{ "Event": { "published": true, "date": "2022-09-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-09-01", "timestamp": 1662076981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "372ef3e8-a57b-4aae-b8c6-e2d622ff5345", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fe18ca-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662031290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031290, "uuid": "1cfed5f5-6a43-4f35-a2ff-fee488381970", "comment": "Malware payload (AgentTesla)", "value": "7cef6d071e260ef6ad970afd3aa1aa58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031290, "uuid": "bf9f5b40-7e5c-4cf4-ba5c-2fab2614b04c", "comment": "Malware payload (AgentTesla)", "value": "006854d4623003bf6b98110f8c8108d97d475055511bd9d222b8d3bc6f39f8dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031290, "uuid": "ad77125f-d935-4c8f-b538-a3a84506bcac", "comment": "Malware payload (AgentTesla)", "value": "10a127cf5caadf7b03c2cc96287b0551cb508ba6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031290, "uuid": "8b4ce7dc-19f0-41c5-bc41-ed5d6e6e4813", "comment": "Malware payload (AgentTesla)", "value": "fbc7b807f16fab6b80be46ee182c5cb53aa0818ff1e9f1ae759c1e2eaa5981ca8d5989216cc03524899604f7d8889516", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031290, "uuid": "17d2d6cd-e0ef-4fb7-937f-072f7647005c", "value": "T1EA24025536F0E817CA641632FCEE84242BA8F9563512DB1A749FF73C1AB33E3144B58A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031290, "uuid": "5f72d206-9fbf-4d0e-baff-0643f113ed59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031290, "uuid": "a1686f6f-3210-42f3-a1c9-ed06203cfbab", "value": "3072:3pFetzVNllIo4o0DHvcvXWAjRylfd4syi7NLtglIcNR3UH5HHMc:3/KoJo07UvrjRylEi7TKNpUhMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031290, "uuid": "c55256f0-8e8a-4c6d-8bc2-c6d97697cf35", "value": 215472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031290, "uuid": "27463094-f5e7-453e-878b-4b7d029eb136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031290, "uuid": "34e7e829-183b-4627-a581-c6d9fb47721c", "value": "7cef6d071e260ef6ad970afd3aa1aa58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7944812b-2a38-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662065755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065755, "uuid": "e39bf2ab-d1fd-4f1f-b1c5-5bc759960468", "comment": "Malware payload", "value": "223eff1610b432a1f1aa06c60bd7b9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAY", "colour": "#B52ED1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065755, "uuid": "3bb8847c-9ea0-49c3-bb5f-540a83072bee", "comment": "Malware payload", "value": "006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAY", "colour": "#B52ED1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065755, "uuid": "7691dfd4-35bd-4d88-a2f9-4ad3b4ed6a71", "comment": "Malware payload", "value": "14177730443c65aefeeda3162b324fdedf9cf9e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAY", "colour": "#B52ED1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065755, "uuid": "5050755f-02e3-4e11-a26e-ad4bb61f67aa", "comment": "Malware payload", "value": "b0eaa7f6581cebd20a6e44d0a491a9c3b8505601bb5f8b20766c166bc261cac6ee6687b86ba079d52b364ef3d8f64c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAY", "colour": "#B52ED1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065755, "uuid": "d1bd2720-a49e-42e7-956a-2e8c4cd86e39", "value": "T1F2047D16A7B1D075E4B6847026E98EF1CE693B320F01C8EF6781176959325E2E135F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065755, "uuid": "b7595459-06d1-4f11-ab1a-cc195cfedfb1", "value": "bfaffd974eb97f13ae5b4b98aa20c81e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065755, "uuid": "9df6fb9f-8b43-4cc2-a58c-d18ab235cdd1", "value": "3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662065755, "uuid": "ee890754-c9b8-411c-8e6d-030137149328", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662065755, "uuid": "2152fb58-5fae-4f4d-bc3b-05ea51a3d4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065755, "uuid": "7e1657b7-b3c3-4479-993b-b40b6cdd6a03", "value": "PLAY.mal_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10ad4a4-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045341, "uuid": "d4e8df52-a388-417c-9e79-02ac626b2ac6", "comment": "Malware payload (Mirai)", "value": "fb25cb9b39e1fc94901753c59554ab65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045341, "uuid": "4a78b931-cb15-480e-baab-42240d4a6820", "comment": "Malware payload (Mirai)", "value": "009dfdd55187c93e24ac100699d5bfcfd14167c72c2b8c8041b72083eb3e313a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045341, "uuid": "4899db45-0709-47c8-802e-2109791a5fdd", "comment": "Malware payload (Mirai)", "value": "272b0537b61e7ff07610a7f2f60af6f0ad7bb133", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045341, "uuid": "23b2caed-4f10-492f-882e-3f741ae9f4dc", "comment": "Malware payload (Mirai)", "value": "f7b250fcd5649d742c8b6260fb1fac9ac61586f6e69e3d14667f36c3a6ec0851f83f556ea7c4bfc90635749072800ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045341, "uuid": "7e3f1aa4-cdae-4926-8308-468a5eea1163", "value": "T1FB23F13A2A268CB9C7503575F58C9B4326D8F9B1D2D978632D288B387FD0D872F59603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045341, "uuid": "ea2c78d3-2900-4ef2-9e97-541b3860da2f", "value": "768:5/TYCoIxdEbM88dvUjA5Xp5J+I1peBroxfO9q3UELbUXfi6nVMQHI4vcGpvg:5ECFIM8qcU5MI1peRkfzLRQZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045341, "uuid": "e12948ba-1f55-4b73-8f80-7f7151aac4e5", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045341, "uuid": "1ac7259b-aeb7-4edd-975b-300a33e2c663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045341, "uuid": "db47a884-470c-4fbb-81bc-893bb4c155e8", "value": "fb25cb9b39e1fc94901753c59554ab65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fc058b-29a7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662003528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003528, "uuid": "61c303ae-ee7f-4bd5-8aee-b7f59b96b8b8", "comment": "Malware payload", "value": "3685d9cad9149ef3c8925f1e94573fed", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003528, "uuid": "de24a02e-e097-47e1-8fa3-12989bd577fc", "comment": "Malware payload", "value": "00fea3e0089625495f57e82d86fac1f0db2ff94ca62d1c25f04652ac8a3fb9e1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003528, "uuid": "8cb428a3-3447-420f-982b-29aa458ed363", "comment": "Malware payload", "value": "c0eb7036eaae0df2328d5c0c56c93304240a7282", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003528, "uuid": "dceb10ea-45ad-4a9b-809c-261e59a396b9", "comment": "Malware payload", "value": "2d68e137f3fb234b8b6a2e9c50a4c2b42e9ea304a63aca0811069ac75840e87463709c5b8030041b159f1b12da020b27", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003528, "uuid": "abe5ec62-dbac-4d80-a8c0-b5fd64a08bd6", "value": "T137E63381F3D9FD2FCC7381324BB5167665864C59C713E203A968B36C98F7AD48A85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003528, "uuid": "5d21748d-4b56-49c3-9548-85a7f19df9ef", "value": "393216:3maBC9u9O4X9uGtUNCK54bOZkLx0hb2XUXT2pQAp:DBVc4X9uGtUXzset2XZppp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662003528, "uuid": "41858071-27d9-44a6-8c7f-8366ab78bb2a", "value": 13999989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662003528, "uuid": "78cb38d8-ead6-4d70-a4cb-c00398ca58de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003528, "uuid": "17d958c6-f5ea-4237-a5ef-ee8a3927b36c", "value": "00fea3e0089625495f57e82d86fac1f0db2ff94ca62d1c25f04652ac8a3fb9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316642d1-2990-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1661993479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993479, "uuid": "b1c97aa8-e03c-4d40-ae34-0820c4c3b502", "comment": "Malware payload (AgentTesla)", "value": "896acb355bec8dcf89f99cc0ca12b8c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993479, "uuid": "2dc99949-bb88-472a-a051-6a1db74ab8ae", "comment": "Malware payload (AgentTesla)", "value": "01b1402aa9583f0b5127ed4bd2abce60d8718c63b6cf048216d30b3beb40159f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993479, "uuid": "cee2047f-1a15-4cb5-9145-7627d639e110", "comment": "Malware payload (AgentTesla)", "value": "0167974837d6894e3d3460762eaf0a6206c9559d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993479, "uuid": "92f79a4e-be79-4cfa-bb7c-2873b49a5ce9", "comment": "Malware payload (AgentTesla)", "value": "c988477f6c493d4ef6cd77f43ba65979782dd64505d0ce8b5fdfa9e25bc1c405d649fc9567f31f91da87846f0158b150", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993479, "uuid": "af919ba8-869e-4bc9-bce8-4ed9ec4551bd", "value": "T1E3A2D5C1EA840274ED6A4F3454B32E59027FAF99BD68F60EAD44F0267A736C3043166B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993479, "uuid": "80caad4a-bd6e-4180-a925-be27129dc046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993479, "uuid": "a66b28a6-2337-4b1b-a0dc-0b0bea7f84a3", "value": "384:FHGwDJIeYcuTuK1qUUDO5MUNVZIOb9WECC:4wGguTLqTDO5XNVZZb9W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661993479, "uuid": "11307a53-112d-4a94-9fad-8186fae17726", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661993479, "uuid": "88ca637a-be18-4a1d-b361-085dbc8f476a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993479, "uuid": "f6dc5ef4-76ac-4b6c-ad1e-92f5b3c96375", "value": "20220823_77466465553654,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d0f2d4-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662006766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006766, "uuid": "750c689f-71a4-4b0d-8361-c7ffb12e0193", "comment": "Malware payload (AgentTesla)", "value": "857229535073ac1caeec482346c7597a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006766, "uuid": "a268a95d-5a3a-4df4-afed-91787b54cb53", "comment": "Malware payload (AgentTesla)", "value": "03769c014c17ced8eabe8d2bc442c7bfc5e211e817c1ec9271654d9aec164ea2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006766, "uuid": "a8f93cae-bad9-445e-91d2-797c958d7f1d", "comment": "Malware payload (AgentTesla)", "value": "7e5dddcfe7c732f85a5c0520d7f5e27918e17824", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006766, "uuid": "7a6f6d2c-e67b-4774-ac34-1200da972fdb", "comment": "Malware payload (AgentTesla)", "value": "f9dc519b6e623c28604d67e761653c5344434c2c5fa0d7ac1ddb00cc4afcba67a13b98b64ecc85656cf0cb25c07f61c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006766, "uuid": "acad524a-39be-4bea-a7a2-802f5c6fb627", "value": "T1B445024A764483B2E8127AB00A31F0748779FD75D570C2D56EDBBBAF29F8B03511B60A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006766, "uuid": "80fb28ab-beeb-47f2-89ac-53e1d37d5fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006766, "uuid": "527f3439-a73e-4555-b0a0-100a573c0ea9", "value": "24576:/Z5MXY+mzo3bvoxqHnFDvrNeOxsTBpzVMA3:B5KlmzMQYnRvrNEMA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006766, "uuid": "98f03a93-98fd-487e-913c-947649dd2b3b", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006766, "uuid": "1d7661b4-f406-4fed-9657-a8b4a05df59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006766, "uuid": "bbf138cd-46eb-49a0-8084-c7beffd0d8a7", "value": "SecuriteInfo.com.W32.AIDetectNet.01.15861.29917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9991512-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030188, "uuid": "9e04f9c2-bb90-4bbe-8425-7ebc611e2dee", "comment": "Malware payload", "value": "b6dc9ba009d68322a855705bdec21a52", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030188, "uuid": "c3f65d1f-3395-4c92-b61a-814097e243bc", "comment": "Malware payload", "value": "03f6c8f173413302d9c22a44a593fc9a5203fbb7652d3a36b3ace79f3cdc39a3", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030188, "uuid": "cef30861-1e86-4392-be19-b535db4d72f9", "comment": "Malware payload", "value": "826827a41805c9641430dddf3d1f618da4f7a0b1", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030188, "uuid": "5bb4bd2a-e660-40dd-a115-bfbe31d2cfe7", "comment": "Malware payload", "value": "bd6212c5e4482e085391eab6ff1591c3395fc2d45d463ef2f46a25dfa7e9cec4acf8b1e662257311eb5c0eb53d7d8151", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030188, "uuid": "76733e20-ad3d-4d97-a7c5-e80c00c97854", "value": "T19301A2081A993B31D372CD3B44D9A317C8353C13EDA66F1D02A116952575500EE35E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030188, "uuid": "9ec7fcdd-2c53-4af7-b0ff-9dbdbe54ca01", "value": "12:8AlXr0C3pQVe/4VdiGlGW+fFKpiumZK3Lu+GSYlZL7alDmNf7+lbYqlKBnml1kK:8ArFpQQCiG1+fwYnZxnD3Wwzab/oS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030188, "uuid": "d4312d69-34e8-4e3a-bacb-9b71bc733565", "value": 842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030188, "uuid": "fa3ad173-5fa1-4712-be0b-08a6457e996a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030188, "uuid": "d45ca196-d6b2-46fe-b87f-7a16b359526e", "value": "03f6c8f173413302d9c22a44a593fc9a5203fbb7652d3a36b3ace79f3cdc39a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af057560-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030197, "uuid": "df71a1aa-9bae-4ade-b49c-b223354743fa", "comment": "Malware payload", "value": "326a9bba4f99110086a4ab1840f9fdfa", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030197, "uuid": "e2e4d33d-7bdd-4d25-bbac-f3e6663115be", "comment": "Malware payload", "value": "0484c7ef48d7b5361e7d99d94339f748b1b12e0e83007a65da76dab54f4e373d", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030197, "uuid": "ddf9d37f-8ecd-409a-a675-f2101915de9d", "comment": "Malware payload", "value": "ab159283522b98e1b394d6eabd98b43c7d6692d2", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030197, "uuid": "ec1f3901-6c80-42e1-9d81-17dd469dc98d", "comment": "Malware payload", "value": "92d0defbb0f627368ed819e7b3589f974adff2bd28aee4cf341e170d5be437219676aaa2bd38f2b9ed164a92c44b3bd3", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030197, "uuid": "f0368274-8356-4536-90d6-567d14ec0e84", "value": "T186A1842516093A4FCB274312FC7F4B5CC7B108B42D9E9F982093C89AB65E9C7B16961F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030197, "uuid": "8d096485-c2c7-4e6c-9eb2-0505626f645f", "value": "96:OQHA8ytIbBMgIoycdIKQiJgS9Fqj2sEjjY+4OvI7C2ZzYJ:OQAtudMoWiPFqSsEjjJzpwzYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030197, "uuid": "92c9d862-24e5-406e-a563-48e1603dac55", "value": 4743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030197, "uuid": "798e7406-eea0-48d8-870f-7dcfe8797015", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030197, "uuid": "4adb08fb-b6c1-49fd-950f-09529f4b2b3d", "value": "0484c7ef48d7b5361e7d99d94339f748b1b12e0e83007a65da76dab54f4e373d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07cdb04-29d1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1662021664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021664, "uuid": "0367b88a-2aaa-4765-af9f-88edb817c2aa", "comment": "Malware payload (AsyncRAT)", "value": "19af9bb64e3a638c2093ed17559978d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021664, "uuid": "8d126e4c-5045-4905-af25-461c6cfcce35", "comment": "Malware payload (AsyncRAT)", "value": "0495c0518c4d8f7cb71cdfdd10f4736e11d5d2c7bddbebdd735cf79a86390981", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021664, "uuid": "3c92f59a-926d-40b1-8ee8-bda7be47c65a", "comment": "Malware payload (AsyncRAT)", "value": "1104289e3783c48e5ad6961eb836927792a8c620", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021664, "uuid": "71d93ae1-8ed1-4e63-ac24-ec8c090b5cb6", "comment": "Malware payload (AsyncRAT)", "value": "6c71566a23ea66faf74f5539aabaf496cd2fadf7050846908cdd1f3cdb7d9ef4d40baa9a41f08ee721a512ebc2ac31b3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021664, "uuid": "4f425dc7-ca53-47a2-b770-21315455fc94", "value": "T10A227D38E152FC0AD121083CF06582F4E7594167AA22B96F1019B2ED47A0BD34BDEEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021664, "uuid": "80c54523-e733-4662-a9df-23748f601cd7", "value": "192:ScIMmtPf+CUG/bA3/w2OcrdlJFmQDZ7rhhap30EZ:SPXumAOcjJFmIZfhMFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662021664, "uuid": "1ea36f92-d028-4554-88c2-55329b2bab7c", "value": 10339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662021664, "uuid": "bb67e752-23d0-4345-a6c6-ea4ab122f6cb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021664, "uuid": "36c7e3c7-9b0a-4232-ba30-cce0cbfc634b", "value": "104 LEFTIES SAMPLES.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7aa7a8e-29a7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662003664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003664, "uuid": "ba4bcb6c-2bb7-4cbe-8e4e-2dd343c00fd5", "comment": "Malware payload", "value": "d78af4728a84370842cb82b98c543e7e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003664, "uuid": "63338a88-64f4-47e4-a568-7f75c630e486", "comment": "Malware payload", "value": "0499ed828c3a4f5581f774f9ef328fe8a7e193c21bd293e2a739a172da056f06", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003664, "uuid": "534b2ae0-5d52-44c2-82d0-ad7f73926949", "comment": "Malware payload", "value": "a4cd57ec2a34bfb350bbf1c490aad6eb8eb61a8c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003664, "uuid": "6ffda5ef-8856-4345-901a-8705cb463cff", "comment": "Malware payload", "value": "a16be6c8b462ad4275e768774ce00c8e44c505128d9b5a93739575c034a96a06d856e95ca9251d2111ab446662dee9b0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003664, "uuid": "3bcbcef1-6401-4944-be0a-dff7765bc1ac", "value": "T170E63381F3D9ED2FCC73C1324BB51A7665864C55C713E203A968B36C98F7AD48A85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003664, "uuid": "07b87962-087c-4ae4-89ac-6e579b5fc1f7", "value": "393216:3maBC9u9O4X9uGtUNCK54bOZkLx0hb2XUXT2pQym:DBVc4X9uGtUXzset2XZpzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662003664, "uuid": "b0ec1955-cbfb-4fcb-9493-5fb2d792de28", "value": 13999989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662003664, "uuid": "ed2578f3-8139-4aa8-8866-d94ec04a661e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003664, "uuid": "13b6a4e3-97b6-4ba7-b20b-2d494dfe736c", "value": "0499ed828c3a4f5581f774f9ef328fe8a7e193c21bd293e2a739a172da056f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb18cca0-2a15-11ed-93bb-42010a9c0043", "comment": "Malware payload (IRATA)", "timestamp": 1662050860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050860, "uuid": "665e5380-6736-4f72-91cb-c78b7b932829", "comment": "Malware payload (IRATA)", "value": "8ef1ab67f230739956d1330689f8a909", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050860, "uuid": "1beccea4-d688-44bd-a648-f915dc14fbe5", "comment": "Malware payload (IRATA)", "value": "07f84479a0d5efc5723d7124ff0b32b7e7afecd6075c78ee84983cbfa0769705", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050860, "uuid": "9c4ff7be-4cff-4cdd-b761-8288dd7b1dfa", "comment": "Malware payload (IRATA)", "value": "6350763cf8a0af436f3abf8a43a812fd4c0fff58", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050860, "uuid": "75c82a34-e9ac-4fa2-abbc-20e0c1135861", "comment": "Malware payload (IRATA)", "value": "dcaecaa99f8fda114794fbee898515fc4230b10efb0128ce52768bb5e16725626eabd58712fe2f677e7987a7f173aa0c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050860, "uuid": "0bb010c1-7151-4dd8-842c-75fd065e85bc", "value": "T1BAF5332BFFB7E420EA93E03C56A5F65AC89D12ACD614FF4379E20B4D48F1E498642D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050860, "uuid": "e3f2111d-1235-4909-9c46-79f83492ce91", "value": "98304:IEVF6aL7fDW3v0AMYfccAxAWS2NPEMxmJRLCkS8dlhgFi37:I46x3vKcAxhSqPEQmJhS6N37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050860, "uuid": "75ac6b7f-f310-4a7d-bb60-480dacfbb5ea", "value": 3423284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050860, "uuid": "5067fef8-fad3-4770-8c00-9ca385d95535", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050860, "uuid": "11fc991d-5661-4fe1-b682-0837c149585b", "value": "gen_signed5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b298d1b-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662031265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031265, "uuid": "481694c4-4c5f-473e-bb69-1ad16be08d2b", "comment": "Malware payload (Mirai)", "value": "77ae8b019386fdb719e4be44151f7820", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031265, "uuid": "74591c23-8fe2-4ab5-84cd-cb8c6efb8d1b", "comment": "Malware payload (Mirai)", "value": "0882e2f173f6c834c85dff214f9f57a1b0c52884393c99d461a76c59ab71aa51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031265, "uuid": "cbbf342c-aaa4-425a-87b2-700fd16c5315", "comment": "Malware payload (Mirai)", "value": "737af5a08c95c1c37f1442f346e8282cb39ba293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031265, "uuid": "96a3ae72-f035-4694-8033-7c9708fe80f5", "comment": "Malware payload (Mirai)", "value": "bfaf85cd41752042eed506a3e5304847d4f78e8c3feddced4306aa056bf4b00a98f72c7a329927a26ee9bca7ac02c1c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031265, "uuid": "6f881462-2ca9-4713-9371-033397b28c6b", "value": "T162833A92F9829612C1D5267BFF4E528C332253EDE2EE7213CA295F2537DB46B0E67010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031265, "uuid": "18e4093c-5dad-4d9a-af2a-15c05bb8ba6d", "value": "1536:jgYnfB5ev9xWyy0esna6GVAE8m8uR+hWposk/MvGP8Okc:NfWVUmFa64A5m8ius7GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031265, "uuid": "9b2557ab-cd74-4483-aa90-5c0071257277", "value": 84380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031265, "uuid": "f8e46cc4-994e-4ff8-8350-4abae54fb8c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031265, "uuid": "3cc0f473-9f97-4734-aeed-145b1d11e89a", "value": "77ae8b019386fdb719e4be44151f7820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991a6c96-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662028443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028443, "uuid": "87d60fe1-4990-4e2b-8400-6dc077973ebb", "comment": "Malware payload", "value": "338d9090a57e6f67043de05aa4d16c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028443, "uuid": "3f017d18-9f01-4999-a084-778de8f882d6", "comment": "Malware payload", "value": "08cf971e4dd5ce430788a6d4d510106e0a9964ac32e4bc283e5c055a33778792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028443, "uuid": "fe413b8a-ae13-4e51-8836-1df980b142f2", "comment": "Malware payload", "value": "be4f9c52f88e5ec102cee6382122b0a2a91f3899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028443, "uuid": "3b08f5c2-2218-41d6-b08e-56401779d866", "comment": "Malware payload", "value": "32e1796870fd889958c3a913da39cb7fa22ba491e6b40083326f00eb9a14d486c73179815efe2125df6fb0450092ae8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028443, "uuid": "2f7f374c-2dc8-4e57-9419-dabdafc6cd16", "value": "T13794BF1833908462E91B0A735422DFF909797C604FB0591FB3E9BA3F6D33793592A52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028443, "uuid": "2c37e041-b272-40f1-9a60-e5f1f60b611b", "value": "f2057f7f292a3515bba46877b01386f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028443, "uuid": "e0cfce1d-4f5b-4ba9-8462-e2966f8e8fb8", "value": "6144:kQ2K8iSVfokL2CMErDlJ8+9RtS81LJ2yUlhb8XkNnqoW1whQuiWb3h:J2nVAkyUnl2+/V1F2YkNJWAzD3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028443, "uuid": "e9c55cbf-a335-41fa-8a58-6728349fa14d", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028443, "uuid": "71effec0-b3e9-45fc-b707-ba8c6d1bca2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028443, "uuid": "45d620cb-3b6c-46b7-adcd-c3fbe3cfe890", "value": "338d9090a57e6f67043de05aa4d16c93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096dcd5f-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1661999425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999425, "uuid": "04ed6b03-b869-4366-ba4d-60c6b296f4fe", "comment": "Malware payload", "value": "b9ff04739bbb928557efd1a174f57afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999425, "uuid": "7c20ed45-aeb9-4d1c-952d-d4620a755067", "comment": "Malware payload", "value": "0968e15d6ef1a801b7d9db6e37c557d3e2b39ad92ca7f39b23f28e1491bd9038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999425, "uuid": "ed8be00c-bf52-4cb6-9f68-ea05c5cb9830", "comment": "Malware payload", "value": "1d2ae15715e8ad7547e568bcc9ef3f23f3cdfcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999425, "uuid": "50edc5ac-3a3e-42c3-9b92-6fea3b25bae4", "comment": "Malware payload", "value": "3b803780883096b406d081f362fc4e0d0e65bec7e8c27a210999e59c5b5ce08ef87bf31ac735a3decd60a3748e133067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999425, "uuid": "b9d247aa-c693-4269-bc7a-eecd52270b17", "value": "T14C81650C2678A763EB6F423D5D47353248FA413B2255D6863CC062CD66EFFA10F0B8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999425, "uuid": "9f76cb2c-25a0-4638-a1c5-876536c5b7e0", "value": "48:6T/MiXOoP5t5FhHT09XKSC1go8K/XojJEFBwlY2izXlNvecBzWq2RYhE70:UEOEnCuORFBRnXTy1CW70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999425, "uuid": "24cf7703-e3d3-4e48-ab90-eb2965963057", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999425, "uuid": "6dc8ab27-003e-48ca-aa62-371764201fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999425, "uuid": "ce0b1f75-d4f2-4dcb-98a3-21db3d1cbb5d", "value": "SecuriteInfo.com.Trojan.KillProc2.18435.23840.27870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758c6cc7-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030960, "uuid": "5cb6df4b-6f33-440b-a626-bf114bf81833", "comment": "Malware payload", "value": "0792a7de994208de43b4c361e7ab2c1d", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030960, "uuid": "7ef27fd9-40ae-4971-aa12-db35aaa5c6ab", "comment": "Malware payload", "value": "09693d0d2ecf0f1f4c63e14609980424df1bd4bb9053170a3f5cd5286293e011", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030960, "uuid": "b59ce2d3-2c79-486f-9517-3f75460a3cf1", "comment": "Malware payload", "value": "970cf349557a4630a2194cf5f86b0d24979b0e1f", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030960, "uuid": "dad71098-1111-48d7-a60c-aee81c042a72", "comment": "Malware payload", "value": "9e507aaac8abbe7a1f7d4e66a05c0f1f5bec6ab353f3bf0817ff68a139c847ac4864e2d40d359e2288e04132a4ec927b", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030960, "uuid": "ff514e19-8d2d-4018-ae30-c96312084265", "value": "T142C32FD43AF208407D1B1E9D7EC4A71E560EB3455EA9477210E9E0EEFE81D626C1E8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030960, "uuid": "71a165c2-ed9d-4c57-a04e-87e7ea3ccdf9", "value": "768:t+SmR1ac2kLe9YPzpmc6iLUT+mh1dOZzyZCe7zU4gblMSI:028IYYwLdqd8RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030960, "uuid": "4b1f3519-ef46-499a-ae22-717c1f971f51", "value": 119644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030960, "uuid": "d5a8e06f-8318-42d4-a732-1d801b952e6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030960, "uuid": "25563ab3-a279-43af-9ab6-abf93a619a7a", "value": "Pe.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5a9ba9-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662028126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028126, "uuid": "bcc6299b-f5a4-4072-85a6-ce8e2b6c82f7", "comment": "Malware payload", "value": "85e02c88448d1594cd14ef2bfbbfb5fa", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028126, "uuid": "666009cf-018c-4e07-9a8a-f2507fcb0863", "comment": "Malware payload", "value": "09d4f87ce2375b99b0940690be6e9cf02849ba525978bdc5af74c8241c10139f", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028126, "uuid": "c007cbf7-2a83-4155-9620-38db9667075e", "comment": "Malware payload", "value": "e1122706624b1b92938c2a78aa2ec06b9d6c3644", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028126, "uuid": "313c1622-310d-46a8-b15a-fdac87fa4306", "comment": "Malware payload", "value": "b13da019187e45f1014efe803fcc9d44cbca027aa5b9a7c6ddaf80baaf77fdb5fc5b7cc54c6ea0385316318de67ed49d", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028126, "uuid": "5e36c8fd-9712-432a-92d0-ffb18f3bdb03", "value": "T149C533837CEB17E089A33CE5208F9D85B43C45056CAB8BB775456632CE90852BD46EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028126, "uuid": "08b7420f-3dbf-42ed-8722-2715d5ae7c68", "value": "49152:bl0SQPTvZkpnEgTHVXPKf6tYHj4vVWJwNdCCMl/EevRN7q58hOLiArOoQ8:pMapEgIff49WJ2C3lsevRxciUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028126, "uuid": "1a46eb09-11a8-4488-8fea-3d62134a0369", "value": 2687965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028126, "uuid": "8ccc0ba3-ddd3-4141-bd19-6367d622c0e6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028126, "uuid": "0fa185f2-3ccd-4ae4-87b2-09817ae16b89", "value": "XML-NotaFiscal0.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777e2f79-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1662028386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028386, "uuid": "fb27a02f-f7d3-477e-bd8e-fe550bfa71bf", "comment": "Malware payload (NanoCore)", "value": "b6bde5f67978d6c6c6c69cab3f153d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028386, "uuid": "02a8e151-36ad-4ae5-9fdc-321471210566", "comment": "Malware payload (NanoCore)", "value": "09dd6583fd86456eb27a538618a89a564710957290f8fdf01fab144f5ca9388d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028386, "uuid": "8e6d301d-bdf6-41d3-992d-d03d21167225", "comment": "Malware payload (NanoCore)", "value": "eb1ddcab9935ee77b128c63f1e72113c8169d836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028386, "uuid": "59aab97b-ba7d-4b7f-b765-b3ddb9388315", "comment": "Malware payload (NanoCore)", "value": "aed41c27c95e2ea3231790ad061203a58a0238bb713e4c97649752d21cfe1bb5bbb4d7185beca15d967e841aa01ea232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028386, "uuid": "1c0fff16-3a50-4865-9bd1-1f2feb9a22ec", "value": "T1342512856A84C3B6F0170BB011B1F66882BD7E12D271C6DDBFCFB2E845B5B029257A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028386, "uuid": "306b8871-5d5a-4164-847d-d776cd7e0e63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028386, "uuid": "eea7b079-5099-4f70-b6e7-a5b37159288d", "value": "24576:8Z59nQwe07vYzvRxCYUfnOALXY+mzo3bv:m5PeUAzvRxCYUfOAlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028386, "uuid": "ea142b7f-23c9-417e-b004-3033d2ecf368", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028386, "uuid": "c71bfe72-eca4-4bfd-8fbb-625461e39b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028386, "uuid": "0eef2e68-031c-48e4-9ef6-6b6a8c4bfda7", "value": "b6bde5f67978d6c6c6c69cab3f153d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e8975e-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (Hajime)", "timestamp": 1662006770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006770, "uuid": "3359ecf0-26a7-4e8e-9c2b-6d3eac7447dd", "comment": "Malware payload (Hajime)", "value": "5fd716e00793c325e6e8b511a9dcf892", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006770, "uuid": "db77a16f-938d-4991-b904-5ab377410873", "comment": "Malware payload (Hajime)", "value": "09f828e39275306539da1bc2fe9a22e32b7f562956b1a5a75033fbf8c31a5fa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006770, "uuid": "9e6307d9-612c-4a72-92e2-0e497fa39bab", "comment": "Malware payload (Hajime)", "value": "79b81f6de5120973edf76723b6b13cf519e137f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006770, "uuid": "5a2e5682-5ef4-4c7a-81fa-30a746328d87", "comment": "Malware payload (Hajime)", "value": "0724d53e6ea5043df6050d69230faca48a202fad316d63baf1d3c463fe57326bb12867b21ff0bc3fec7b01d55481ea87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006770, "uuid": "8fa83fa9-fa16-47d3-8db7-58746909db0a", "value": "T1E982D0A123913958D732CF783BE8380B8058591771695B042DA0B619D92FB205CFAFFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006770, "uuid": "a1ce101b-8607-4c29-a032-78cd39e079ff", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvrY6jdE7Fj:yb2eX3zAKuiNPZRwwqdvrrduMXbCAkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006770, "uuid": "af1e2ced-a6bf-4499-822b-bc30c6ec862f", "value": 18720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006770, "uuid": "b2c6575b-3d67-478f-9a65-00e7e85eadd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006770, "uuid": "5de293d6-a5c0-42be-aae1-5a46a720dd77", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.25927.420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f5ccab-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662043391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043391, "uuid": "31577de6-a06e-4a71-aa6a-b00e00939eb8", "comment": "Malware payload (SnakeKeylogger)", "value": "7f51558de4fac4bcc84365e280583434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043391, "uuid": "09c9cb86-4415-480c-baa1-7b82bca12f0c", "comment": "Malware payload (SnakeKeylogger)", "value": "0a2a09cb156988a9501c8dc1ecccc6cd1af9e3c8eadcfd669e43484cd6342749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043391, "uuid": "c8af90f0-8ead-45e2-8f73-d08bbe733935", "comment": "Malware payload (SnakeKeylogger)", "value": "3d3ba8ff6240cd6b006119c6040d004ab0427165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043391, "uuid": "0dc8334d-c429-41de-bac2-d2c0b96d92cd", "comment": "Malware payload (SnakeKeylogger)", "value": "f7162b61a5bbbf2ac62aeadc5769e08b6b78850380c1821edf9f548afbc7fb2258b1fb4e364d0f816e4ba51838758565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043391, "uuid": "d4107b10-aabb-40b5-940a-ca734024c5a2", "value": "T1D8150249958483B6F4261BB011B1F21496BDBE15E271D2D9AFCFF3EC45E8B429207E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043391, "uuid": "9d76af45-fe07-45a3-bfad-f87397625909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043391, "uuid": "f9fddf3f-eac1-42a5-a0e3-6387e22290c0", "value": "12288:kF75eUgPwqoXY+mzoRtbvRT7Q3TcD9b3T29lGcKG2zjVcb0HOmmKq+QFty5uzaR:kZ5/XY+mzo3bvOTctTklTJ2a6uHy5HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043391, "uuid": "f905a72f-5af3-4f78-bd1e-2831a54632a0", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043391, "uuid": "b1987ccd-8418-4bb8-84cc-fc4cf5ec664c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043391, "uuid": "74f4b3b7-a439-48be-bc6e-cb8f87ddec11", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01c839e-29df-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662027622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027622, "uuid": "4dc571ea-f0a1-43f3-9533-20890bc42786", "comment": "Malware payload (SnakeKeylogger)", "value": "d2ff91ac498c78e3b2a173f46b28f3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027622, "uuid": "d9b92b69-27b8-4be3-a8e8-4ff7f4db6481", "comment": "Malware payload (SnakeKeylogger)", "value": "0b0f09d889e6277dbbb2eb42bb4fcddad9e8cc9bf98a9d39a9bb108d1d5a3059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027622, "uuid": "83097069-2ccf-4879-abbe-99135befe4f2", "comment": "Malware payload (SnakeKeylogger)", "value": "c658390e95322c1d3a8858898a8e1ca8bf0cdb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027622, "uuid": "dbec8a81-d369-49b0-a241-2f40ff714c27", "comment": "Malware payload (SnakeKeylogger)", "value": "424a57d9a1fe6799469ff44559f49499b21c58c5f8c96becb09b3feb8a6b260962daee9124caa56a2f3d08bfb7222bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027622, "uuid": "e3386a32-2ac5-46a7-94de-412f6196473f", "value": "T185841B2D3A210A62FE0DC0304D211A09FB6E4BE7236CE99157DF99CB876F2356D59CB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027622, "uuid": "421eefa1-f5a0-4a60-aa09-91dfbd8c854f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027622, "uuid": "295aee4b-3440-4a25-b27b-12897f1f7c61", "value": "6144:I2Wk1ZCKzCoYh966Hvf/o6smP1o5AxodniEvU5A7BqVB9PtGXI2TZsoMFTYG9Cw:I2WkuqCXDxnw6smP1o5Axo9ictIKGUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027622, "uuid": "95d9fbb3-7342-421e-8c76-6380226f77ef", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027622, "uuid": "3859d47f-f566-453f-8316-573e256ec455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027622, "uuid": "decf95a6-6f50-4667-a12f-2198dd95a14a", "value": "IMG3000182.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8b19c4-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662043531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043531, "uuid": "262ba80c-6594-4974-bb86-f2482ea236d6", "comment": "Malware payload (AgentTesla)", "value": "9e03ae381f6833b8953e749d30ea8497", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043531, "uuid": "53259958-23a6-42b6-921a-7b739b7138a5", "comment": "Malware payload (AgentTesla)", "value": "0c456f8ea59bc473f8b91cd1ff24a5d7dff0e830b3f590de9afcdedbfaa24ccc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043531, "uuid": "1c73c995-2794-4d94-bd72-2eaacecc2de7", "comment": "Malware payload (AgentTesla)", "value": "cc0c9c6771a400c83f4741ddad3bf3d083f1ee92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043531, "uuid": "4184f236-847c-4a90-8775-2321f01d11a2", "comment": "Malware payload (AgentTesla)", "value": "20bc43b11feceaf7035a853d44996aaac18c0b011ce41e5ade0bc08b43978ae2fb4c10303f48bf6ea57c55aa96daec25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043531, "uuid": "7990c4c8-e293-492c-9fcc-882703129446", "value": "T17995E08AFAD1414EC40653B588EE6C5452DE2B8DCB9FD30C78EB675B792860AEC045CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043531, "uuid": "e37fcb64-515b-4374-9047-c14e7b575abe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043531, "uuid": "a249d456-d3f4-49f8-b8e4-12400d850bbd", "value": "24576:uMxY0BAukOumVUg0dYWi4mnu1QCcLtfChaGoj4GEdPnE+sBz8kJsgEYXsKO71Y8:bCuTx0P7mnGQCcRChk4XyDBgmvO71v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043531, "uuid": "ef53601f-8b7e-447a-9b2c-6c7786dce745", "value": 1967104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043531, "uuid": "513989fd-0bce-4ec7-ab3a-e0359510b18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043531, "uuid": "339c2321-ac50-4a34-a33b-765bb87236a0", "value": "SecuriteInfo.com.Trojan.PackedNET.1505.29145.25484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e8b95a-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014635, "uuid": "4b72cd32-5839-4308-bf49-cb6210734e22", "comment": "Malware payload (Gafgyt)", "value": "9051aa230451f9dd2e388101143d5668", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014635, "uuid": "0c6ca284-54d1-42b2-aac4-4c3c851ad00a", "comment": "Malware payload (Gafgyt)", "value": "0db657e44b848bb7e4661e0dff53c53e30482fd568ba93d2e4264e9b0e50e822", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014635, "uuid": "99e00a7f-4fb5-4fb1-b441-49144b7b9edf", "comment": "Malware payload (Gafgyt)", "value": "d341a2c63f88e1a11fcd82eb70bcf90087b05fbb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014635, "uuid": "c92914b8-9768-4a18-8cbc-9e73b25dbb85", "comment": "Malware payload (Gafgyt)", "value": "a33c3ffcc0a4b7a30bfaa27082ddcb2a8bc35be10b56ca3075a05eea40daf08a006b559cd91918fe8f69df5585fd5819", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014635, "uuid": "b9183f89-1123-4eb3-9321-2526d82ddc52", "value": "T175836B23A651C67BC0875BF92BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014635, "uuid": "c7ff3fdb-3ce8-4c41-a569-66ed1890982c", "value": "1536:eB7cH1LhKlBqIKVhuzdPQq0aJP9sWtjG7ew3njLWODPPmoIYuOVje+ZNne:eRMhKlcluzdPv0o+QK7eknjL1DHmrYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014635, "uuid": "10ee3766-6f27-4746-af48-a829c1a10dde", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014635, "uuid": "4cf9458c-affb-499b-9aed-fb213a88ddd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014635, "uuid": "e6323d8f-a089-43fd-a822-57f71e10b161", "value": "9051aa230451f9dd2e388101143d5668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c4534-2a02-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662042591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042591, "uuid": "44ddbe42-fb78-434f-9421-34a69c143d43", "comment": "Malware payload (Gozi)", "value": "9401560f606e617d88d3001f7e54c31e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042591, "uuid": "00ec096f-1139-4421-841a-f48a5ea46435", "comment": "Malware payload (Gozi)", "value": "0de05524e9e2c94220be1df9f09d2b3a3b1d15a4659f69f7bf8271366ae0a91b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042591, "uuid": "5d895498-e212-4eef-9896-6a8e75fbd202", "comment": "Malware payload (Gozi)", "value": "df9822733711e7b7948786703b6123f25b57bf94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042591, "uuid": "39965949-1055-4a9c-8958-8cb414093b9b", "comment": "Malware payload (Gozi)", "value": "697cc4220cefa8d31b6a75e289d5fcda418df6ac0da71cfc439c0ab63cafb7fea248739bb06fff181224e96b793ffb52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042591, "uuid": "35326959-4b70-43a2-bffa-c83d7f24f5eb", "value": "T15C03E1B45C0028B7EBAE15371321A01E75B6C2C1451A4ECDD371E8DEA65E926FDBC34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042591, "uuid": "a05efee0-f3de-42f3-8a5c-973a1e57e797", "value": "0d3ce1aa4e05aa830613233bf85702d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042591, "uuid": "0c0edd38-39e7-47af-95b5-eb56bd1b374f", "value": "768:A24rU7eukUXM7dWVvuyTdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38u3O:KaeuZM7MQideD8B56w39HE384h387", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042591, "uuid": "792541d9-2713-4146-8069-ae9417e8baba", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042591, "uuid": "7b14d32c-cc06-4802-a2dd-dc793e3642b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042591, "uuid": "f4a0d61c-7bcb-4143-b860-4517addd60c0", "value": "10000000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c7b1f7-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662043233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043233, "uuid": "6b632e5e-bddf-428d-866f-e6fa272f03f3", "comment": "Malware payload (IcedID)", "value": "2b370ef93ae0232a0affae4661377b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043233, "uuid": "b145d502-ca5d-4365-b07d-0a487b4aa855", "comment": "Malware payload (IcedID)", "value": "0e0087a8c593a71fa508f52a6f4f66ec1cf620ddc6855ce5addfe3eaea37e3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043233, "uuid": "68a8c803-328a-4ed4-ae3c-f4b4b73ab73e", "comment": "Malware payload (IcedID)", "value": "6a77eeef7f89f2552e918c62051be6f7cd4768ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043233, "uuid": "19abd067-f39e-4981-b66d-6217e880aebd", "comment": "Malware payload (IcedID)", "value": "5ee96a5920fdc6424887e58b83de142083cbcc5dde28ff600dc6e0a3b207c59155a368abdfb3d386011eb418bd9f11b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043233, "uuid": "ef060b4d-c68b-4590-9be7-317afb56e032", "value": "T15A7419DCF246B4BAC6666775C11F5909A23C28F2764CBC40D99A88D81E351B93263FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043233, "uuid": "153af811-2ca3-4a9e-994e-db13fb660c8a", "value": "4e013a8dff9f649aada694b345eaa2e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043233, "uuid": "db011051-aa4b-4169-8633-4d4dbf406b08", "value": "6144:cG0DekUg++nFEN0GjeW/JVD5N9D37NKoCaG201:mT/AeWThe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043233, "uuid": "87097d7f-f592-4921-86a5-4c5817f517e0", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043233, "uuid": "f9d505f3-d4ed-467c-b2ff-ab607f86f8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043233, "uuid": "002ab483-9969-4fd2-878d-8cc4e36c1a0c", "value": "fZNlvgJ5.TmE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9269950-29d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022510, "uuid": "bde04acb-e5a4-46bb-96d7-b2367976557a", "comment": "Malware payload (Formbook)", "value": "ed50513b926ef3d4c7e0cc8c05d9528f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022510, "uuid": "95baa8d6-4a32-4b02-ab23-70adfe6b2bdd", "comment": "Malware payload (Formbook)", "value": "0e0dbd77f23d8c81b21d351b9a85d3fae401bb4b8ef5feec7634264671eafd1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022510, "uuid": "f2419f63-b2d3-4b30-a59b-5f3162ad2e1c", "comment": "Malware payload (Formbook)", "value": "b80593e8cd03650cc5cdae49e23c8010faa24968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022510, "uuid": "b1fc72ba-69d5-4193-b1cb-eef13340375d", "comment": "Malware payload (Formbook)", "value": "f5f2271ee69d6ca624ca4ed1ce039600fdbc926f3867b4185da9ffbaf19eb06f4cb8b3a7a66086f0e1ebd4133f19700d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022510, "uuid": "7df9e42f-f799-41d3-a3ff-a364e454c938", "value": "T1872502495680C3B6F4262BB111B1F21596BEBE15D171C698BECFF2FC49B8B029207B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022510, "uuid": "55bcb276-0b82-4cb5-b153-a0fc57ee3898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022510, "uuid": "b04457b0-5e16-41cf-8255-0984c72ddeb1", "value": "24576:LZ5nXY+mzo3bvOnUITyzvj621E/kXbnHX9gnhEuW8:15XlmzM2nUuyi21EGbnOhEuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022510, "uuid": "506971f5-a26a-4eb3-81b7-235648c83886", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022510, "uuid": "90aad425-487d-4c73-8827-efb05929ab3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022510, "uuid": "2da7108a-2b49-4a22-8ee2-26a8e4e69bde", "value": "$23,248.98.PSWIFT.PAYMENT.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc27597-29fd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662040480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040480, "uuid": "a4a29a8c-a019-49f4-bef0-997c8cff77cf", "comment": "Malware payload (Smoke Loader)", "value": "8d83d963e09920861dc3e5d612ef6ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040480, "uuid": "f763e9e6-af9b-47a8-9c83-4fecad8977c3", "comment": "Malware payload (Smoke Loader)", "value": "0e2c33ba809d4ca3aad2432134e5893f7ea45d101107780b09b1342a245228e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040480, "uuid": "0e6836e6-0591-48ae-9096-89c96e11c83e", "comment": "Malware payload (Smoke Loader)", "value": "d531ee9c47984dcb2200cb44dadca585461d8784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040480, "uuid": "aefa63f0-ba3a-4242-a9ae-cf8ff558bbca", "comment": "Malware payload (Smoke Loader)", "value": "d4453a87a27e41ac619ebfcd1a0d80f67f96e333aa2e444fcbc23d5d6a2f3e4ad4ecf0e16fccb1ae80c41867db912f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040480, "uuid": "3c157bdf-d026-4a3a-8731-ea1950af9c1d", "value": "T1FA54E0217580C07FC04621719878FAA16A7D953117B4D6CB3BA92A2E6F303E19679FCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040480, "uuid": "bc39e20e-24e6-42c7-ad6c-8b36c6870e0c", "value": "b0a16631cf6b80d1aaf105b20b72b5bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040480, "uuid": "4b707817-6261-4b60-9181-ed7626c1a5e1", "value": "3072:bBdNNz2LhAx12X+M8c/Z7XopUAb7ljmPJy3R:2LhMTzUAb7lyP8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662040480, "uuid": "c63751ab-0e84-4330-b6a5-cd96f57045cb", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662040480, "uuid": "4b923495-5b19-4bb2-ae88-40d186326300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040480, "uuid": "f06d9027-2122-4fdd-a9f3-7b86ede662e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6080562d-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662046387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046387, "uuid": "a61806d0-4bcf-4e19-bc31-6983228777a9", "comment": "Malware payload (Formbook)", "value": "c2724b5bece3913584ce76a11e2b6414", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046387, "uuid": "3b987195-6519-4909-a8dd-0e38564cda2c", "comment": "Malware payload (Formbook)", "value": "0edf2a0a4fe852db8050d58c5698b71b14a8346022eccc5180f5acd0378a9966", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046387, "uuid": "6b81685a-c2a8-4e4d-a2ca-c00dd79b9908", "comment": "Malware payload (Formbook)", "value": "dd65c490d2e5ea690a3522e680169e1c748ad605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046387, "uuid": "cc33c9bb-fbaf-4586-b334-850779c3d27b", "comment": "Malware payload (Formbook)", "value": "b87d4ab76911729fba78df7e6f9a247c8b5eb1d3b145f619a738e88d4310814a1d67d4060dc9355c9c557ccebdec0836", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046387, "uuid": "bffd2165-f28f-41b2-a1f9-1cfec3a80259", "value": "T1A715120E92545F23F4690B3523F1F313437A7F19A1B6D7998EC9E3F415DA77A820AA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046387, "uuid": "61bfdb44-6084-4de6-a112-9f723e01dfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046387, "uuid": "e9e18a61-ab76-4a84-a5c4-490df0e983a3", "value": "12288:yHF75eSgPwqoXY+mzoRtbvRT75yzcv6Fe5pNtSuz6FbIo0fRw1hDs/7bDI:0Z5LXY+mzo3bv/H6epNguz6FiZSDyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046387, "uuid": "21163328-4c51-4831-b3a0-a83975757a2d", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046387, "uuid": "2017ad7e-b72a-4e16-ad47-e6422f875299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046387, "uuid": "ac1e093d-4a9b-44b8-b094-4eb7e3219166", "value": "c2724b5bece3913584ce76a11e2b6414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5852c995-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032199, "uuid": "5129bebf-67cf-4b22-ade1-fdc559125c80", "comment": "Malware payload (Mirai)", "value": "5df06d7717eb687bb01d5b824869867c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032199, "uuid": "1ca76595-c826-4414-a4e0-8ee0d0362ddd", "comment": "Malware payload (Mirai)", "value": "0f22efba0c2e24bb9275622af426fb0e41a65566b9e86aa284a069aea8405d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032199, "uuid": "a8c24389-a6fc-42ae-b207-b385ab5eb6dd", "comment": "Malware payload (Mirai)", "value": "7d8219ce197ecbd9f74b4f28e779a5db60ac38aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032199, "uuid": "1c474646-21fb-478b-a7c7-fa18868cf0cf", "comment": "Malware payload (Mirai)", "value": "7a9b1cafa7e75569614ad48d613369d2dfbbcb0de620f7a282d624f96f16b6368aacbf7d0c231f0ae30029153fa9d884", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032199, "uuid": "31782185-d6e1-4b7a-8049-a2bc702022db", "value": "T1FF630951B8818A12C5D913BAF92D128E331227F8E3DF72139E205F547BC692B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032199, "uuid": "c9e8566b-9e87-41ce-8522-2b5c4a885b88", "value": "1536:txndeUeY9/Okzl2CY8qH3kGniPvwlty3M4OAykccIMiGLBksFm1:Gq/OSl9YN3viPvuty3vLBksFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032199, "uuid": "0f1d01bf-ab92-4be6-956e-3642d511e04e", "value": 66860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032199, "uuid": "f055c674-305a-4164-ba7e-7ed61cb40609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032199, "uuid": "08e2ee74-4574-4bb6-9a2d-7efeb01c0eed", "value": "5df06d7717eb687bb01d5b824869867c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced1bd8f-2a4c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662074489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074489, "uuid": "e9983e58-0af0-4fa0-a488-39358ff3f5f4", "comment": "Malware payload", "value": "1db9ce2cf416557e3c4815b62e43b31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074489, "uuid": "ff168643-481a-43b3-967a-4052e4d4d74b", "comment": "Malware payload", "value": "0f3b262010f9d12dd37b18903be4c3a5de0f20b2e4841efde7d2250bdf660bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074489, "uuid": "4e9256c7-505e-41e0-bd2d-54dbdaca2adf", "comment": "Malware payload", "value": "2afc08f044a15a8812e8181cbe37cf9a39cc8243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074489, "uuid": "3fd499cd-2584-4068-b202-0c2ca95e8014", "comment": "Malware payload", "value": "4cdb26fa0a1e94426290b6411599b39707cac616b345eb793aab41c9fe429ebaff90b0d93864803856f1b274e8887d84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074489, "uuid": "95206852-2ee2-44c1-ac5a-cab2d1b2c494", "value": "T1CBD4C208F911009582BB15F989C7DEF897C56AA4DAF9C71D96FA7C02E2D83C433EE590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074489, "uuid": "713d788a-caf1-42e7-a16b-7b3db1bce52c", "value": "6bac1a41c35cf62a504dbecf0412626a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074489, "uuid": "d2275b1d-87da-4edb-8444-e4fa93334f6c", "value": "6144:vY+BkUWnbcgwe8O8FeCxJedUBe1kTEd9:vDkLnbc3e8O2Bxkkwd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662074489, "uuid": "e2f20a72-ce1f-42de-87ac-66bce8884ca9", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662074489, "uuid": "11a8434e-62ed-4b59-b1e4-7dfceb47718c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074489, "uuid": "cfe46a5d-a1e7-4634-bfde-501eeacc9936", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483703ef-29c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662017999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017999, "uuid": "d04354ba-b34e-4fee-bef0-62ef9e2b0a4a", "comment": "Malware payload (GuLoader)", "value": "7b66b2ed9a15c047f75ae00bf55cb7f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017999, "uuid": "4ea69aa8-75fa-412a-a2a9-a598aea73c8a", "comment": "Malware payload (GuLoader)", "value": "0f9a3149d869c89dce449fb41b56ac6d1d92cd86ebed8b480094efde569074c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017999, "uuid": "4c80cecf-227b-4f70-8626-9782b1e8b4b8", "comment": "Malware payload (GuLoader)", "value": "fb32c07cad89788a8e6518f1f459d922c91184bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017999, "uuid": "3293cd56-0b4f-43b9-9036-55347e21551f", "comment": "Malware payload (GuLoader)", "value": "8240cec6eb9f2908c0bca5f516284ceca63320479883167ecf60c5b61abd1a1a614aed9b1b50d7d4eb8dd26b0cb4b48a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017999, "uuid": "fd32f427-4253-47a3-9fca-0556e90e37a5", "value": "T15374F193B61869E3D8A8983240270BB267757C7A97855A1372C5FE37B833353D70E31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017999, "uuid": "08cc7592-dc40-4da6-9ea2-6791af21e669", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017999, "uuid": "2fb86e4c-bc3b-41dd-b7e2-5a8c0edf043b", "value": "6144:eLsBN8xoIiL54j0CCRALS9f1nNv5oNBnXnIyTxGa1Z9dpPLwKWkJ3CP:5Boj0CfuNv5ovnXnRTTZ9bdJ3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662017999, "uuid": "13de126d-a9ca-48c6-b2b1-48f902b62967", "value": 354800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662017999, "uuid": "efc8cfb4-e7f9-4b0d-905d-b8266c13f097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017999, "uuid": "801617cf-acf5-4fe1-812a-0f24a47f027f", "value": "SecuriteInfo.com.W32.Injector.OHYF-3135.25928.26136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cb5a2e-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662027167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027167, "uuid": "4b894181-ac8b-4d89-a0d7-0828ef259cb9", "comment": "Malware payload (AveMariaRAT)", "value": "3c1626eda6b1bd948cf46ef93cf5a8f3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027167, "uuid": "a3f8a8fe-78fb-4022-bc8e-130b97fb66af", "comment": "Malware payload (AveMariaRAT)", "value": "0fd65e81b0140b39cd20e6911c5b7aea9b6d7d43eb0fa52e669d6ed96d237daa", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027167, "uuid": "bf704258-678a-4891-950c-b724f3460867", "comment": "Malware payload (AveMariaRAT)", "value": "cd19d2ac6ccaa9439e840bf7482fbf935e88774c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027167, "uuid": "ef15d47d-876e-47d3-8b09-ff0a805633e9", "comment": "Malware payload (AveMariaRAT)", "value": "09ad6bd57db300cb848804d869ea7927890b8c34e2dfaa31ce37ea6b5adfc873475d19c749f1adc01a552b2dbefe5654", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027167, "uuid": "79b8936a-e896-4575-bb32-527f0ff3c91d", "value": "T1CED4AE876BC41E50F17DBBB226BC955093B2D2C74852978368CC8DD8BF636C53C89A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027167, "uuid": "a4846e6a-7a04-4ffe-9e7c-796e99ffc6d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027167, "uuid": "95915722-39d7-4685-8e6f-6084a4f9b951", "value": "6144:lmWzslvkLVTRNVubcKYXH++pWE8XGK1snw76DBWsztdk9JHlqnn93+f9t:lHs2RbKAlpWE82ksng6VWcWBen93e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027167, "uuid": "57d2ade4-fcf1-4120-848a-5bcd840f6c45", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027167, "uuid": "9f96d499-9bef-4648-a219-36150e799324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027167, "uuid": "607a3d2a-6ef8-45cf-9f6d-5051351d1ff4", "value": "edonbee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf9cd87-29e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662030652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030652, "uuid": "92acaf13-f24e-4362-b17f-49885807a33c", "comment": "Malware payload (AgentTesla)", "value": "17e499f0b9cf0f00800bb436743690fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030652, "uuid": "b8b41216-ccd5-4854-b532-0d42893ca295", "comment": "Malware payload (AgentTesla)", "value": "11afbb9825483c17460015b680f37e04b3c1652984cfd91297ed3e83a9a05b27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030652, "uuid": "6d9f7e8e-9efe-4c4a-a2eb-51722b85a397", "comment": "Malware payload (AgentTesla)", "value": "6b72c2f244c1776a562ac614a9f98ffe30852456", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030652, "uuid": "569ff11e-8eaa-444c-9e10-5d6345e30008", "comment": "Malware payload (AgentTesla)", "value": "262779e3178f6e1ed152fafef3506879e1b892cb182ac9accd52d1534234176d29cf6c7026d410791f3541e83d0165dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030652, "uuid": "aead26c3-f456-4ed8-98ac-cf5db2fab423", "value": "T11E15CEA3B02D6992C55917B784038A4432E06DE7D6CDA7CDD8C4F6BB41B5EACC33512B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030652, "uuid": "e192c37b-2f2f-4b92-9f79-98871daf6e12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030652, "uuid": "424e5c33-e6e4-4cdd-baf1-002d686f4224", "value": "12288:RVNCEHslgDan6nmc6wONNqpU461htqqp/zMj1/DrPQ8Lc4hRX60EIMB:IC98NQ5qq7rrLHX60EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030652, "uuid": "4af7ea6c-e6be-4d50-b889-c82cb238776a", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030652, "uuid": "f6d8c4ca-d63e-4866-9340-e9faadc82ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030652, "uuid": "837f8d8c-ecef-491d-a0e1-5b39354314ab", "value": "doc_82789292737838738097390889228.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda9548f-2a03-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662043161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043161, "uuid": "25bc5c8c-e4cc-473c-86e5-3acc789ecbbf", "comment": "Malware payload (IcedID)", "value": "5c61c03f01ba5f71fe622ba9a48392cd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043161, "uuid": "085c4a8c-64c5-4efb-ab9e-737113f4e660", "comment": "Malware payload (IcedID)", "value": "133245a337b1703f3940d8ca3907c9bb7ec6b47701257766e70d7c9318571ce5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043161, "uuid": "c9498608-3243-4b2f-adae-e2f871697020", "comment": "Malware payload (IcedID)", "value": "d3ac9c0cc790c8543ed32b7cbe0fa4fafb215218", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043161, "uuid": "844ae210-9da1-4989-b92d-ac22967861cf", "comment": "Malware payload (IcedID)", "value": "c26d9fa26a67b0e7f92739216d76f66bbd92a7e2e8cde0ff50fee1ec2094c8828ec15b06660b7c5961670fec59c6927a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043161, "uuid": "d025cbfc-25da-4e84-ae7f-f18d30d268d5", "value": "T1528533CEF5E0C2D21E1E12B566F2F49641080EB1CABDDBD1ED2F7196E7381949C98A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043161, "uuid": "efb9c17e-5ee9-47df-952d-3891e65d1a74", "value": "49152:+uU8048QtCvu+0b1QuVQZ5iMFv88vV/nLbN6yihZ9YcZ:prj4Wb1KzFv889/LbUyi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043161, "uuid": "b1aab91b-e7bd-4794-9e27-60be26804746", "value": 1731839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043161, "uuid": "90c95f8a-fae6-4239-a798-1102e53b875b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043161, "uuid": "089c79e8-c0fa-424f-98ea-7357c5b217ea", "value": "redacted doc 09.01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ab3202-29c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662017996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017996, "uuid": "c1ac7ff4-47f0-4418-b076-81ba9e1d1e2d", "comment": "Malware payload (GuLoader)", "value": "19348e5011e2caedd988a306a771a033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017996, "uuid": "b0fbcf6b-61e9-4849-9648-1e39a8c60be3", "comment": "Malware payload (GuLoader)", "value": "134a5a68fe704581d35b9ef943835368b2c048d90c23d2ae1f7d389e2fc2feb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017996, "uuid": "31dd7836-fc67-46df-b64f-39f30b8a3036", "comment": "Malware payload (GuLoader)", "value": "2ce610d687e2ef288b606ee74c0b639e43140248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017996, "uuid": "16c9a780-9452-463e-8f9a-e1f3ee248c11", "comment": "Malware payload (GuLoader)", "value": "d26fbfd5cc74dbe20ddc98b56eb93521f4579d45ac3417a161b45c622ce3813b6fcd6007590f89398e235d3d56758b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017996, "uuid": "a0706413-6ee5-4e23-8050-f4f0c873c592", "value": "T10744E141BB505677C4F20E7298A7CB666772DF2157020B0FA394771B3EB22839F0A799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017996, "uuid": "451f2ff7-2615-4155-92f4-acc224dfa0ef", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017996, "uuid": "c46e949d-1df5-48a7-b440-f2e355c42e46", "value": "3072:CNRCywDw1DiJku2eE8gs2BfEuLygCSrdNaAirLjyWbuTbg/6yMv8DsOSklHRCzxB:CT4DtnEBErg9v0jhb6gSy48ssqMQVOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662017996, "uuid": "06529cd2-8e35-40c2-9040-25fab7c41eb5", "value": 270864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662017996, "uuid": "b8318046-4a32-4b47-94a5-8d4a26e415fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017996, "uuid": "718adc1d-8265-4488-b6bd-97109eacbbfe", "value": "SecuriteInfo.com.W32.Guloader.E.genEldorado.22623.6425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04738856-29ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662041078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041078, "uuid": "e2b7c49d-0de1-4932-ad7e-b433e8bb301f", "comment": "Malware payload (IcedID)", "value": "a4a844c3dca1e294dbad4d14133bc3fb", "object_relation": "md5", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041078, "uuid": "0c9fee46-c4c9-4ff8-abc7-18dcf12b017a", "comment": "Malware payload (IcedID)", "value": "1352dc0a79091ad63045b9b7adc43b809f57c6bbb7e741e9b237a44e41767e4c", "object_relation": "sha256", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041078, "uuid": "eb408493-d292-4d96-97af-e6cfc63a321c", "comment": "Malware payload (IcedID)", "value": "d040a5d0b2fb26c353534b4b56296e7a7a8879de", "object_relation": "sha1", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041078, "uuid": "d6effe36-c3ec-4415-8609-d35924d664f0", "comment": "Malware payload (IcedID)", "value": "4b8876e9ebac70710795fe7b4358afd3c24c3152bd1ce9fb389dbe521e0859d8ebf829cb4d9007c80d149479c5291910", "object_relation": "sha3-384", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041078, "uuid": "2998b334-4126-48c0-ae4a-4df927f43d15", "value": "T195D31247E3E4C413D5BC003F9ABCABC4B5C95C2ACB61E077650B661D6F4D6EE1B98602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041078, "uuid": "8f5c049f-b8da-411b-bc7f-6f18a4507dc7", "value": "3072:D2k9QNL7HPNTfqXt1KQkXspIoajgNSFKJXLQMRhCrdJ7Guco3:DxQB71ItEQ1qjiSFKJFkrL7oo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662041078, "uuid": "dc9b5e28-41c0-455d-9af5-21e7344a91a6", "value": 138992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662041078, "uuid": "3247ac27-bab6-498d-aa58-84afa0e950db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041078, "uuid": "ddd7ff4f-ba4d-4572-a64b-3b3f55036d08", "value": "document_163_september_unpaid_invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ea7476-2a28-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662058718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662058718, "uuid": "87141695-5d31-4652-860d-1df404c3a541", "comment": "Malware payload (AgentTesla)", "value": "28a9e583c0a99e3d945acb08f96bbd9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662058718, "uuid": "9f669174-0c8f-45fd-a981-474ddbe90606", "comment": "Malware payload (AgentTesla)", "value": "1376e991beb5454f3e3887ee68061d0dd7180454644266ff5c55d98a2c0c39f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662058718, "uuid": "458201cb-77b0-46da-9a8c-5f74f7510d4f", "comment": "Malware payload (AgentTesla)", "value": "6f2f56100256cea1086ecc460a65936acbb49b77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662058718, "uuid": "b1d6e018-8924-49d1-8628-f45f394f398d", "comment": "Malware payload (AgentTesla)", "value": "06602e803606bfd1e2329cb1ba47f44f617a53983ec3fd70b42afae6ea27227453aa90f258498223915a3aa811cfb6b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662058718, "uuid": "fdf24dc4-758f-46b4-8446-1319ea03b959", "value": "T13E154B48B834764BC25414F4FA63CF056A63AED3EB9DE1C69654F6D6D0702F4EA080EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662058718, "uuid": "818e68f1-0c59-43ff-a9a9-aa5524195f01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662058718, "uuid": "896dec12-2786-4800-a32a-2d95e0097009", "value": "24576:KCbQDHV5UeOXseXu6FTc9bRphkM+n6OHeX:KvHVCpXseXVc9Zkr9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662058718, "uuid": "fcc51d6b-5107-4d53-9fd5-e75df9775bb4", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662058718, "uuid": "618421fe-9737-443f-a4d2-5b056dec186b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662058718, "uuid": "1412ec89-b059-4c78-b94a-b7d39f308420", "value": "Doc-35623627902636262-3767272773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4616c077-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662027874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027874, "uuid": "81dfd6cc-f896-4a8f-be40-ba2d98ec8fca", "comment": "Malware payload (RemcosRAT)", "value": "76a7d9704c6d68c6513f411cbd924df7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027874, "uuid": "34d97783-a5f2-491c-9914-ffc16f47daac", "comment": "Malware payload (RemcosRAT)", "value": "13d857c2ac33c736177c0eb942aa19a955c337d057ff6605e52f2e7692dfbaac", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027874, "uuid": "39646a4f-33fe-4cfe-b4ea-f46baa341137", "comment": "Malware payload (RemcosRAT)", "value": "0e43e98acffd942c4242f47a90ba4701007e8f76", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027874, "uuid": "7fe67d32-6660-4d5d-a592-792e9db7f7b9", "comment": "Malware payload (RemcosRAT)", "value": "6c12a48c68a04beb2b8d83ddd299d1b335c4539bfd436ab2125a31d87520cef792113391be1ea5cd6e32c01e04621bf4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027874, "uuid": "2b59d7a0-dc52-40e3-a685-169a467939ae", "value": "T1034512895A84C375F4271B7102B2F169827EBE14D571C2DCBECFB2E855B8B02961BE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027874, "uuid": "f88ea104-44d4-4106-ac1a-f382ff98ffee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027874, "uuid": "300ce00c-54a3-4216-8104-eee1da1b71e1", "value": "24576:XZ5PXY+mzo3bv+1ZJKHvMghqugpq2rXsYFUuQf:p5vlmzMG1zKPMugkIUuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027874, "uuid": "361e665d-02c0-41f6-8c32-85ab53323526", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027874, "uuid": "30931c4a-72de-4c56-aa68-95bada26332e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027874, "uuid": "3caa65d4-dba3-43ca-bde7-e9d748d8beba", "value": "DHL ACCOUNT STATUS - 1606561674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bfe9c0-2a2b-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662060329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662060329, "uuid": "f634e2fb-339f-40bb-8287-d90597b5818a", "comment": "Malware payload (SnakeKeylogger)", "value": "fe028f8c0530615064781a2b129c02d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662060329, "uuid": "ee13aad3-30e8-4e8e-bc85-f4bd15315df6", "comment": "Malware payload (SnakeKeylogger)", "value": "13ee81b57e9a4f756f6e7ad106b54db15a5da2303c6f88d7f54cc0772883783c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662060329, "uuid": "f1e0bf3d-6551-44db-ae87-b51a26301667", "comment": "Malware payload (SnakeKeylogger)", "value": "4aae10f7b34da3a08d38651dbde2e06a4d384618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662060329, "uuid": "d418492a-3fd4-4963-aea7-e03b97442448", "comment": "Malware payload (SnakeKeylogger)", "value": "c0feed13b1e7c9dc546013d8b7fca79b8c3c6d5ae51796639208772352550642b29d865c7de030d7e228b76b7f9a0700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662060329, "uuid": "b8039371-6847-462c-879b-6419027bb1a0", "value": "T113C45BAC755836FEC817D972DDA81DA4AA9224B70B4F124B855315BCCECC987EF180B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662060329, "uuid": "50b0abeb-9c69-4c9d-b346-0b87ad91644c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662060329, "uuid": "a4285223-7a3a-4ffc-a047-38f171619d0c", "value": "12288:QsjDBB3A7+r2ESBhwoKSLWK1ALlylSx1XlaOUUnL2YMrj4G6TbUp3mAJIww/CWl:QEDB1A7XEdFSLWK1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662060329, "uuid": "b4f3d6ec-9340-43c4-b0c0-d8cfe09449b0", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662060329, "uuid": "d5ce59a0-6123-4958-9b15-3377acaa7e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662060329, "uuid": "9524a2ef-075b-42d7-9a20-070ac214e20e", "value": "PRE ALERT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a2a175-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030150, "uuid": "5dee121d-96a5-4570-aece-ca5b4a533337", "comment": "Malware payload", "value": "adb0ff7c4d575c311fca0f7ab2f3c999", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030150, "uuid": "669b8ca7-6281-437b-b77a-fd3ee9ff1a67", "comment": "Malware payload", "value": "1411c8f084179eb44bb14a24859a190945cea5c723c3e01f742a0885d8cb97d2", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030150, "uuid": "3549b050-0ec2-49d6-baec-137d70df2d2b", "comment": "Malware payload", "value": "9d257d89ab94c7f39d76bca96d4b3c23183c80eb", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030150, "uuid": "468486de-77c2-44d0-ba69-36cfd77e6548", "comment": "Malware payload", "value": "73bb46b0527a3d2e8f539f165a5ba5111c084ea4d96cc96405aeec19ced18a47a04197f468039dcbc8cf63191f10aea0", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030150, "uuid": "c3873093-eef0-478c-afcc-1136cd326979", "value": "T14E92E025F51B5029E0AB0F3CA7ABE2C925194C27DCA27690B47F12FD5ECF8502784F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030150, "uuid": "eca926bf-d09d-4a24-95f0-6754316dd51c", "value": "384:6go5aEk9oztQyMH0QM7xFa+GUHxnHyo4tqwJ6H1I5YkyG7yPV:6gosB9e7M41xb4EwJR5YJG4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030150, "uuid": "a1181959-eac7-497f-b80e-766bc4ee724f", "value": 21181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030150, "uuid": "d747826b-6d95-4044-a388-b64451e3696e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030150, "uuid": "8b2ce3a5-9644-4ec2-9eaf-4d59d8c2fc18", "value": "Crypto OTC_Individual List_20220305.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb75953-2a50-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662075938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662075938, "uuid": "bd56b354-83e2-4af2-b2dc-4fb8a339b347", "comment": "Malware payload (RecordBreaker)", "value": "162afbdf5c47e676de0b22ff01023eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662075938, "uuid": "8ddfade9-de7e-41ac-b9d1-1895318eb94e", "comment": "Malware payload (RecordBreaker)", "value": "1425fe43a0d680bc02644d3cea3f79e9dc2b3dae86610152429f53947ffd9814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662075938, "uuid": "77c2617f-4e47-4b8c-8fb9-2c2eced5e21c", "comment": "Malware payload (RecordBreaker)", "value": "4127d1456da4c6a4b777868922f83af4f1efb155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662075938, "uuid": "b32de16b-6deb-4e6b-bb09-f69b8a4a0c47", "comment": "Malware payload (RecordBreaker)", "value": "604855e49fa6491db988b5bdcb734552c47107e115d44fb2923a676e989ccf27f40fdfa6391b1b1e759a479fcd269650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662075938, "uuid": "6bafe752-cb90-4eea-b97f-ae5390f6538d", "value": "T1E225AE2039D59532EDE2507A06ECF9324A6DE8F00B2186CF56CC57EE86246E13F37997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662075938, "uuid": "d8bb8805-9c54-4408-9d56-95d3ce80dda4", "value": "885c07b22374dc1137a9f063282ad390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662075938, "uuid": "14d6ce29-c5fd-4efe-bae8-57641a13c0b7", "value": "24576:uDWnHh8xtkkyuDg4SYJANcFO8no4wa7q1:nxkyuDgB2kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662075938, "uuid": "d05d1420-d2ad-4488-a3c6-b3d93f32e19a", "value": 983968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662075938, "uuid": "a07d9e9a-13ce-4259-9b13-6f9b0566a970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662075938, "uuid": "22f6b882-f46a-4653-9379-11b53061e85a", "value": "162afbdf5c47e676de0b22ff01023eaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5120567-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662027174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027174, "uuid": "65601dfb-df5a-4808-81f9-df98a9490d1e", "comment": "Malware payload (Loki)", "value": "c4072867bcec50c8ec778cf631871bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027174, "uuid": "b2b4b0a5-f2b3-4426-94f6-62dddd8b6cac", "comment": "Malware payload (Loki)", "value": "143d9bda1ad208fc54635837093e1f6588cb7f992c2eab54ea53e3cd98eb1afe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027174, "uuid": "0a4fd3fb-7aa8-4f0c-90e9-f5a7842b2285", "comment": "Malware payload (Loki)", "value": "33ce32df28ecea411d53a5476cde588c37a1c0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027174, "uuid": "13e5a7fd-7f79-4965-b7ca-56acae06746e", "comment": "Malware payload (Loki)", "value": "aa26c84a3b3577648bf1524403eb321bc6c67036566502c45f58623905e1f546d55bec1604a8ce9ba3cd2ca2be340197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027174, "uuid": "9ca38591-9866-4abd-bc37-2a2c4bd15dc3", "value": "T112A47C876BC03A51C17CBBB637A9919093BAD2D7C950939368CC81D8BB636C53C897C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027174, "uuid": "a0864bdb-e9af-4466-8239-b56aca9d5e37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027174, "uuid": "8dc8ddf4-f578-4b4c-9fe0-17b2ba1dc3a2", "value": "6144:/64UlvkLVTRNVubcKYXH++pWE8phEiw3HoZM3XixN1got:S2RbKAlpWE8pmH5XzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027174, "uuid": "a6f3c64a-b23b-4680-bcf2-c0be27502541", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027174, "uuid": "b72c1f2f-9c4f-422b-aa35-e1a3c5e98c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027174, "uuid": "1107fe71-48ec-4003-a89d-06618872c86d", "value": "lowon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae49975-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662018433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018433, "uuid": "68db67ac-0a91-40cf-b34b-5b560cd6e2d0", "comment": "Malware payload (GuLoader)", "value": "4e0f268e0ccace13d330e51c8fc428c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018433, "uuid": "df68d380-ae6b-4dc4-8935-eff99827c05f", "comment": "Malware payload (GuLoader)", "value": "14443291e71ee31026e9b69b38d45284b55b63198fb5dea410668e8a3fa4f846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018433, "uuid": "4f5ecb57-755e-482f-a45d-dd64d016677b", "comment": "Malware payload (GuLoader)", "value": "5fdf0c4dc1f6510fa35c7abb60ee979a9a0bddcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018433, "uuid": "5b7b2516-b0df-4f4c-ac24-45d540000df7", "comment": "Malware payload (GuLoader)", "value": "6bf770b89a925d6df73671d40cbca9916986587cfb55f2bfbcbe61b8962bfdb7173cd75eb341dbff0f3bd0b45956fd9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018433, "uuid": "eea14fc0-550e-41e7-9848-0e1144221c4a", "value": "T11BC3CF45B164D093E0260A71E93592F3276DAC12D8B3595F37603F8E3A31153EA0F7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018433, "uuid": "8c1c11ac-7825-4814-a04c-826aa897f4e5", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018433, "uuid": "7c2b8908-6cfe-4d5f-b542-00c9354199f9", "value": "3072:WuxVUg3yGDRb8lc7uUcQbgmuBDFx0sT4SIbSPS4z:JgORagHop05Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018433, "uuid": "a2ba80a2-1f44-4137-916f-3d5493d9ed40", "value": 126555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018433, "uuid": "05ea38ba-0c49-44d9-9784-0fbb0a7602a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018433, "uuid": "b242d1e3-a54a-4c11-81ad-8683b0cb9d8a", "value": "PO#20990_Sept_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b091b49a-2a1f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662055111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055111, "uuid": "b5b9f832-24c1-45eb-a935-ed0cf8c44224", "comment": "Malware payload", "value": "4603e2a65a6d876a3d20b8cb91e871d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055111, "uuid": "178c339a-250f-431e-9a07-88db1878fd94", "comment": "Malware payload", "value": "14e8895c1ce615eb1efcacf62f4db6812f20801ea0353a09f84574850233a360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055111, "uuid": "0aa27cc9-37d6-4172-9593-bbd1f77b2fb1", "comment": "Malware payload", "value": "c72a60b83522e884ab99c510f3ca5f13eb3d8978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055111, "uuid": "646199e5-40d9-4647-98ee-caaecd245054", "comment": "Malware payload", "value": "1efbd3ab1d0edeff22bbecf029dde8679338c45ac18e58666bc4e3157a0e5b4370e6e2d40ba1f06d64a646ace20ac4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055111, "uuid": "7dea56b7-61af-4ac1-9443-558989571e43", "value": "T13555CA7952B709F6E78C48FD06F9DB835912C59492333BE5CCE5CF221D402EAE12678A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055111, "uuid": "f7bbd9a4-fa05-488c-8949-303df62933c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055111, "uuid": "aa60a912-6dfb-4bb9-909b-69535c0899e8", "value": "6144:MmYZ4G68G8e35saC9ISkhiErPoKgSF0oKXYkInycM3Zfet3Agp0q9ygbX+1RzDU8:DYZ4fl5FwW3gDoKEgsaMJcR/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662055111, "uuid": "95cc1587-fba0-47f8-a145-3d981d26a69d", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662055111, "uuid": "640b6502-412a-4839-8dab-dff3dec8a051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055111, "uuid": "751b1c2a-5975-40c5-a625-577546b07a9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a163030c-299f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662000110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662000110, "uuid": "a1126349-f578-4429-8519-98137e8c29ff", "comment": "Malware payload (Formbook)", "value": "7569ad8644074e28a6a9dba38e67b95a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662000110, "uuid": "eae7df3d-c0ea-498c-bd73-71203e72aff5", "comment": "Malware payload (Formbook)", "value": "15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662000110, "uuid": "564e56a9-5bfe-4f92-986b-791a7b7a9267", "comment": "Malware payload (Formbook)", "value": "10e73d912b5a6955161213a5f9004988ca4030ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662000110, "uuid": "22d9876e-0237-4e6e-a2ff-e57243abbc2a", "comment": "Malware payload (Formbook)", "value": "1611cf3eff7708433c31658bce102013daacf9a4e2f115d8388909d8ffe6235f649746f5d91a5240ef6914df92f8df9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662000110, "uuid": "57bdd278-d206-4481-bdd9-639ae525a128", "value": "T1E174E14D9FDD0FA3C56D7F7AFD034B8306EC9209B886072AB69C20550BBB1F165865CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662000110, "uuid": "3fa8624e-67d5-4644-bdda-d121e5529380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662000110, "uuid": "a0590e68-8fa2-48c5-8421-b0566e147e6e", "value": "6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662000110, "uuid": "16b451d6-6891-41f7-b242-282b21d39005", "value": 351000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662000110, "uuid": "af1c0ee6-94bc-4715-b108-c8232a7827ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662000110, "uuid": "19c3a5f8-6861-4e22-af39-8d4155c5bdac", "value": "7569ad8644074e28a6a9dba38e67b95a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcb90b5-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031162, "uuid": "1c2f0665-4f5f-4bd5-8b3f-0cc834e8466d", "comment": "Malware payload", "value": "b18526562ac43afae6a43d01d92ba9cd", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031162, "uuid": "4a8d7fb4-c3c5-4de0-8069-54c58a499921", "comment": "Malware payload", "value": "160f71a5a4a2ab7b657868bd937bc0c60e345e334b00ce83e5346794d4c4bcb5", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031162, "uuid": "bfe4f67f-9d97-4d8e-897e-c17dede9c1cd", "comment": "Malware payload", "value": "ce59e78517d67394d0d275cd49ecde16c6d9b2aa", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031162, "uuid": "5978f5a7-7cf7-4cb0-9d8c-60246ae1b4e2", "comment": "Malware payload", "value": "f2a12522244939083f28fa07955cfd89d76b1d8884d6c044602b9815c65b5dd096252183ee0566af4453ad59452f429f", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031162, "uuid": "fa67cf97-dd44-423c-96b3-5926a9d4ad1d", "value": "T135531BF656175D8F86370E44F50C1201ECE8A8B7F3D991E8BF4A4EE68A954188CB4DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031162, "uuid": "441abd55-8fef-4400-8625-007c99ea9e14", "value": "1536:YH6QOXFKYUsveuTVxhtIYLPyeu7HE/iE8wCQBDqRj4p:YH69Dvb3IY+7HE/Sw5iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031162, "uuid": "b392bd41-78d2-4448-b312-ccc10a59f5d1", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031162, "uuid": "8c6a54b0-b3ce-40e4-b273-a47957538699", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031162, "uuid": "733dc008-6e5b-4017-b9a9-f9dc59a415f6", "value": "As1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c902e046-2994-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1661995452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995452, "uuid": "831510ee-44c6-4754-965e-01239666ba2a", "comment": "Malware payload", "value": "65c23ab61179ccead393f92ad212ea87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995452, "uuid": "7f50cadb-2e50-4263-ab47-11de4de15fe0", "comment": "Malware payload", "value": "1624fdba1c3f9647d6925436655a3c9c7ad8d5cc61ad18d48cc9cb0eb58058a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995452, "uuid": "8d5d748c-5518-4c03-82e6-24190def608b", "comment": "Malware payload", "value": "dd5aa78c9b2fb2d03bb560f0776c982fee75d74a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995452, "uuid": "2399cb1d-9a85-47c8-b935-441ec35d469a", "comment": "Malware payload", "value": "4d13844135de0b54fac65b0514c571c3528a6a6d73e172bde2b176bb5ecd3ce01cca03aae8a5307941993fe2b7a2ac10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995452, "uuid": "e8fa8c12-6544-4bd0-b5d8-9c971fc46d43", "value": "T18394CF59339044A2ED2B0A736432DAF449797C614FB0681FB3D9BA3F6833743552E62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995452, "uuid": "07d16b39-eeb6-4f27-a279-422c32d57118", "value": "e1e75077f8ab00555f309c32f1264f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995452, "uuid": "f6cee85d-7cb2-4828-9222-62fe346246a4", "value": "6144:XD5IHGSy8wI4hODJT9dHS3B30b8XkNnqoW1whQuiWbC:XDRoyhO9T6kNJWAzDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995452, "uuid": "259a3d4f-1daa-4afc-bbeb-dfc24e703513", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995452, "uuid": "724ab9a2-2445-499a-92a0-0d4a6b215bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995452, "uuid": "186e3805-c8c0-4476-8457-971aeb59b5f2", "value": "65c23ab61179ccead393f92ad212ea87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7cae18-29bf-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662013849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013849, "uuid": "f14222d2-35d6-454d-9ccf-8fcf742faba4", "comment": "Malware payload (GuLoader)", "value": "376eb9a5144513df3d1e667666ef0cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013849, "uuid": "bd6b52d7-fb8f-473b-9981-3333446d8792", "comment": "Malware payload (GuLoader)", "value": "162f046a4766e014575ee85929fb67d8413f13e587897d55fc6923ff2bee360b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013849, "uuid": "2def1e2e-ddc2-4468-b29b-b967b464b12b", "comment": "Malware payload (GuLoader)", "value": "df67b6e317426f1752a1015ee52853339951a35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013849, "uuid": "319a394a-6673-44ec-8a68-e57493022e76", "comment": "Malware payload (GuLoader)", "value": "8da7ff6417d8372cce1c29829969b96c62411212626fda75f4ce830ff12ee57158bdf961513e2dbccd071b5a13b77319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013849, "uuid": "19934046-7fe0-421c-a254-036a6a60b894", "value": "T14AC3C01176B0C363D82257B1EA6986F533B9AC2699B5420B37703F0F3E75161C90FB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013849, "uuid": "b3e7618e-673c-45bc-8ae0-8a45debc70d4", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013849, "uuid": "90fb4a68-a2e1-4e0c-97e2-ab5203019f88", "value": "3072:WuxVUg3yGDRb8lc7uPpA2nsa/AvsEB15uejreIbOy0ALNr:JgORahnsUAvxL7VR0kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013849, "uuid": "8edf207f-5e15-4dac-a136-58a39b3dfe79", "value": 126543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013849, "uuid": "41989640-ed0b-4550-ae01-ccad04245c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013849, "uuid": "49237122-af07-4784-8895-9604e4a7e510", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.10313.8335.16531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252d68c2-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662018370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018370, "uuid": "7929f13e-c256-4020-8c3a-f723cba9fbb0", "comment": "Malware payload (AgentTesla)", "value": "08cdab5108e0866db024ae76d189c2f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018370, "uuid": "90e03a1a-1844-49bb-81ed-228eabe7fe84", "comment": "Malware payload (AgentTesla)", "value": "164966f3119f19c64f929044d9c654d471ebd7dce9f45d1a544b16de7c05ac54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018370, "uuid": "bbbe37ea-91e6-4736-90e8-f271644681de", "comment": "Malware payload (AgentTesla)", "value": "560d1db63c4621fa21d5842c3664a01fc1a11ecd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018370, "uuid": "5188d184-60d1-490e-b76d-da931a44adf9", "comment": "Malware payload (AgentTesla)", "value": "ec7ab48c1ba66bd939fcedce3205afc9e8d77553eb54fb52dfeb871926d790cb3eeb4e6812946f91e6caf49cea0bf53c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018370, "uuid": "4c6c210f-27ad-4b3d-827e-1eba6e8d4043", "value": "T108B423ED0047F2F6DB358B01FEAE819CF41C218D37B189FBA06292054B5677562CED59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018370, "uuid": "de1f818a-e58d-409d-bbc4-f48aec809356", "value": "12288:5JXO825CFOjMzHVSa3GOhleylWCstNkGf6+ZDD25YB:LXSsYAzHR3TlflCk0VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018370, "uuid": "ae1318dd-9fbf-42d5-a814-81f43276dabf", "value": 534937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018370, "uuid": "d8ea1399-6436-48f3-9695-9ed9de193017", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018370, "uuid": "f0a77d6e-cd2b-4e66-a12e-d826a2e34913", "value": "REVISED INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bf20f3-29da-11ed-93bb-42010a9c0043", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662025558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025558, "uuid": "11418542-d79f-4097-bbd9-e88cd21c7ba1", "comment": "Malware payload (ErbiumStealer)", "value": "e1826f107e517c0cb9a9b02f74cb94f2", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025558, "uuid": "20ae3aa9-4c62-4575-85ed-6586b3fc89e3", "comment": "Malware payload (ErbiumStealer)", "value": "164f6090aeabe48d2f9a2de12b8da6e8de24735a39371fe922e51689e969ad37", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025558, "uuid": "1f89f062-a9bd-434b-81db-c6277a2b5a5b", "comment": "Malware payload (ErbiumStealer)", "value": "c994bc4ed56145b8ff80fb0c0fa47a39e19e0ca3", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025558, "uuid": "b7b7ecd5-9dee-40ad-a49e-3c80a2e52293", "comment": "Malware payload (ErbiumStealer)", "value": "a0f289274ffc5b2d55ec455a4cb8b26907d23c84724ff254eb48b7b6575532a7a4793d61a917da91b09472ad77b9b074", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025558, "uuid": "d38f62c2-1c7f-444b-adc9-dd23c6bc2f0c", "value": "T1D0B5F9036A8B1D75DDD23BB4618B633BA734FE30CA2A9B7FF609C53549532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025558, "uuid": "1be2dc74-7f0a-4c95-a1a8-a29a59b1dca6", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025558, "uuid": "304e580e-a501-4cb9-acbf-3c3bb3d19a73", "value": "24576:PIjFwwY+YDPZ1MpMw2oxJrGL3lYebnWpFSoHSL2yAlRl3RuQ55313r:AjFzd0bnWjSoHSqyEl3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025558, "uuid": "2854e410-ee8b-4380-976b-3d80266c3fe7", "value": 2410247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025558, "uuid": "82c8d929-f2d4-49fc-8288-bf13c5c1e918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025558, "uuid": "0aa5cd6f-7a5b-400f-95dd-563166b20a39", "value": "e1826f107e517c0cb9a9b02f74cb94f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f547e2-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662028437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028437, "uuid": "71971d97-5043-4f96-b5d2-5e990190a285", "comment": "Malware payload (AgentTesla)", "value": "23bb132d8b8f4441a8e3a3f6119c56c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028437, "uuid": "445f96af-c387-48be-8d35-49cad602682d", "comment": "Malware payload (AgentTesla)", "value": "166b9ac8d5c2bec0c4400b07ff898b069bd59ddf029bf5387066d704114028b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028437, "uuid": "3c5947fc-ec08-42d7-ab5e-21db408be9fb", "comment": "Malware payload (AgentTesla)", "value": "fcc94705636c8eb15adadd3e7aa9232386f288c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028437, "uuid": "c0246f26-03b3-4145-8888-86a4873b8b16", "comment": "Malware payload (AgentTesla)", "value": "c1121810a9df3f314e8d19cfc22437ba5517d134385b54ebca6e15273b8e2f20a8b84a99058636de7160ec2c6f24a233", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028437, "uuid": "09d07eb6-d737-4dd3-9b6c-73c602bff970", "value": "T139251249A684C7B6F4170B7112B1F214917ABD11D2B1C6DCAECFE2EC09F8B139267A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028437, "uuid": "7c241d25-af84-42ad-91a7-f82686c836bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028437, "uuid": "822796cc-fa2c-4ee9-94f0-8246166bb8cd", "value": "24576:bZ5vXY+mzo3bvgDMkDpoU6U3T110wfxX:l5PlmzMoNDeMj1VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028437, "uuid": "de48121a-02aa-4eda-a508-e50898672cc9", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028437, "uuid": "b6595c6a-ff55-4b5b-b423-f6da03fe8ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028437, "uuid": "94e51c0d-c031-44c3-a02d-9f537d0b3c13", "value": "23bb132d8b8f4441a8e3a3f6119c56c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c93340-29df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662027424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027424, "uuid": "7b77a2f4-9296-4ce4-9db5-846c0f7393ef", "comment": "Malware payload (Formbook)", "value": "4d273ebf4f5feabfa245aec899f6daaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027424, "uuid": "d7be2f7a-f29a-4668-8c17-18ccede906cf", "comment": "Malware payload (Formbook)", "value": "16ba659d813dfa2c6d143c32c493f56266d9a408ec75b01b0aa019db2dad216c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027424, "uuid": "c6024272-8cb2-4f34-bc09-2c758d4871e7", "comment": "Malware payload (Formbook)", "value": "6518576bc596b6a84c18c127b46e6a43993201aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027424, "uuid": "3f251938-7e03-4ace-a3bf-27b51bcc7f64", "comment": "Malware payload (Formbook)", "value": "54521ae2f5325bbcb50b7f01e005dc418a3abec50912d3630c795c9b340824e1773c62d6856b431eba78c619f7a849ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027424, "uuid": "dea99061-26bf-4a9a-b57a-33b524146acb", "value": "T1061501283B46B98FD463CD794CA09EA0E660B6379707D3476027266CED6C7C68F851E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027424, "uuid": "39142fcf-c148-448c-b6e3-9d0f7dd15722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027424, "uuid": "eb36a438-df7b-46ef-bf9c-c3b17a1f99c3", "value": "12288:JO7E6+aG6xFjjvuEHslgDa+6nyiTKwGeHXQ+Lnsdgd+6rgxwXCfqXCaHxjvvedtU:JkkCmPTKTe5ixwXCSXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027424, "uuid": "346521f6-b145-4e52-a0df-0eb9f8b23444", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027424, "uuid": "d2893c54-fd0c-4c63-a5bf-6a075ea80fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027424, "uuid": "a3355acd-3df5-42c4-8b8c-34c3fe06b966", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80d746e-298c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661992095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661992095, "uuid": "82fed05f-8d9e-4f78-ba6d-bcafa21d94e6", "comment": "Malware payload (Smoke Loader)", "value": "17dec5c158316286463768dbb6d83637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661992095, "uuid": "8ed69fcd-d3ab-4c5e-9a0d-cb3c1efb3b6e", "comment": "Malware payload (Smoke Loader)", "value": "16fc7e2b4570f3d2d363efd13ffb7a5e7db3086d1600cd72bcbb6a8018489377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661992095, "uuid": "5077de59-b3ba-4eaf-8882-f7a348c4092a", "comment": "Malware payload (Smoke Loader)", "value": "f71ee48303d7d5fd31caa230df0794611f1bf5cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661992095, "uuid": "ce1b523d-e9dc-4344-8858-c0beab14064a", "comment": "Malware payload (Smoke Loader)", "value": "f05f2ce77a8016be2337cba759aab25bf234663c8405c90538185dffe6b556597d65b4392829b0a28b7fa4f0c84a6e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661992095, "uuid": "03f30040-b3e8-4810-8d59-520b6db54ece", "value": "T16954D0F27682C0B2C04211B154B4DBD11A7F5832C77145873BB92A7F5EA06EE56FA70E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661992095, "uuid": "679ded14-1f50-4d1c-8d11-8e5c4b3a9178", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661992095, "uuid": "3ab8c2fb-fa98-452c-94ac-e450031366dc", "value": "3072:ZXZ3+Ied0JVoLuwAUrPk/2X84XmaWKwrQ6aVd8Au1jUlRL5V5nMD4:9joLugksmaHwEd01jUXL5V5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661992095, "uuid": "180c3548-bb76-4c74-91da-f369b47cf91c", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661992095, "uuid": "373287f9-9a4b-49c5-a620-5d9460d880b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661992095, "uuid": "f871f3a4-463f-4e40-a65c-459284f818df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778a1e4a-2a09-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662045566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045566, "uuid": "47f3fafb-5a88-413f-a855-08883ba88c9d", "comment": "Malware payload", "value": "385da910bd1d677af8056f396f21fe72", "object_relation": "md5", "Tag": [ { "name": "181668765", "colour": "#43B9A4", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045566, "uuid": "21b19755-2858-4064-bd1b-abde52eaf671", "comment": "Malware payload", "value": "1768a5956327dc9cfe9261feb2f2de8a893c1588fddee030ccd7551049a83fa4", "object_relation": "sha256", "Tag": [ { "name": "181668765", "colour": "#43B9A4", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045566, "uuid": "388d71f0-759c-4ab1-81f2-72adcd66d949", "comment": "Malware payload", "value": "b7c961267e4ad5edd0491930b25ebfb17ce11aa0", "object_relation": "sha1", "Tag": [ { "name": "181668765", "colour": "#43B9A4", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045566, "uuid": "2c5ba44a-3b8e-42ee-9ee2-4e9eaed9d98a", "comment": "Malware payload", "value": "8167ad3218002550d141dff9facca1ac32f12786bff6d500d3220aaf423d6d0ab152f7e009b9105fdb208e41d3b5d923", "object_relation": "sha3-384", "Tag": [ { "name": "181668765", "colour": "#43B9A4", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045566, "uuid": "e4c70dde-3b2a-4038-bd73-a471bdebab35", "value": "T16285333C9D9627198C45EF1F1030AD0FC818DAD1195D0BFAF5F8BA826676A079FC6436", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045566, "uuid": "8daac876-57cb-46b4-9c0d-bbc617b9252b", "value": "49152:RXaYmTDW6gLc4ngFG+WZb8Zzb9RxNEk6lCsy:IFXWJwTs+W5ApRovy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045566, "uuid": "a21fb3e5-1510-48b8-a073-9c84d3de96ce", "value": 1722563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045566, "uuid": "e80fcf6c-ba8e-4110-9351-6bacf6eec3c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045566, "uuid": "9f4db67b-afdb-48a0-99fb-12d0e8de7e3c", "value": "removed.invoice.09.01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff75e4b3-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031191, "uuid": "361a1fe0-7a00-4cc2-9d7d-4d944f44509d", "comment": "Malware payload", "value": "189ce0a36df6a7812645083c190e7983", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031191, "uuid": "1081f4b1-dcf2-479c-987f-adc3c9b9f5d6", "comment": "Malware payload", "value": "18d1bcba0d78d33dbf1686c8fd0c9cba5f6400715b179d6a7007cb616a3821bd", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031191, "uuid": "2717f8fc-71e5-44d6-a001-1e85b1b59666", "comment": "Malware payload", "value": "d1d581cf3f0aa6539d5238795e3d7c78198adfc4", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031191, "uuid": "83f5729f-207e-46fe-adef-c5fcef04237d", "comment": "Malware payload", "value": "25541f62e6fdf6cc32fc28d142f712edfb692fa08334eea145385c22673f5c35c6596b110c8d3f0d28349cdf92fd56a3", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031191, "uuid": "82bcefb3-733b-4553-8bab-75049224d1b5", "value": "T13242297A2942FEE86FBE7D405C0429911CC87A2753A4AB6CFBD509B92CED510DF138B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031191, "uuid": "496a1f1e-3ce5-4096-a580-a82d37624e18", "value": "192:Ip4erQ6tqUfPkm5xR9umd3MrYnGXHnKctoBRLQbXnbeD+5:enrxR9MSGXHnKYrbeD+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031191, "uuid": "f521f3dd-38d6-40ed-a9ab-b01503c40aa6", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031191, "uuid": "de7c64ca-8bc2-4995-af73-df197f6c0f76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031191, "uuid": "b77dded2-b49e-4f61-b901-d7e82aba73a7", "value": "PersistentF3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ef3afa-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662018691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018691, "uuid": "127bb3cf-9543-4358-a678-d3be2f11f16e", "comment": "Malware payload (ModiLoader)", "value": "2df6641dd76043f80aefd2395c8797c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018691, "uuid": "34888cfa-a676-42a7-b9b1-37f57a64d3b7", "comment": "Malware payload (ModiLoader)", "value": "18d3b2043c0bbcb8af1d740837e13dbfbf803156a205df76ed824625d57158e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018691, "uuid": "04127d37-2b79-4707-bab7-cf9e348e40bd", "comment": "Malware payload (ModiLoader)", "value": "b74940aae38d2f47c35cfe6ec3a271f0314d0454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018691, "uuid": "44dc51af-310c-40bb-9ecb-916eb4fe8c24", "comment": "Malware payload (ModiLoader)", "value": "68b5714caa5ffaaf452c8621e4150bcb33df301b1edcec355fa0bee032570e1d4bd94dcd58db4f7ed6c02b88fe885c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018691, "uuid": "4f5167f2-a1f4-4074-93cc-5fd18dd9df6b", "value": "T1FF159EF672F04A33D0631639D95763A8ED29BD511E11B94E3BE4298CCF78680343EA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018691, "uuid": "d2b34ab2-16fd-402e-92b2-0874379ef4cb", "value": "e44b1ce3d13e55963ede0f334a1c0840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018691, "uuid": "92f25ddf-00c0-4865-b759-6c96db0a3ad9", "value": "24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018691, "uuid": "5ab73b64-571c-494a-8b32-01a2710a1a49", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018691, "uuid": "fdbcf425-5a6e-4849-ab37-73e3ed4f904e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018691, "uuid": "8e7a740b-1ba3-489c-aca7-76b07062c903", "value": "Dospjela faktura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b258377-29bb-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662012125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012125, "uuid": "1dd33c8c-d17a-463a-a242-e17a4c554820", "comment": "Malware payload", "value": "a6e88e853b0a5125963cec224c7389f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012125, "uuid": "ac9348cc-47f3-48a5-8362-e917ded4cfec", "comment": "Malware payload", "value": "18f418ba11bb61169db3e51b0f042ab139fc92cbf4f5f3ba87026a437adcbdaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012125, "uuid": "f0045f78-0913-40f0-ba53-59fcfd382fd6", "comment": "Malware payload", "value": "64667737a878ce67be61f7c9e564e5a378d7259c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012125, "uuid": "fd62b8c7-079a-43a0-8085-dbf2b4943869", "comment": "Malware payload", "value": "a8f159bfd0f3c5bf439f74df4546eb37830bc0f2d283d1b70d37c66959a5ad8a5f0d99f267488edd62886c031e6d052a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012125, "uuid": "29b6f4ef-3466-4798-aa3e-9e056b37493a", "value": "T12143BFB069508E11F8C95F310DA3C74ADB6E1E81267B7A0AF79EBC07BB317D24D28605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012125, "uuid": "8bc808d0-c2f8-47c1-8945-4225ae52b427", "value": "a6d5eba18a5abd00525734a3647c3abd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012125, "uuid": "f2ccb6b9-c657-498a-93e2-d24dbb44cad1", "value": "768:ATzAV+gLa1t9ioXQXx7Kkl4xi1oJaZXdYnxeZ9yU:KzAtLa9XQXflIbganxeZ9yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662012125, "uuid": "d040f4ff-d13c-4d64-8e78-1d2c4bd126b9", "value": 55822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662012125, "uuid": "8344c5fa-02fd-42d9-86ab-9e075cea8f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012125, "uuid": "e3c93df1-9da0-4e08-bee5-d2f89db9aa51", "value": "go.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc07b05-2a2e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662061632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061632, "uuid": "0672ec93-f84a-42f9-823b-c6a2f452eadc", "comment": "Malware payload", "value": "49ef54a9366c589c0f1b6e13d0997932", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061632, "uuid": "9cf240ed-df8a-49b1-a445-255934d52a1f", "comment": "Malware payload", "value": "1914b8c8cbb22ccebcdeb2c968e41f9113c9ea02179bae858cb76e477c3eb0b7", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061632, "uuid": "feeca545-3b30-4338-ba3d-2d8956811a9a", "comment": "Malware payload", "value": "3b85704b450414275fc59431b06fa7f4f91a7344", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061632, "uuid": "6ada761a-644f-474d-b815-517bf3a742d5", "comment": "Malware payload", "value": "b615919891b366948c3803179bdac52557593f9b9b2166d39508d93c20c537d5c16d8937486de19db79d9f3a066d960f", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061632, "uuid": "7c5c0b94-fb48-449d-a87e-237a2493b288", "value": "T15D5612696BE942B5C07B8A78C162A56BDD3BFC1107448A1F4311BB6D0F33390F17AB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061632, "uuid": "24fb79ee-a8e0-4d91-af2a-9fe81af0043e", "value": "24576:K2g6iSk124v3QMwo04WbKpHd/bq2Nf6lRcN5AWwem6EU0MmJO85:3g6iH13l04yK7/bERcLwBLKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662061632, "uuid": "b7e6406e-edc9-4ea4-b9ba-1f41f1acdbe6", "value": 6311936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662061632, "uuid": "c6255219-d883-4e78-a509-7b80b8141c37", "value": "application/x-virtualbox-vhd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061632, "uuid": "0823cd61-d414-4e88-99c1-8c9bdfca30d9", "value": "applications-09-22-18.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b87ae1-29cc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662019251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019251, "uuid": "c54cd350-af9a-44f3-b96b-6e1beb71269b", "comment": "Malware payload (Formbook)", "value": "00610b7a20b3af0c67b2b39cf2407b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019251, "uuid": "99aacde5-5cc4-45f1-9fa2-2d8811baa5e6", "comment": "Malware payload (Formbook)", "value": "192270166e17780c5b1de39e0b906115798df4185b2413dedcbebd114a01a5e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019251, "uuid": "e289eb53-327b-40cc-8b21-7482b11eaef6", "comment": "Malware payload (Formbook)", "value": "1de10882caba880eab6a3d3417cf72dcac0b6417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019251, "uuid": "b49f273f-1f07-437c-aa5b-d92e3da35653", "comment": "Malware payload (Formbook)", "value": "d5fc8a1283c5a62e7dcc2007ee1ec5f275c95879313cd1c0d1b0b868a90623ab941078fa86275582d3f302f20b5fa586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019251, "uuid": "4ab08e1f-a26c-4f69-a8f2-fead23c6b432", "value": "T1321523845FFDCA27CD6A07B32076869C03FCF639A812D131EC97AAE54A4439AD141ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019251, "uuid": "5d2bb54e-08bb-435e-81f1-190a930421b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019251, "uuid": "c5f271c9-0f31-413d-b429-05607b65783f", "value": "12288:4sZ1zzqH+OMcKDZrqlmak6ALniJFHa5fNNYgsWdO+HGpjWS+zopLGj0NwvDbYsuP:54HEZ6Iry05fNLs4mpjFUj0NybYNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662019251, "uuid": "3c15566e-73ad-4090-beb9-845d59b5f62c", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662019251, "uuid": "4e2fd1ef-2307-450b-ae83-411cba2f5b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019251, "uuid": "a228617e-60fb-41c1-880b-ab7943f8052d", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311b5ed5-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662027839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027839, "uuid": "4f44b6e6-3b87-4d29-aae5-eeffac485e5d", "comment": "Malware payload (Formbook)", "value": "f815435415b15b0b2847591bcd2503c1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027839, "uuid": "37a98708-dad8-49c2-86c7-224413ba8305", "comment": "Malware payload (Formbook)", "value": "1953141dacacdb78b26b51ad716668724a4396be2f1cf35094925c6892321211", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027839, "uuid": "f14797e8-38dc-4660-921d-7906222b7152", "comment": "Malware payload (Formbook)", "value": "2b0b163d7c28505022b8d6d521ef85bb4148d958", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027839, "uuid": "4026430f-d40a-46c8-aafa-efe5bf842e77", "comment": "Malware payload (Formbook)", "value": "cfe095073f911103cf0d5f25b82627e06808429f52f88cc4cb22fbff7ac4a69b3f4c89598ce84aa3fff40ed8c7eaf8bd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027839, "uuid": "f3870459-f84c-4efe-a335-91356df02ca5", "value": "T1B115124ED284AB23F4AD0B3552F0F71342BE3F0A91B1D3C94DD8E3B429ED7668146A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027839, "uuid": "94a97623-06c0-48ed-a33b-01dc5340b271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027839, "uuid": "1968d85d-b8ba-411e-a650-0a70f8c52c54", "value": "12288:QF75eQpTC+NBB1Ql5HGkVQEOOh0XxCcQcxIEI3FzkgQgPwqoXY+mzoRtbvRT7:QZ5rZhLBSmzizMHUzBQXY+mzo3bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027839, "uuid": "7586bc1c-5190-4c8f-962a-93b90b39878c", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027839, "uuid": "7e5b61bf-9cc9-40f0-900c-6b190c0d0244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027839, "uuid": "104aa394-dfee-481f-bc51-4d35194a9113", "value": "DHL ACCOUNT STATUS - 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ff177b-29be-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662013326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013326, "uuid": "c692a006-cc5a-4ec3-8b79-28aa0e27d775", "comment": "Malware payload (AgentTesla)", "value": "b57bcf28e0632bd065e9f29db93e8944", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013326, "uuid": "5cf3b837-63a4-4ff6-9128-22d104f88187", "comment": "Malware payload (AgentTesla)", "value": "19c775f6a893eb2195170017e1bebfb744a355d72b2678d4f6457b65e167d04b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013326, "uuid": "b4cd705b-5b04-4f70-a3dc-6d6506095d11", "comment": "Malware payload (AgentTesla)", "value": "96759dedd6d129102fde34140b8f857c665f7f66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013326, "uuid": "5fa4c9fa-886f-46b0-9f21-fc2618fd95d0", "comment": "Malware payload (AgentTesla)", "value": "013b4c9d220e4259870ab93c730de51e32b977134ee3d32383519cb0898f5cafc9a0a29fa281680d6c4bd6761eded620", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013326, "uuid": "f899eec9-1031-4fb6-b82f-dd358831a224", "value": "T1062512899AC483B1F42B1BB011A1F25986BABE15D571C2DCAFCFF2EC45B4B025257E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013326, "uuid": "0bd38252-1c93-4f96-8713-b8d25c407bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013326, "uuid": "fd59879a-fbee-4113-a893-f302a4feb495", "value": "24576:hZ5nXY+mzo3bvlM67glLxOoknoa2sJq9/Hjq:75XlmzMvWk92suD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013326, "uuid": "2f75d152-555d-4dbd-9ec7-64c24d4af0af", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013326, "uuid": "09cfd282-d2c1-450d-a9a4-a63f9e501988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013326, "uuid": "2bdc8231-5229-450d-b531-7cea587c3920", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe3a842-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022166, "uuid": "6a051083-a0df-4bef-8bab-be09fbff33cd", "comment": "Malware payload (Formbook)", "value": "7864fa09a6b871e46136b604e2a94cf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022166, "uuid": "0e3c64a7-e3d6-4498-8011-fd389626d4ea", "comment": "Malware payload (Formbook)", "value": "19f4465b541efe4239fd64d4ced7b8b3f07e1b6b967814c73066e004155be6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022166, "uuid": "2b0b45ec-b12f-42fa-a759-8c446e62e0e7", "comment": "Malware payload (Formbook)", "value": "041ae664341dd0c663e7ad66864cac221ef44eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022166, "uuid": "e9d39af7-50b2-4353-87b2-80d923e482d7", "comment": "Malware payload (Formbook)", "value": "5e5d5b628db8f737622f9ccfc1e3b1ba95a75b3bdd16fa4b6d31d38cc7aedb2cca47a9dd109b65eb893188163aa0e1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022166, "uuid": "5af472c5-8f5f-45bd-b8a0-ede99e6dc6d6", "value": "T159E4011992E58F25F97C0B7491B0A312437A7B19AC73D39E4CC4F1F45EE53228A5BA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022166, "uuid": "c1e36ca7-9fdc-45e6-a96f-659547ec7d94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022166, "uuid": "e85d02f7-7541-40a5-a043-d739f87c1d29", "value": "12288:jSqg5SXF75ev24F6LcYl7ZrC4PRjIds2qMP5OxfK35T+7c6/fy3Zw+1Iav4b:3XZ5WvF6FHrBIeMP5OkJTWc6/fg/60I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022166, "uuid": "32cd8b7f-f25d-4776-8955-0a1f850ac000", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022166, "uuid": "b97e83de-736c-4ed4-aecd-9687f782ea85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022166, "uuid": "2b4c7cab-272c-4f5c-9600-f31a9d1d5c96", "value": "RFQ-31-08-2022-Doc.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5196fc89-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662043785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043785, "uuid": "cb2de4e3-14e4-46f3-ab3f-a8cc563e670b", "comment": "Malware payload (Formbook)", "value": "3721162cef4b21c07de63b34e8eb6e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043785, "uuid": "1ab3a60a-7273-4a6b-8dce-1e9964dba775", "comment": "Malware payload (Formbook)", "value": "1aabce457aa66a0f3aa64ef6204da312920d2e085ea4025a39459b9c28ed566e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043785, "uuid": "34b6f04f-a4bc-424d-b79e-62963a1c0c3e", "comment": "Malware payload (Formbook)", "value": "c4107a28adfeafa6ab20352a4bd56c47bd968e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043785, "uuid": "f2b657a4-5066-4946-b917-aa947be6f8f7", "comment": "Malware payload (Formbook)", "value": "f78a82d8d846502e5097da5737cc137ad3183f583019e585ebb445e3bc144b82ac4e5273b67e2bc4bc8359a6986a6db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043785, "uuid": "1bed69e6-875d-4573-83aa-521b96c2dabd", "value": "T10C136419337C9712E47AD3F14A9C918243FA712E2222EB488CCB39EB15BDF519750E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043785, "uuid": "bf18af9a-8c91-40c1-bf76-4b9379a31ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043785, "uuid": "3f85bca7-bfa6-4032-8377-e8eb726cb1a9", "value": "768:bFBAWNatGPra/9tRcXJaxytG1jGPSrP7thBahe:twGPHXJaxWGF2QPBahe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043785, "uuid": "c0041f69-1700-469a-b4b6-ff7fa701e50b", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043785, "uuid": "4dd23d97-9662-484e-930a-5db7c7fca1ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043785, "uuid": "b9f3ff93-b5cf-4a83-b95a-8092a39d35c8", "value": "RFQ310822_vivo_concerti_PO54637763_657993877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d6bed1-29d5-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1662023072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023072, "uuid": "c19b7c77-0b5d-46a0-baec-e19ad68e160e", "comment": "Malware payload (NetWire)", "value": "24a005a1488f71fb65d78eeb4d5e4876", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023072, "uuid": "378be75a-413a-417b-a5c1-98976ee889f7", "comment": "Malware payload (NetWire)", "value": "1b2073dc1d040030490fc5ccd754120af88334825c88ee088539122aeece4e86", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023072, "uuid": "302d4ac6-ad7b-40d9-9d5b-55e2aa021a11", "comment": "Malware payload (NetWire)", "value": "93872739564b1d12f600dadb2857445d8c6f9f26", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023072, "uuid": "beb74cd0-5988-4ae0-8cd1-c68325b1204c", "comment": "Malware payload (NetWire)", "value": "752157ef26e68b0375bdfd6705786022d2ffb20bfba8136e75472513f37bf86291a34ceac28b7d9523115e3a83f75ee4", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023072, "uuid": "28a7b6f5-c79d-46a9-acb6-ff25b0cba289", "value": "T1A96502499684C3B5F42B1BB01171F12896BEBE159671C28DBECFB1EC4BB8B125217A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023072, "uuid": "9d708d9c-c292-4ea1-b53a-4ae90c27e71b", "value": "12288:6F75eqnN7org1+XKeT3unq0jEnrDtyejzJegPwqoXY+mzoRtbvRT7:6Z51ndoNXHynlAnrDYoleXY+mzo3bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023072, "uuid": "85c461cd-a493-45d0-926f-09c83c247f97", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023072, "uuid": "0c8fe87b-12ac-46fb-8bf5-7af000deff03", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023072, "uuid": "0c415e02-a076-4852-8920-f1b7fe20f119", "value": "Tax Invoice.PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d08df7-29d0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662020896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020896, "uuid": "e6bc4f91-9ecb-436b-8ea8-13d2f1d2e215", "comment": "Malware payload (Formbook)", "value": "73cf6ccfd02c904058311989ecb61ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020896, "uuid": "f912a466-b07e-4880-8a3c-59667a927073", "comment": "Malware payload (Formbook)", "value": "1b5882c4ba74d1cc2367938d0dd85e8c651887309d9c0abab0587d903878229e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020896, "uuid": "ebf3aac9-0b1b-436b-aaec-bc74c6a9ee35", "comment": "Malware payload (Formbook)", "value": "539a6c8c85d8b371b09b28ec55f32aeb58e1ecc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020896, "uuid": "3563c564-50dd-47d1-87c9-9127fc6f87c5", "comment": "Malware payload (Formbook)", "value": "75f3acfc592e8e25cb8f86381aa5f702c45e438a5fed886a2a77555ae12fab9ea6658880c87c6904b73604ea2a3eb538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020896, "uuid": "3b435cdf-b72c-471d-8d4b-0fe6d6082020", "value": "T1E715234976E6E947CA344773085161AC4F7893996823F13F6CEE53EE0E493FA4291E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020896, "uuid": "da5a9ef3-1ddb-4505-a0c1-e1f6022956ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020896, "uuid": "bf7c0071-ae56-48d2-8f2b-122de296c5e2", "value": "24576:jfbaHP+LiTREE9bSUjNaP3SNDEqHEZ6AbYNt:jfb4G2TREaSJP3SlbaYNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020896, "uuid": "251ed0ec-cdce-41a7-9c98-8c13400e3348", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020896, "uuid": "6128e63d-496b-426d-a2dd-096b458a7038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020896, "uuid": "514a85bf-6728-4feb-bec0-72297d298705", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba7cf6a-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1662024313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024313, "uuid": "1c98b277-c4b6-484a-a69f-e4cbe5ad4836", "comment": "Malware payload (NetWire)", "value": "ac9cc6bc1e83854378c4d59fe0050efb", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024313, "uuid": "8f03b9a4-debb-48d4-8654-bde6c4f6477c", "comment": "Malware payload (NetWire)", "value": "1b964f7a2c0d0f90f083afd67ab71bedbfc293eb888f929d1331adef0394c27c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024313, "uuid": "6acb65f2-6990-462d-8165-a1d62e5b7dbd", "comment": "Malware payload (NetWire)", "value": "438afec1b0fbf225356b7fa6b9622be23160f4e8", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024313, "uuid": "97712933-05cd-45de-a2ce-273e36e9ddf4", "comment": "Malware payload (NetWire)", "value": "a5e08ea8c24e066aafe5758a47a017c7dfc524aa823599f5e5bc28d7ab1bf164a971635690a620418b636f3683d60854", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024313, "uuid": "cacbaedd-b1e9-444b-93b4-a7a00962d64e", "value": "T17775024956C4C3B5F4260B7011B1F22986BD7E1592B1C2C97FDFB2EC4BB8B129617A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024313, "uuid": "da0e9200-3320-4ad5-9517-50cc93193dd0", "value": "24576:5Z5+XY+mzo3bvrn23nt+uK6ogSOY2OKP1:j5YlmzMjcocoOYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024313, "uuid": "9539f902-0b96-40fc-b6aa-39a4e02003bc", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024313, "uuid": "aad75a43-e1ee-488b-b7c9-f393eb193ee5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024313, "uuid": "7e385654-0047-4794-84e6-6fb0e154a7fe", "value": "Tax invoice.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867ad5a2-29c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662016815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016815, "uuid": "e606b7ec-2db4-40a7-a5bb-7fe4a429f76e", "comment": "Malware payload (AveMariaRAT)", "value": "82d056d54f657095be85b95b34aaae59", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016815, "uuid": "bcec00ce-673c-44db-a53d-a0dab1c28744", "comment": "Malware payload (AveMariaRAT)", "value": "1babe82911a15693d136412ce60c459c3776e8b346b6ff87da87239ea19c7e90", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016815, "uuid": "6fd78e9b-e4d5-42d2-9bf9-0ef66c056645", "comment": "Malware payload (AveMariaRAT)", "value": "5a507c8bb430b0b47f25e112703f9f751c2ede7f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016815, "uuid": "17c0d200-da88-4ae3-8770-5d2cf44c373d", "comment": "Malware payload (AveMariaRAT)", "value": "113aed5e40d5b1d4d81e677dc01bd49687a5dc20742d4f44e9b34956a35550bf5401b85c84d88708efd4abb924612ea4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016815, "uuid": "8928ab8b-e914-4ef0-94f8-9a5b5fe59dff", "value": "T15FE47CA71BD5FA90C0BDB7B5336836A4A3F1D0D78491872B194880DA77B37817AF3486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016815, "uuid": "8370d2d5-23ab-42eb-8ea3-13fdce7c77cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016815, "uuid": "9868d1cb-961e-412c-8630-0724c718956d", "value": "12288:OHEmO6r4YqRl8+WQBlHxe/tZPyIlEnuEF:f6rS3Vze3bEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662016815, "uuid": "65d10343-9135-42f4-a8ed-aab52f75bad6", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662016815, "uuid": "66c9f58c-ffad-4822-9726-15f0e2278742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016815, "uuid": "f5885719-d745-47ff-b135-4e05256324f5", "value": "Purchase order NXLT02208211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642c2f32-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662043386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043386, "uuid": "e7c7e69d-a3b1-409a-9939-4a5820ab47cd", "comment": "Malware payload (SnakeKeylogger)", "value": "ff3dc42fa2accc35392198c6a051efe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043386, "uuid": "5c4e0dda-c537-42d7-855b-63e79fb3bf31", "comment": "Malware payload (SnakeKeylogger)", "value": "1bbf41a764f80dc096ddcbfe462fbf3149d3bc060f4bda7f083c065357fb901f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043386, "uuid": "053f2aca-08ae-40c5-91fa-856de406e9e7", "comment": "Malware payload (SnakeKeylogger)", "value": "c5d00589b42e9bfb3a7fd5cb4c07dbad343bfd0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043386, "uuid": "1ce056ac-2e72-42f6-80c9-39f0a961c917", "comment": "Malware payload (SnakeKeylogger)", "value": "b896b874e7233b490eb036222a45aaf5fc05353422a3f866b0df6ab62fd72c857d48ab765739fa7fc702b8a33b3c1821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043386, "uuid": "156e8eae-cd4c-4ffd-a245-5f267cb5fd36", "value": "T1CA551283B2989719E794357285EB9A3C87C6B9D73133E3972F1872892D01373DD40B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043386, "uuid": "01bd1dda-0f38-478f-b904-c23034d214e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043386, "uuid": "a8442a6b-8824-422b-b655-4fd931b8ca64", "value": "24576:ECYvqP8Rzqi+1auyVIaFxmsHrfVJ+bdBSYiIPuEbXMHyVYxb14tQ:gTzqi+IVVDVNJ+beYlWEbXSy2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043386, "uuid": "8c32451f-89c4-40b8-a518-32d7ee5dd779", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043386, "uuid": "610bfba2-2cf8-4a01-9c57-8e8b58cf4418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043386, "uuid": "ae9df8c0-96d7-439b-ba88-f0cd9c38399f", "value": "PO#GREEN AURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66c6c22-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031176, "uuid": "401f2daf-1b5f-46ae-ab85-557626cd3cff", "comment": "Malware payload", "value": "85d16ca27df29e0d191255458a4a4fdc", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031176, "uuid": "989627fb-3587-41dd-8718-e99790ececdd", "comment": "Malware payload", "value": "1bf1ffe07fc46f7415a3767797fa48e60e5b069be5708c70b48b290e7565eb5c", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031176, "uuid": "09195d46-2a76-4254-ae2e-c5b901a39f6a", "comment": "Malware payload", "value": "e376d138c3fb1f16f155f3cd8b6e932e1576bb8a", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031176, "uuid": "866cd2d3-73f2-4419-8214-ce56badf7fd9", "comment": "Malware payload", "value": "3844c022d55198f3a2f5a05adbc5418db72dc342bd16d97937bbdfa400e869b634ed6fca37b3d08bfbaa90ec19418303", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031176, "uuid": "40e36fc9-0f88-4633-9452-1b3afe6ea07e", "value": "T176420A766942FDD56FBE7D409C0429911CC87A2B53A4AA7CFBDA09BA2CED010DF134A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031176, "uuid": "e243a516-ed69-4b4f-9dea-efcac4233d99", "value": "192:IAC/Q5tqUfPkm5xR9umd3MrYnGXHnKchxoBRLQK7mnbeD+I:HnrxR9MSGXHnKWXK7mbeD+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031176, "uuid": "d90dcfec-f8ce-4013-86c1-701bf0fdd8c8", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031176, "uuid": "7fb0ada8-f0fb-4cc0-99a7-a6c2e5bd3466", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031176, "uuid": "db7e78da-1732-4eda-91c8-548e7519b41a", "value": "Dllf3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b781378-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662043721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043721, "uuid": "08496582-5b61-4f1a-9255-a8ade3440380", "comment": "Malware payload (GuLoader)", "value": "dd861c11b71d1dabb90625df88007468", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043721, "uuid": "d90f64a5-9a38-48e6-ad0d-6fab3a3bbbbe", "comment": "Malware payload (GuLoader)", "value": "1c363729a89c7be4f758100e3ffa29fa98a3f2acd385b515d66e12c74e209199", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043721, "uuid": "9d603112-6d48-4e5d-9040-2b10f894b4a7", "comment": "Malware payload (GuLoader)", "value": "ab2879b29e682a5715c5e47bd9287752e926334f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043721, "uuid": "e135c337-99ad-4ce7-9574-0c7d749a34bb", "comment": "Malware payload (GuLoader)", "value": "8c5f479c979d93dda1a2aede91ac9be1230a58b2092605e5212b28bd95d8c78dc3ef38a110e6d84c7a4afef944978c33", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043721, "uuid": "ace8fb6e-0b53-45fb-bd60-334ed2a78684", "value": "T1CAE42340F2E18097DDAA03F00E765E1D09F67E1B88F1A70F67487218A7375E2DE4A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043721, "uuid": "8754e0d2-7407-418c-b550-0c67159e6cc3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043721, "uuid": "90e28ac3-0981-41c4-8d09-4545155efcd8", "value": "12288:/gPq7g9VxCWlmGcWd7r110SPrmLDQK+HMBjVZ9Bs:/gPqcxnmGT0HNVZXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043721, "uuid": "8a3c02a1-75b0-436e-be4b-b52c4cf5ba51", "value": 661192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043721, "uuid": "c3166ee7-e022-46f6-8242-3ebf2738b745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043721, "uuid": "a7b4cfe4-5554-4347-be0c-f084e4a15758", "value": "DHLreciept00098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961341b6-2a1e-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662054637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054637, "uuid": "93c45afc-b7e7-4cac-a27a-3e5540805429", "comment": "Malware payload (RemcosRAT)", "value": "2db6399f31d17bc882af364fbb4fc519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054637, "uuid": "340689c5-2dc1-4424-843a-acec3461e73e", "comment": "Malware payload (RemcosRAT)", "value": "1d54c7f11bb2f8ac095bf334f0d8025ae7b8299c483c62ad9604f22b92204814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054637, "uuid": "e9751a7f-9abb-46b9-a365-76366a288b3b", "comment": "Malware payload (RemcosRAT)", "value": "36c0f563dfb29f2ffc7669aa77b1c13b889a3474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054637, "uuid": "ba0c3938-dd64-4213-b03e-5cf912369191", "comment": "Malware payload (RemcosRAT)", "value": "fed8693e0a51961e5af00fedc3e0c5ffc8e3325de4d35eeb8b1da20dfa410649beae4d933c9ecd403fa043a11d84f44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054637, "uuid": "f4a377ee-fb8b-4008-9a58-b10bcc949546", "value": "T1D425F0189C9CA7FCDD129F3960A54AB245D35D722C8FAB6C4F893678CDF6782740890B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054637, "uuid": "329fddf8-339d-4e87-ae73-0f967c7bfdd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054637, "uuid": "27da13df-4aef-4096-85cf-af97ed189ded", "value": "24576:GRaciQxpGaKqvW63jqVGjBEmy+28mthtr:Qayxdx3jq8BEUGtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054637, "uuid": "d8f83551-b9f5-4007-af51-e98284f1e74f", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054637, "uuid": "0f2c4714-6505-4211-9af2-fc3fc6e3d81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054637, "uuid": "31ce19e9-17d9-4459-b392-e589cfb3ae3c", "value": "Recibo de DHL Document awb 2032675634,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeef4bc-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031157, "uuid": "b172b679-5748-4464-bc54-3c39fe593ae8", "comment": "Malware payload", "value": "c4803c9c32897cb849b7210c41ca7639", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031157, "uuid": "ed092686-fb2e-4533-a319-aee75ff56ab5", "comment": "Malware payload", "value": "1e991e2d11fc0b38b8d17dde9a786b45d57a4e01cbef4b34f05f6058f4fbea1b", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031157, "uuid": "7542d168-5590-45b4-9465-383e2e399e17", "comment": "Malware payload", "value": "0d5a9f7b3c5e5d185e33ee534b652c8ccf9444d2", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031157, "uuid": "53242fb9-e23e-43e0-9651-092723dd8c6d", "comment": "Malware payload", "value": "e8c7798adc81234b85e7b49540a42c42f108cf4cdd7a6c442db2dab9edddb3dc7cef053d04b973c53f3a67bc2f641a52", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031157, "uuid": "a10ee4ff-621b-4bbb-94fa-9ffd9cb5c7bb", "value": "T151534BF652135E8F4A370E18E40C1315ECE9A8EBB3D8D5E87F498EB54E954588CB4CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031157, "uuid": "41b05a99-77ac-4303-8667-e674a06e7e56", "value": "1536:KTjWG0aO6hvrFWmvAbouUmxEOfciw3H35oyQcuOz:40AFgwuULKci+35tQcFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031157, "uuid": "0e0b2e2d-0d52-4f21-b731-3523d370c30e", "value": 64856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031157, "uuid": "42b4ddb4-1911-44f0-a11c-c690a6f2ef37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031157, "uuid": "44791695-5bc7-4447-9cc5-aee866da5a8e", "value": "C2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123e762b-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662018338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018338, "uuid": "87b5f2c8-11bf-4afa-a497-fe2f4b930473", "comment": "Malware payload (AgentTesla)", "value": "9e22324dca3d7fa3b6295977c8e98a96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018338, "uuid": "af39bc6d-1cbc-4b7d-af74-e09c27a231a2", "comment": "Malware payload (AgentTesla)", "value": "1f6e1758b123080556a5ee96779d9ef63f54f9af1d07d8a3cc8cff39c636b12b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018338, "uuid": "5306ec30-6844-490e-b910-08ef19dec4e2", "comment": "Malware payload (AgentTesla)", "value": "2307b7858286b19be8e7995df61bf7dcc8df5926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018338, "uuid": "4f98e41e-24de-4b69-bc2c-903429cf5d02", "comment": "Malware payload (AgentTesla)", "value": "b2020bda38903829d570deaa5437c7919cc1c122f3977a29cd60024712dc1e2ec44b43971d141c824ee89b1c6530d64b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018338, "uuid": "8f753d5c-c6be-48ba-83d8-61b674761bef", "value": "T1C984F8E0317DC383D1A19EB11FCA867079F176ACACD0560DA0F99B2E93D2391149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018338, "uuid": "798b8aa2-675e-4eef-8540-6470012889ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018338, "uuid": "f98c64f6-a621-408e-a838-8ee2e12e4477", "value": "3072:aiFUhWPvi4voGtW3aoAIgBSXk6gKW8NmyQvk4FAkiLPVSJbsHIVMdvqGMjTQ7n/+:xHi4vXgUL8NdOHxjJoHSovqGM0/KiUMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018338, "uuid": "70aad135-7294-4971-aa45-0b8c1b0fc157", "value": 375216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018338, "uuid": "5ba02db8-99f9-44eb-bc77-827edaef94bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018338, "uuid": "37d8e3be-ffb7-430c-94b2-8281c9dbcf0e", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca8380c-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031187, "uuid": "3d7c559a-65e4-4456-8979-f1be994a27bb", "comment": "Malware payload", "value": "db46d15f798df119972f3e1647d6c2ac", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031187, "uuid": "b5acd202-02bf-43f0-8d7d-896e6c718955", "comment": "Malware payload", "value": "1f7730cdb7bdd2b5687f3555f02aa12ba830618fd60654888461642031d2b76b", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031187, "uuid": "0b983351-eedc-4ec7-8db1-d61eef66a90f", "comment": "Malware payload", "value": "c8eba3362cad5ff6d2005cce6ff8d215f5b7d52d", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031187, "uuid": "b2e756ef-f769-4da4-9d82-cf591c2ba0a3", "comment": "Malware payload", "value": "5a2c719065d4bd0f2f99683c307833aeb54981ee3aef6a10e5f08b2db4d5abcb0b01403818fe5861fa37146ed7eec570", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031187, "uuid": "e0317591-e759-441e-ae07-8be96f814c95", "value": "T19433472B34BA190EF0639FB7EDC4B8F58C8DEAE1342561B661D143138A00A71ED556F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031187, "uuid": "568aca69-59e2-4bc2-9a13-3b0adbecd9c3", "value": "384:qHisLStdUOBWk/1Vn8Q/k/GU9d4Q28xUsyXJVPeXR/KMzhaI6KPzG+6s7CeGi9Lp:7r8WI2ni/d4U8dGg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031187, "uuid": "9eeb1cc5-1be2-4b84-b15d-d0133362c187", "value": 52262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031187, "uuid": "ab342ae9-d3aa-4508-b8dd-0465f7540703", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031187, "uuid": "63c323a6-26a3-45fb-8e3b-81f38e68cff5", "value": "Peregil.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9ec618-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030193, "uuid": "fc9a887e-be1e-49e8-adba-714beafcd9a4", "comment": "Malware payload", "value": "d888103fe76fe701237dd98898d849cc", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030193, "uuid": "183f94c6-b319-43cf-bb9a-fea9ee3dc37f", "comment": "Malware payload", "value": "20abd93a1c949874ca930d270c2fe1a4dffd8fa7d2a3056111c35723999d0078", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030193, "uuid": "0330bcaa-4fad-4feb-8996-74286be524cf", "comment": "Malware payload", "value": "5c138e41c84ca29bbaadd449ebef7d85374d1349", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030193, "uuid": "e346e506-e43a-438b-a558-61a339f10ebe", "comment": "Malware payload", "value": "0aa3d41f7aa3bffa5c36a51a8c0a3ef5abfa4eb88a646a15479c3b4fd3b02c444aa8a9776573d4ca9afec98998b7e5ff", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030193, "uuid": "c53f74ca-c16c-43c6-a718-520bc95f988f", "value": "T1D10142181D561731C372CA3B44DA731388353D17ED927F5502E012891D59610ED35F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030193, "uuid": "e5a4e622-fdb6-4aec-b435-0e50dd2e1298", "value": "12:8AlXr0C3pQVe/4VdiGlGW+fGpiumZPZq2r9alwllDmNf7+lbYqlKBnml1kK:8ArFpQQCiG1+frnZxq2rlwzab/oS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030193, "uuid": "dcf8c434-e0cc-4c64-94f5-351ef2dae55b", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030193, "uuid": "7b4b30c6-65e3-4905-aeaf-d0e306f3d337", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030193, "uuid": "86f87950-6457-4867-9e4c-df727e8d4390", "value": "20abd93a1c949874ca930d270c2fe1a4dffd8fa7d2a3056111c35723999d0078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372df510-2a2f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662061779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061779, "uuid": "bfd46a29-1a24-4f93-af26-e55521689931", "comment": "Malware payload", "value": "1d5112a31adb9f0b52b72614cbe104e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061779, "uuid": "53d666f5-bb4c-47a2-9e41-bbc11e764a27", "comment": "Malware payload", "value": "21744c474eb784b6d0d54de44451154dcffe08d3e8e4e833a6957cdb0165742e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061779, "uuid": "bd1dcade-35c9-4baf-a401-bb116989b620", "comment": "Malware payload", "value": "438b19f57dc51d56d7957a89ae9732d29e7d5ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061779, "uuid": "5128cef9-d06d-448d-9c42-341e07ed4b7c", "comment": "Malware payload", "value": "a4b5321908252d19598f592c4f2ac80a0717c8eb88bb1a48a3923aa57f2bf072df38ef3336cf8dac548a3787441f48de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061779, "uuid": "135155cd-5507-4811-97c2-406307681f38", "value": "T18435121A8A994F22F8543BF041F1E21192BD7E241574C691CCF8BBF815F8BABDC4615E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061779, "uuid": "a0c2d039-13c1-40ff-8f5b-55b03f78b850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061779, "uuid": "c84489d1-ad00-40be-bf26-4805e04edb03", "value": "24576:4E9+Z5Rx8EfjrXY+mzo3bvRvCmkE/bA96XwHQgq2ugVNfFR4bhVEc:+5R2EnlmzM5y2sQH2dHtRCvEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662061779, "uuid": "a69c8918-8cce-4dbc-9f97-934cd95a7ad5", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662061779, "uuid": "14c9f0cd-7e37-463b-995f-8a7e035ceaed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061779, "uuid": "7235f27c-dd1c-41f2-bfa4-efeb87f3b589", "value": "S1McPDQzRJY2xFP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab9e618-29ad-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662005924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005924, "uuid": "f9a35cd2-15f6-4462-914c-88afbfcd5c21", "comment": "Malware payload (Smoke Loader)", "value": "346e0a8ea14a15a3cf2bc95fc81e479b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005924, "uuid": "33ed315e-6358-4e1c-90e1-b9f73ddb71b6", "comment": "Malware payload (Smoke Loader)", "value": "217f5797fbae3c2f0ec71e014f9269175b692c3055906302c969d328268e198e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005924, "uuid": "1332e764-3af1-4cb7-b3f2-a1748db2c913", "comment": "Malware payload (Smoke Loader)", "value": "be8ddf5928b57aac793318c211b00f2152525773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005924, "uuid": "56f30822-39cb-44f8-b50d-611c9fcfa08e", "comment": "Malware payload (Smoke Loader)", "value": "81bd68815d1c6623a431d8582ada5710a256bef392e79a12ea95bab8dd33c9ba06ab13e2c0f2b5e3bfe681bfdbd064b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005924, "uuid": "b99d349d-42dc-45a6-a418-ca6d009df3cc", "value": "T13F54E122BA53C0B2C45556715475FBD51BBF4830273406DB37AA276E6FB02E28A7630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005924, "uuid": "73dc503f-95ca-4a2d-9600-684d112185e4", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005924, "uuid": "4829efea-cfff-43f9-9705-7b3b6e1bf64a", "value": "3072:FnXkAsl8jsPLUtZ7r2ooKELfef3IU5pcEvQOC3sazxH0:FELAZMjA550hD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662005924, "uuid": "126f2d21-c2b1-4c10-a20e-9c4d6bce5ea0", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662005924, "uuid": "948112e5-ea25-40ec-b2f6-6c845d16a055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005924, "uuid": "d15380ac-a850-4e6b-95d0-fc31a411f031", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0fcfc8-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662018626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018626, "uuid": "e575f206-ca14-4ece-8de2-04fe26faeef5", "comment": "Malware payload (RedLineStealer)", "value": "fb2c1a55b38a17dcb25c05b4aacb4443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018626, "uuid": "80667dbc-f102-4e3f-a5e6-4576d0925f45", "comment": "Malware payload (RedLineStealer)", "value": "235667aad7d9f703f1042e857b70bfb7b9b0b2b5bcde1af6fe63663a02064a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018626, "uuid": "c99fbc03-5ba5-4f9f-ae8c-c79cd0b66497", "comment": "Malware payload (RedLineStealer)", "value": "975192ae5e1bb2a4c4a894066c6043642d4906d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018626, "uuid": "9a3edc1f-4308-42dc-bdc0-63608663c8a1", "comment": "Malware payload (RedLineStealer)", "value": "39ed143a8620a97a2b8444e5ad5871f0d2f78d6b1d9b56f6ae75e657edf38ef0fbec09afce2f80703cf85babc4b96d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018626, "uuid": "14be0343-cb84-4fcc-9b5f-e4207bc4689d", "value": "T11D840222F583C0B2CD5396305862C7D1AEBF4931D36514E73BA83A5E0FB06E15AB625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018626, "uuid": "f8e0a810-12e5-488a-936d-a1f7631af308", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018626, "uuid": "fc0ecfc8-24a0-4378-92ea-f0e7c5be3b8d", "value": "6144:wZD3Lyc+bvl7wKOZJpwcAeR6XbOcaFmEJGc7vmI//u6PPL:wJ2c+bvlbOZJAeR6XbOcQTDD//9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018626, "uuid": "7a4921af-adeb-40c1-b8fc-474bc596a50f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018626, "uuid": "85a868c4-c798-490f-aaa5-6b963e06ea56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018626, "uuid": "e72e503d-ca54-497d-b4cd-0612d964046b", "value": "fb2c1a55b38a17dcb25c05b4aacb4443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594e54c8-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662036926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036926, "uuid": "9fbab22b-7252-4bcc-8022-c383acb3c63b", "comment": "Malware payload (SnakeKeylogger)", "value": "d1b73c58081bcbb43a88a8d33828c71b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036926, "uuid": "1f77e15d-d2e5-480f-9fd1-307a9987d7d6", "comment": "Malware payload (SnakeKeylogger)", "value": "235ffef66c38befd0b8bf53bc32cfb2e57378ae3e19f3b4204dd7918c4dc30d4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036926, "uuid": "7a503659-6abb-4672-aad2-f4752e614d79", "comment": "Malware payload (SnakeKeylogger)", "value": "7d77cba28a5b3f517541ef5d711854714b4aa9b3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036926, "uuid": "6c95e041-ee34-4d1a-b43a-e2d70c698bd0", "comment": "Malware payload (SnakeKeylogger)", "value": "c957e69a1f847146294ca667076ab00cd10d2ddd973934e40f9cddced51b048117949cf8a8d8af6ea86c012a68532c70", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036926, "uuid": "3ffcec61-cf5e-4f99-b3e2-bf4e59459760", "value": "T16954237C83DCD63A262341FF0D29C39F624E1B8F2947E533646CC381965825E36A4EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036926, "uuid": "aa6ccb92-b950-4119-873c-03e4696ec7e4", "value": "6144:L4HDMa2O5uAIyjaBP8gBQYOEHfLYbqgyncd6IsJMg:L4HDZ2O5HIyjuP8gWVEHfhgScd6IsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036926, "uuid": "77d6309b-5d0b-44f0-8347-339725b3d332", "value": 294765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036926, "uuid": "0fbcbf55-72cb-4550-aeed-27992e72cde6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036926, "uuid": "092a33de-64f3-4778-b451-cd3bb0b69a08", "value": "Purchase order 10261166 from ElringKlinger_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944c8aad-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049050, "uuid": "c779fe6d-5de0-46e9-9ca2-60f4a676bdd4", "comment": "Malware payload (Mirai)", "value": "7d3bd8d5faa7bf9b2d4cf068903ea293", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049050, "uuid": "d5e8ba1a-d665-4c86-9e97-fdd2715b24c4", "comment": "Malware payload (Mirai)", "value": "254fdda295c4f922af6d0f9ae7fb0656f46cc449d2498ccb7b5514e3372a004a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049050, "uuid": "130e6879-ed8c-459d-92d0-c1683d383eb8", "comment": "Malware payload (Mirai)", "value": "933b73ff2192cce3bb12b534d594dfe4d6bee384", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049050, "uuid": "7eca94c4-9476-48f8-bde5-3fe8a551c637", "comment": "Malware payload (Mirai)", "value": "311217d99d994bc75cf09ec312fafad81def7d4d23078488363067c8168621d26ecfd26125c24bf398056e1a45a2193a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049050, "uuid": "56ab6596-e797-4ee3-bc57-4331ebdd399f", "value": "T1A5331995B881CA17C6D0227BFA2E418D332663E8E2EF7203DD252F51778A81F0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049050, "uuid": "9cebe1ec-c4a4-4325-9c68-cf404abf5489", "value": "768:QdIW1696z4DM20MhpZHos1fzAw2FY0OUzEooPL7TcSPOt5SsgZ/NPDrb+j4O:HWo9tZZHFzp2FVOQy7TcaOt5sZFCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049050, "uuid": "588c702b-6b6b-4bf2-9def-8a42fa2788ae", "value": 54340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049050, "uuid": "aa1304c4-6024-42b0-accd-8db98b0866da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049050, "uuid": "230f58e8-e8fb-4825-be6c-0d84f199bce5", "value": "7d3bd8d5faa7bf9b2d4cf068903ea293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a96c79-29df-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662027692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027692, "uuid": "752adeef-db91-4993-9114-6a85e25b303a", "comment": "Malware payload (AgentTesla)", "value": "ac9448f38d9a9d8d18dfc7722992b840", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027692, "uuid": "2f092cf3-c78d-4658-a308-d0d788269bce", "comment": "Malware payload (AgentTesla)", "value": "2576aa1350bf0fcaeebbb7e095a7cd9acbe8f2d4e36a7ee49757aacab5100042", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027692, "uuid": "5dd42bb3-9687-4238-bb11-02253e3da6cc", "comment": "Malware payload (AgentTesla)", "value": "f743f33e3f1977d908a49b802a30a2ff946dc2d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027692, "uuid": "2eb351bf-7955-44f4-899d-650bff5c6263", "comment": "Malware payload (AgentTesla)", "value": "196c7f93e6481c28fae8e597c9bcd54e1f35fbb68d5eb5bf774a47a6662362421218ca3745ff49774da517825402512a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027692, "uuid": "34a63495-a1a1-4648-abd8-e7a15a067b34", "value": "T129047687E4ACD25CE9B50DF925B49357E9D87CD3280986EBF7987AE9D133912207C00E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027692, "uuid": "c082fdef-cf28-4d7c-99c3-3e7a064460be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027692, "uuid": "4006ec66-3ce5-481a-b287-e688d2725226", "value": "384:0U69OLlcaWI8Z+6QlHn9LTrvkkfkkyT4T5U0YnSj8SsA0quEKtuhzOVa4C:0RwMIM+6kOMU0YnSj8SsA0quEKtuheC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027692, "uuid": "f77e7e01-bee9-4d48-b6d7-0642df585a94", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027692, "uuid": "6439c6cb-acd3-4510-8698-c18de4b51958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027692, "uuid": "f523f232-b6ed-41cb-8678-4a7e0f658e80", "value": "V.21002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cbfb53-2997-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661996726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996726, "uuid": "771c7921-daf1-4ee6-8a89-2f1224f6ed48", "comment": "Malware payload (Smoke Loader)", "value": "c076b6a198e15edd8520b462a29196b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996726, "uuid": "e00fca77-62d5-43c3-82b9-fa9bfb2c3e3b", "comment": "Malware payload (Smoke Loader)", "value": "2587ccf8e9d0979bb25fc824ab10ec5dbf35677641b0f6c87043b0a500b8879c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996726, "uuid": "abe771a0-5852-41b5-a6a9-459b43ae3445", "comment": "Malware payload (Smoke Loader)", "value": "757860201c4761af0e6339fc3960eb66c7540b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996726, "uuid": "6d54c577-ee5e-405d-8ac9-f0b409166d8e", "comment": "Malware payload (Smoke Loader)", "value": "fbd54c456a47109db5a4f2f55700a3aee34be7a5271d02b66f135e83e26227f16277b08cbce7b6d3c1f95433a5d6efd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996726, "uuid": "1b92ff79-9f93-419c-b6b5-b54cdda75120", "value": "T1E654E112F283C072C44612B15425DBD06A7F983127211D9F377D26AE5FB16E15ABB33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996726, "uuid": "446f31cb-8885-4afc-af7b-8db238ec8c1c", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996726, "uuid": "55750d0a-3396-4c75-a778-714ec36d2619", "value": "3072:PXzheuiGJ9aL0N1rZPUc82X1rmKRWOyqP3tp1eEE1/w3PE2vuZ4lj:/iL0jFUYJft3PE1I/JuZ4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661996726, "uuid": "b762fb08-0fa5-491c-a379-c0796a4d5239", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661996726, "uuid": "d66b451f-55aa-43c1-9c8c-4994abcaeb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996726, "uuid": "17e68d41-9af4-4252-8f46-88291cf35b89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e469e310-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031146, "uuid": "f14603e2-783b-42f7-a2b2-ff8d021eddff", "comment": "Malware payload", "value": "7e3eb24b61b41eff5b96bd50167b0300", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031146, "uuid": "f93b92b6-fec5-4d0b-a53f-fa610bacb0c0", "comment": "Malware payload", "value": "25b310e13aa0ada7701b14018f7680b5ca76b7432a34723037985d247d9283f0", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031146, "uuid": "36153e37-ef8b-4dcd-9d83-59ec263ec8b3", "comment": "Malware payload", "value": "a927b04e20e1bebb9bfdafcebcb411403b7d354d", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031146, "uuid": "1ffac15e-a89a-4446-adc6-7b130d568cc3", "comment": "Malware payload", "value": "412f4324d037e8bdabc6dccd9a3e5a779ed6dda7fa57501bc33108885d404367a69bc457e7449e9b2807de3cf3f0adc4", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031146, "uuid": "c550635b-64da-4983-b61c-751d881c8490", "value": "T17E330136A01ABE4A07AE995DCB2F671A1DB177E7B2819758374014DC063F326C46F8F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031146, "uuid": "9f5fd11a-4f91-4d13-be9e-d162b460e143", "value": "1536:Y2jvw0Ys3YAHMBeyD+cX0eoJOZ7nocSkNF:Y2jJyhDbEeoQLqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031146, "uuid": "61fdcf2a-9844-4706-8fd3-14814eb3868a", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031146, "uuid": "0a788a03-225a-4360-949e-364a6bd6015b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031146, "uuid": "1e37b3dd-07c5-46b0-afe9-6e8eba1d0a4a", "value": "Lx1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26760c55-29ad-11ed-93bb-42010a9c0043", "comment": "Malware payload (Fabookie)", "timestamp": 1662005916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005916, "uuid": "d90be473-3c34-4cad-a0d8-3b064156284e", "comment": "Malware payload (Fabookie)", "value": "b9ed8bfe9274b15ba8e694c2b71fffae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005916, "uuid": "7416774b-02ea-4295-8a13-82fd38bb06ba", "comment": "Malware payload (Fabookie)", "value": "25f912e1d01c48648e6971eabd273e8138affd61c19d1163a852b7b6dd238eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005916, "uuid": "def8b544-b8ee-43d9-bf7e-4f622ed28447", "comment": "Malware payload (Fabookie)", "value": "9a6f2cb6d74719e11cda2d28960dc4ea102a091d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005916, "uuid": "72859389-1d50-4aca-84de-997e1e33d437", "comment": "Malware payload (Fabookie)", "value": "a30ceaa140f2e725cb307fac19ae00686f1408da377213f39bc188ab4f9990f1955873bcd86edb62b9902f8d34b87da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005916, "uuid": "29f24198-3a11-4dde-944e-ebbdaa23f2d2", "value": "T10B06127D5294339CC40E88785433FD85F1B6621F42E8D5BAB1EB76803FA7461EA42F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005916, "uuid": "4962bfd3-363d-43cc-9dc1-341dbec6f76a", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005916, "uuid": "9eb756e8-bfe6-46b9-825f-e992c36ee8b0", "value": "98304:Gqb86eR0REB/iPaSyN0swMas7TWGYQSxN2F4B2M99+:Zo6eR0yB/uKNeMas7TWGLW7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662005916, "uuid": "e6a165e5-e387-4b68-82e3-82f831aa587b", "value": 3945472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662005916, "uuid": "6b0dd92e-ffe0-4425-bc49-2a600f740df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005916, "uuid": "393a0ffa-bc06-4729-955f-e545c353e9eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651a0909-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662043388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043388, "uuid": "62034859-6858-4022-8bbd-8a8e43eaca43", "comment": "Malware payload (SnakeKeylogger)", "value": "28b48fd787808f1e27f6e92a2103e661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043388, "uuid": "ed49ee36-225d-4cfa-8c12-7bc0f483e9c1", "comment": "Malware payload (SnakeKeylogger)", "value": "272e30bec2d6651fff5646201a01c34d794f58f492e9e2da88cf56a8be2202b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043388, "uuid": "cfa7b0ff-fba6-474b-8e56-395b0454afe4", "comment": "Malware payload (SnakeKeylogger)", "value": "a001179c19e6f478b2b6c2fcb03d669bad66f7f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043388, "uuid": "6e0234c6-c4c4-42ee-a453-b73726b013de", "comment": "Malware payload (SnakeKeylogger)", "value": "4b46a03559162c1c2961dc43d9860db9a912d9b8d1b38b5f731371b9bb6ed1d50b85d9677990e363876e7ed11d0bddde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043388, "uuid": "9c225f9a-e7b3-4a07-ac6e-6fbc94bfa32f", "value": "T19445F14739448A98DE6825F26222C14063F9DCBFC524D7099FD833A26EF9B979C1271F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043388, "uuid": "140cf4a5-1eed-467d-9a5c-8026483deeba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043388, "uuid": "5173b9cd-5a6a-4214-b720-c23a4f30ea75", "value": "24576:QErfZ5Rx8EfjTUc6T2J4HRxr17Df/qN1eO8VobXY+mzo3bv26nnjqKoe:B5R2Elx4HR9Ff/MrlmzMDjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043388, "uuid": "2ccaccba-d153-42f1-bd99-27da68488cbf", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043388, "uuid": "8e2f1cfe-3064-4b14-bd1f-f7ee00cd696a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043388, "uuid": "8b8e6883-7aef-4d7c-8ca1-76125d273056", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a2af40-29ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662033931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033931, "uuid": "b156d026-c9e8-40d3-9e18-d3ced34d8a6d", "comment": "Malware payload", "value": "ebbf79e49681b456fd89aa5a044de2f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033931, "uuid": "d65d9c92-5e77-4b2a-9f06-00a70e591169", "comment": "Malware payload", "value": "27abbbbdda20873f7808c199134cbe234e57593c0f04a4d9466c44891328a71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033931, "uuid": "3aa2fe41-3be8-4b18-a16c-76f14206fc36", "comment": "Malware payload", "value": "4efd5b5e0597b27468a2a598045283330d65d73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033931, "uuid": "4ee2cf50-ac36-4dc2-a478-081e017b261e", "comment": "Malware payload", "value": "1480fa41a92b0ebae40feb6af3ab24b8e07151665ddc32f1babcb23c65909122c6d6ef518af2bc5fa691c14c8633cafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033931, "uuid": "1d93bd88-dd31-4f57-926f-8df7de2506ec", "value": "T1532633841F4189A3D89644703047AAB73ED1CC71A360BEF3ABCE255D7C613A2FDA4999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033931, "uuid": "152d2af6-b499-4900-ba09-1eea2c17c2aa", "value": "efa5f35372e4d62ace30c793506bd914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033931, "uuid": "6aad3ce5-1292-4737-9bd3-b220245c9f0d", "value": "49152:9Ud8g4X/jCb21UhH35rTHhrnwtGVyaB3C1CvEqm+eYIDNVU16j/dbr4imHHXNv/k:ed8/XrU21ArTJnXVyoIqcYAK4MicHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662033931, "uuid": "98a96b60-801b-4473-a85b-ab211e9ca862", "value": 4445208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662033931, "uuid": "d3abc0e4-1512-4a35-9c69-18ff7a6dfbf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033931, "uuid": "eaba16fe-4c43-4539-b4bc-cf1bee1e6c24", "value": "27abbbbdda20873f7808c199134cbe234e57593c0f04a4d9466c44891328a71a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d3a871-29d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662025130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025130, "uuid": "46dd9e5a-ed27-4cb2-be1d-3a582e4c4fcb", "comment": "Malware payload (ErbiumStealer)", "value": "43702c879cac78706825df0829620844", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025130, "uuid": "6009a056-c75e-4209-a077-f19d5e7f8c05", "comment": "Malware payload (ErbiumStealer)", "value": "27dbca88a1b01b220ca881a2636f539a1dd5048d1e5e2948e10185ca96edb36d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025130, "uuid": "a0d8dd88-0c3e-4d9e-a8be-618135331b83", "comment": "Malware payload (ErbiumStealer)", "value": "8ebcc633efc501cfadab2829b388b89be09d11e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025130, "uuid": "a12d51c4-6db9-4216-8d3c-08d4f80b1d55", "comment": "Malware payload (ErbiumStealer)", "value": "dcba1d8964331cb588d2df565990578ccc8259c2b7b5dea9aa4b0321e98d1e7cd18e26778eb0c328aa39a35b46150b85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025130, "uuid": "54400e94-c0f0-4b8c-9bc5-a71a78a04d33", "value": "T154D57D21E652A070CEC525B1D13EAFF3AC389A241BB890F797E41C6D65356D1233FB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025130, "uuid": "51a9c382-c49f-442a-9cc2-ecf894a2604d", "value": "fce537f90e196225b462ce4019d18db4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025130, "uuid": "9aba9577-8151-4044-b3d7-f64c9935a3f0", "value": "49152:CdHpOUrhUM5WgRdr0ylBqtXG6IY541EsU:Cd48UMvpn0G6IY541E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025130, "uuid": "4b3fad17-8450-4cb1-a370-4b86ab56211f", "value": 2830336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025130, "uuid": "31058d13-fccc-47db-b7a2-607fd2255e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025130, "uuid": "1dbd6033-93e7-4c23-a827-72a12de916c6", "value": "43702c879cac78706825df0829620844.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf2946e-29b2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662008422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008422, "uuid": "56739462-1ccc-4e8a-8b43-b91e843a4f16", "comment": "Malware payload (Smoke Loader)", "value": "65f9ca701e89a439752e54d719b6a70c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008422, "uuid": "63ab8a66-06aa-45eb-b1a4-e0875939008a", "comment": "Malware payload (Smoke Loader)", "value": "28f232a886a47d4df43459daff17752a3650b6b5c2d17f51098aa96e9e054bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008422, "uuid": "331d6587-003e-4043-ad68-e92945f91c83", "comment": "Malware payload (Smoke Loader)", "value": "90a4893a7a8fc899834e0a8e7fad411f8038187a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008422, "uuid": "518fdb56-0991-46fc-bc2c-e632c0e32881", "comment": "Malware payload (Smoke Loader)", "value": "2e07ee9fe5fc537ab7f9b8ce35258747989830fa8096c9a0a080c11c19ca97008cb477f1c1fcbab63d4a56976aa58a3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008422, "uuid": "936a8103-bbfc-495d-84eb-9bcc7b8cddd1", "value": "T16054E126B693F472C45115709860CFD5B6FFA830227049873B69277EAFB02F195BA34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008422, "uuid": "5589327e-1dee-42b4-9e46-8d23067f210a", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008422, "uuid": "553e2f5c-b122-4218-995c-656a06a0bfb6", "value": "3072:5cXkaG/Loq8LD7cdr2og6Cnyic1sA0eEyt9OWpGhrT6YtdgACVu2A:O7LHcv6DvXe79OWpGZtCRVXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662008422, "uuid": "339ea8db-4640-425a-94be-684a6e3cd377", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662008422, "uuid": "664c36ab-397b-4e6f-8f78-cdeb3a41d8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008422, "uuid": "fda83705-3dc2-40a9-9de9-be2c81544499", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52407c91-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032189, "uuid": "e49bcc3d-2fd9-4aa5-9801-82501cfc069e", "comment": "Malware payload (Mirai)", "value": "d52449cdb7bd454b1173c295a4d1f13d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032189, "uuid": "657d2e8f-d424-4706-9961-88699fbfa24b", "comment": "Malware payload (Mirai)", "value": "29af51122425d519af5b2999f98519e64177fca911ae88d2712e2fb48bf837a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032189, "uuid": "2a129ce9-2f05-4e17-b880-306277a2b531", "comment": "Malware payload (Mirai)", "value": "fc7bc09102fd8b5bf693ec3bfdfb5fa1aa8e1c43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032189, "uuid": "a2fbb330-ae24-4411-8579-403ea2e8cdd3", "comment": "Malware payload (Mirai)", "value": "b077d987794ae9e21f2c224779ce381dde47f2c0072bae773805c965334521be6f2e713c1d7e381f684db8f4841f617c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032189, "uuid": "e79a91f2-9496-4fa4-aae7-8e6c01326694", "value": "T1FC337C3DF41AAED4C49A4274A96C8F351F23A1C183125EB72B9185B14483EACF909FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032189, "uuid": "ae3be388-87f7-4db6-a420-52553da78ab8", "value": "768:na9PAUpYOebGeybmqehKwtjNg5iDwcUr0Z5PfmM7/qfCCoCo77v+0C3:na9TpfqGFZNwtjc4+M7/qfWCaHC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032189, "uuid": "4224919e-cbee-4cbd-b6db-00d153b0dc73", "value": 50164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032189, "uuid": "11115954-123a-4840-a7b5-38f7e4cb5d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032189, "uuid": "e573284b-8704-455a-99c3-393128752dc9", "value": "d52449cdb7bd454b1173c295a4d1f13d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633e3333-29db-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662025775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025775, "uuid": "f92e0a8e-1e04-4461-90cd-2b8e71bec491", "comment": "Malware payload (Formbook)", "value": "b4e29c5d12d69fb6226cb2c0cdeec7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025775, "uuid": "cbc57ada-e52d-4f6d-a5d7-0152506e5ccf", "comment": "Malware payload (Formbook)", "value": "2a8df78b05fd8f497ed976ca4db985249c2c6b250850619168d5ee56b4c3d4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025775, "uuid": "3451ad26-4910-45bb-baa4-e8f3c8c2fb38", "comment": "Malware payload (Formbook)", "value": "4808eac4750c95cb70cd8b7a602dbb93af7cb75d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025775, "uuid": "255fb4ed-693d-4bd0-86d9-e0ee02a9051d", "comment": "Malware payload (Formbook)", "value": "a5564d3712845c4178f4f6c804703cca37c4d5c948c6e31214b9e522aef35a20492da2a506e89aec0f59398eecc4c7ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025775, "uuid": "3c52155e-8386-43e3-909e-d537369b8486", "value": "T18A05F17833B2B59EDC63C17488A89E94A2D03A77DB1B9207F493215DE95CAC79F050E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025775, "uuid": "6ab74487-630a-4aa1-854d-d288211a3576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025775, "uuid": "af2e49a8-b618-47d0-baf2-67067df56ae1", "value": "12288:EGSMTYgYr+sw5prqixFC+UuF19roDLnRnFi+gJJX6nI9EHslgDaG7ufjdBIDD1R:CgYr8lFsuF19650+0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025775, "uuid": "22ba7acc-98ff-44a2-baef-dbbaf00104d7", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025775, "uuid": "9370bf8c-0fc9-42c9-bc31-ea107d93cb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025775, "uuid": "467324d1-60e7-4cfd-9dd8-1b82a6627841", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbd558a-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662006845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006845, "uuid": "dcb6622e-7f24-4f36-8f9e-720d8f7b5e40", "comment": "Malware payload (SnakeKeylogger)", "value": "09b42cbfaf53fd80494bf79ccefd529e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006845, "uuid": "2e422182-b50a-4b61-b9e0-9cda4e3d2f26", "comment": "Malware payload (SnakeKeylogger)", "value": "2ad5716b765ac9248180db741dd3e09a08196c1b509c1edf36880ca103632201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006845, "uuid": "d69f3488-54cc-40e6-8189-4407420a05c1", "comment": "Malware payload (SnakeKeylogger)", "value": "9031679e2a6f4e0593624363535b5e0d6e610d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006845, "uuid": "cd3fdaf4-f53c-4c1c-a5b4-d90e5d9f4f13", "comment": "Malware payload (SnakeKeylogger)", "value": "35bd2b1a98c2c1a1219da2a3775830c31a9666e75d58766e8ab4a2276c5afa7db3701977d291fd9ab8376d660e27a7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006845, "uuid": "88528c59-6412-4022-8584-92bc0f49e7a1", "value": "T158051BE43350B09EE427F139A4765CB9A6E1B42EDE0A610F6013798DEE4C6D7CB1D4A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006845, "uuid": "f60bef52-082d-420b-a276-3cc4d0d73a17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006845, "uuid": "93ae9a07-2732-4351-8a7c-df6763264cce", "value": "12288:oYHqhtXpkKlnHWYsPZPjI/VqGrwSGWiyzMLjxCiEumB3mDI50i3PRuy05rINaFlr:7KnZkKlHePZgqGUPeQ4DwPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006845, "uuid": "30b8507a-4aaf-4952-a76b-31018fc8db08", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006845, "uuid": "50fe27a3-cd28-4ef6-862a-64d6a31906b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006845, "uuid": "36c1a70f-4964-4b6f-a140-5a4cd9be435b", "value": "6P8vNX8dh75zpkI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83a2484-2a1d-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662054372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054372, "uuid": "f8e6a2dc-ae8d-4f5e-90df-dc59bd73e535", "comment": "Malware payload (AgentTesla)", "value": "166873fe48e8c083695524354df0e781", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054372, "uuid": "5e03de34-39e3-465b-8a29-7875fb2c8a0c", "comment": "Malware payload (AgentTesla)", "value": "2bcaa01ac11ab5373acf66fb0eef608284c4a342730af3852db934afc31c38ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054372, "uuid": "468abc88-7dd7-4df3-a10f-243117a15f10", "comment": "Malware payload (AgentTesla)", "value": "3767ef75c8b20bd3ad7ea9cab015f8b4c0025042", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054372, "uuid": "64af7875-9184-4f2a-adbf-dab2971216f6", "comment": "Malware payload (AgentTesla)", "value": "5de1ee8a9bf1af145d8bd69cb61ffb7181465657631ba6d6c14ae85b7471a6c393e9b7a9acd18bf8e8e100affa4b4caa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054372, "uuid": "a1b57256-496b-4932-b5c7-93fca16dd409", "value": "T17815224FC1849B12F4AC0B7962F0F71243BA3F1991F2E6D84DD9E2F524E979A5217A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054372, "uuid": "fa4158b1-307d-48bb-9a7c-379a0c32c3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054372, "uuid": "2ff8c13e-2f04-485d-8148-0284ee408836", "value": "12288:6/F75eHgPwqoXY+mzoRtbvRT73FPtS2Wsh4UO1laCDPS82pgMdkeYtcQyRP:YZ5SXY+mzo3bvzlSF957aCjSOakGQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054372, "uuid": "089df97d-011a-473b-bb42-f237f43175bc", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054372, "uuid": "b522bfcd-53e8-4ce0-af12-4dfa9c260a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054372, "uuid": "b5487690-52fb-4e5e-bbe3-119d816d8d10", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a36c9bf-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662018405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018405, "uuid": "9c38af35-86d7-4d02-84be-66dfd36ef5d2", "comment": "Malware payload (AgentTesla)", "value": "c8d304972778d37af0181c621d8a2b58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018405, "uuid": "54948e4a-e954-40bf-9d60-84817c62326d", "comment": "Malware payload (AgentTesla)", "value": "2e8079a1464cb39ace44c42b95f3c3b7324eb0aec5bc337488cb6fce7743e1fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018405, "uuid": "acd0e083-b43f-4ed2-ae7a-c7d62836b1c5", "comment": "Malware payload (AgentTesla)", "value": "965b77228876732d2e759249b1689cc1bb9a6157", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018405, "uuid": "4989f80b-434b-4588-a354-61cd28201995", "comment": "Malware payload (AgentTesla)", "value": "4377009f7f44dba874a89af1838b4ed9140c9a2d1fa755087acece9122bbaad6b094a0ab148b222ef3532560d375dab0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018405, "uuid": "7c221e1e-9e4f-467f-9b14-d0f0bc042115", "value": "T1059140412BC0FCC403936AFBDA3FB296C45192AF7E65AC5F8500FCA49E41516CD86738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018405, "uuid": "3e8cc581-bbf6-4419-b52f-c16cacc4954b", "value": "96:caN1GtgVrLIEgdLajSZ0v42GpfUa3VmAkl0hnxrwWeB8QCbIctC:caDGtgpJgwjvGpfUa3Xkl0Hkt8zbICC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018405, "uuid": "f3bbc9c6-048f-4cfa-bbbe-e451c164ec91", "value": 4600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018405, "uuid": "5365eaae-656f-4c89-b85c-4a3ba96ec209", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018405, "uuid": "43fcfba3-8438-453c-905f-81631932f7ad", "value": "TNT INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24195762-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662006772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006772, "uuid": "ccdd2d81-94bf-40bf-93ea-efb5e0698a19", "comment": "Malware payload", "value": "dad4287939ce0c581c107ee4a6be7116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006772, "uuid": "8c1bb4f5-41a5-4cb2-8276-1dd135e8f4ee", "comment": "Malware payload", "value": "2e874de96db0423c319ce1532520fe0d151eefcec51e8cc823695363dddbbd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006772, "uuid": "f3d90ca8-0122-4b12-995f-c21bde5f08d4", "comment": "Malware payload", "value": "55dbacae6ff3a4ce3f26723d3f1b8edf2f98e7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006772, "uuid": "75b4c0c9-5f47-4092-8f71-e7606e0fea60", "comment": "Malware payload", "value": "7b2e755b1f18df3b083b008e907bd21592c6c836f8a156b53f48194731139a663f1bcb663c1a42ee3420f5bed4db206f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006772, "uuid": "40cbe72a-8d71-4bc5-bc85-f997b7478fd2", "value": "T1C025CE94E74C9357E0278BB91161B1800E792C90FBF7DACEEB8EF569067EB815123523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006772, "uuid": "09025338-aa38-4aa7-98d2-83a8d945463c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006772, "uuid": "d59b44ab-2a6e-47cd-b645-45be792a34e3", "value": "12288:JF75elgPwqoXY+mzoRtbvRT7EUgpBpSJqua4WlmGxow7zODWqoOun:JZ5mXY+mzo3bv5gpOIdx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006772, "uuid": "43d575ae-0c25-43df-896f-be5435d79179", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006772, "uuid": "12d61da8-aac1-45fc-b20e-c2670aa771d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006772, "uuid": "7f7ef3a4-6a53-48ee-b42d-8a42a3062c56", "value": "SecuriteInfo.com.W32.AIDetectNet.01.8029.30339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec5fa52-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1661999434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999434, "uuid": "9991d766-955e-41b3-8321-caae6ea78fac", "comment": "Malware payload (RemcosRAT)", "value": "4a19760f18e686921fda77a9ce984ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999434, "uuid": "e8639b1e-99ec-465c-8748-4555bb04d78d", "comment": "Malware payload (RemcosRAT)", "value": "2f42c0e9bc0822908c8efee840a2da430abfb5a3dfe3364d782f876fc150a748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999434, "uuid": "cdd178e8-178a-4ada-837c-12647132941f", "comment": "Malware payload (RemcosRAT)", "value": "8f26a5c3c80cc76d6ff2e76089c8a69cf058367a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999434, "uuid": "338e7626-23da-4fde-b3d3-85d2db6f9867", "comment": "Malware payload (RemcosRAT)", "value": "19c33e272a1fe8c4b7757f624ed4260b7e4834090525a19487b0a8e0c1043ec4991786ed9bbdb6f94eb0d458891bd639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999434, "uuid": "3e9e12bf-94d3-4ba3-b4ef-a422de681d81", "value": "T1794513499648C3B6F8271B7011F1F51981B97E2591B2C6D8AFCFF2EC09B8B429617F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999434, "uuid": "724c72f7-0ff3-4c85-bf4f-13815aff81d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999434, "uuid": "304ba72c-c3b7-4d3e-9757-667ebb6362f2", "value": "24576:ZZ5EwSyOb1kJ/ZHp4HcG6yXoFsjlwL+OuHbBU+XY+mzo3bv:D5Ew3OuRZ+H/omjlU+3HbiYlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999434, "uuid": "fced9fec-a838-4ce5-b6e7-067867e07108", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999434, "uuid": "2a113b65-dae5-42b1-b758-98f23cd37bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999434, "uuid": "d0e56e19-3e09-4a22-ba1d-f40446b50ad1", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29162.15214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f0f85b-29ae-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662006390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006390, "uuid": "ffb72eaf-c1ca-4b86-86a4-11cfd39c3b08", "comment": "Malware payload (Smoke Loader)", "value": "637f65daa222abe25b402ef3f07bc071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006390, "uuid": "f827e00a-58a3-4129-9b76-8dc397095fbd", "comment": "Malware payload (Smoke Loader)", "value": "32847dc942372768afd72ce092d9c7e6e68cdf5c09e7865c9e2a1800e6ee7fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006390, "uuid": "8d59a64c-fc74-4050-b4ee-be03b4615c37", "comment": "Malware payload (Smoke Loader)", "value": "fbb1a2710ebccc9258a58f42d245a96806fa7b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006390, "uuid": "2b3d1b98-bf3e-4ee3-855e-5ce41df42ea5", "comment": "Malware payload (Smoke Loader)", "value": "dd99a36d068be33e2e2dcd1c036c76bf925040447dfe025ace3f09edb3ee1a20bc01c37896340b6a38256ee30c0bf2d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006390, "uuid": "93256239-d800-4c45-a131-5a8a672563ce", "value": "T19654D0227992C472C45651729460FBE01EBFD4311773C59B3BBC2E6E6FB02E24A7634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006390, "uuid": "eb6dbb2c-e1e8-4173-bc3c-c89adda9383b", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006390, "uuid": "9d25f543-aeba-4e28-bdd2-71618befb8bc", "value": "3072:dhXDy9lrOGbUcLM+unr2o2H4vmYBmpZmhvBz789QoOi+Wgn6:XuHLbu0Kbmwvs/z+Wgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006390, "uuid": "21ce73b7-748f-4fcc-a81d-72680b703371", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006390, "uuid": "768a8375-d7b8-4b9d-bae2-586c8e6084fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006390, "uuid": "a5aff663-7241-472d-b733-37515662ec25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b67f9f3-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1662030030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030030, "uuid": "b43f84f2-a6b5-4c21-8dda-f66c7db8fade", "comment": "Malware payload (BumbleBee)", "value": "14da4c2df839237771865372ce4eee25", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030030, "uuid": "976b8a6e-adc2-41ba-aac9-5891cbf3d1e4", "comment": "Malware payload (BumbleBee)", "value": "32d3c8a61ba7a61d1f7466a4a60f7b52bb9bb0e6d000418da5cce79831f55a8c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030030, "uuid": "a01d1d92-9648-4191-a0df-6ec4ce41b541", "comment": "Malware payload (BumbleBee)", "value": "5b0c15e551f989d1702478a50da3fac5bd3dff87", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030030, "uuid": "a8fca661-d909-45d5-8fc7-f84e6ade44e6", "comment": "Malware payload (BumbleBee)", "value": "8cc2383373d96950d1df8f09696493c556d49af8470b7457ddc396ce9874e4ab421fa51fb01de9b205b1d5b44a9c7ab7", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030030, "uuid": "7821a71a-3dd1-4a65-b9f2-410a32fe527f", "value": "T13B85D0831CE88288DC2598FC6FF1F173857F6250CAFD2A50A5225D6E59E5D23B23B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030030, "uuid": "64849b30-48f6-4fc1-bc61-acebc187ab3e", "value": "870d5612f32c9405cb8b46c8aa36cb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030030, "uuid": "961f7f44-3da1-439f-abb7-a8a8c6ffdbfb", "value": "49152:7mWxtD5wWHxLrApxq7pMKEngsfyJllGVeTQKP7:7vxtD66xLrsxIpMKEngsfyJllGVeTQKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030030, "uuid": "780f5310-c219-429c-a493-38705c2e98ff", "value": 1820672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030030, "uuid": "b07f212c-6f99-4895-9ea1-456b2f8b637b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030030, "uuid": "0ea805ac-4596-476e-a19f-e8eec942103e", "value": "GfsFepFIKsNGpt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a730d7-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030989, "uuid": "4d47c62a-56f6-4a2a-943c-a638f82738e7", "comment": "Malware payload", "value": "1b429f16774ced913937cd3d4b9dcbcf", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030989, "uuid": "93663f74-d035-432b-90f6-79a7a3bade7b", "comment": "Malware payload", "value": "3320c60b08b66353be89f6fa1d8ebad010653ca198e3e2a8d3cf806f77ad3be2", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030989, "uuid": "066b7ef0-beac-479b-b89b-834d735f8728", "comment": "Malware payload", "value": "68d73b8842a63d613a4f526550177332a3fa12aa", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030989, "uuid": "a210788c-dcff-4959-9989-692f1d98bda1", "comment": "Malware payload", "value": "d1e8a9c6ac6abce698d8af94eeb02da6ee74a3f1ce40e1250b050f86c5a9a8c9634c9251a0cb869763e6168ff863a29b", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030989, "uuid": "cf51778c-7b1e-4288-bbf2-6cef28f6a39b", "value": "T1E6D219731D42BDE81F3A1D42E24675810D8E3E6787789DA8FBC4099625A8712DF6E83C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030989, "uuid": "12d0a63a-74c2-43ae-b4cc-029e53ee947e", "value": "768:pwOH6DaJeepaWdPp4Xu6Erxxq/3RBv4HMhD:ywreeptPTnrQRBvpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030989, "uuid": "b8526708-d077-428a-a468-6ff9aa56e8e0", "value": 30040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030989, "uuid": "eae5f211-68fe-404c-a314-191bbce2bee2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030989, "uuid": "834f7e3c-775e-4298-8685-4e772532b929", "value": "dllf3txt.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b2be61-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031167, "uuid": "86030092-ff25-49c7-ae05-04d1c6811285", "comment": "Malware payload", "value": "5c2f1d3b6dd06c8091fafa9671b8e538", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031167, "uuid": "58e5ba81-8e1d-479a-883b-a758a12817a5", "comment": "Malware payload", "value": "33ddf98a264671932d5698e8d1780f8ebf8c81877f763f910aaa08646f7f71e3", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031167, "uuid": "b0b148c0-cae4-4d37-b9ba-17acff0646cf", "comment": "Malware payload", "value": "c0ca874cb455bca04db02824867d13d8c0b86d85", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031167, "uuid": "16561eb7-63ce-4dc3-bc58-d715a527ba0f", "comment": "Malware payload", "value": "85cbad45a65301405c94c033e31f156e3f2d10ab0822cc588ae5684c245d79cd0db5e1c847f959b9e2b7411e7269a662", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031167, "uuid": "c175042b-8618-4572-be05-3103e9ea8926", "value": "T1B6533CF656136D8F46270E59E40C1300ECDD98B7F3D995E9FF464AE689998188CB0CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031167, "uuid": "2a838ba8-1333-4677-820f-f4781ba6e468", "value": "1536:PWAwHd6hWC/F7tw0Pi0SF7OJokslebAfun6sQeuKUEhsE3cAwYRqRrC:+HdRCdO0PiZZ+oBebAfpKUEhHc2oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031167, "uuid": "b8ff1a9f-b8c9-4ce6-a41d-150dbf0fa748", "value": 64856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031167, "uuid": "3e57440d-22f3-420c-8dd8-4a8ec696484a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031167, "uuid": "f8b17f90-9416-4007-910b-e47f9581b050", "value": "A1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7795859-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030185, "uuid": "5a3ca147-0190-41b3-b815-ef45f0e19e5f", "comment": "Malware payload", "value": "6cdd8f7311975edcfd51e3a08e28390a", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030185, "uuid": "d8b3a597-8e39-49e4-bd26-bc8b8fd82e79", "comment": "Malware payload", "value": "3402afd799f0fffb4704b5d3f6223086d2d2e23914107f44d21891eea65c0e0b", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030185, "uuid": "8733c72c-a82d-4b41-9660-76e197f4142b", "comment": "Malware payload", "value": "1345d70efb47de3f815cef53565756f6453c4f92", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030185, "uuid": "90737ea1-c972-4ce6-a29b-a2468220a5d1", "comment": "Malware payload", "value": "c6c4301c24ad7a2170515bf92ca3f482b0dc6ee3cbefdaaecd23281b0e529bbcc1112f873f9992ee23c2e1866984f5f9", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030185, "uuid": "879d747f-2636-4589-a1c4-0f548083aaf7", "value": "T16141AF047ADA5B21D3B28D371C7AE61919B17D11FF63C75D07D092D82528644F93AF23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030185, "uuid": "a147c223-04fc-437e-864b-9d1cefb1adef", "value": "24:8SAImJp3n2yUwK+/pKq8o0B2ARjVuWAbMlJx0q3kR+/ftz7Z8GT4I02:8R3sroJUjjA4Ji6IwxZlMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030185, "uuid": "3b1beb14-bf15-4ab0-9f97-f0577df64a26", "value": 1880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030185, "uuid": "449a22bc-2028-44f3-8f7e-9e9813063ce0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030185, "uuid": "ecc83566-5f55-48bc-b889-e2d1788fc49f", "value": "Password txt lnk4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2eb7d9-29df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662027674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027674, "uuid": "95313682-23f3-47e8-b975-6a865294f26c", "comment": "Malware payload (Formbook)", "value": "c0f6c9ad0c33566bea79527a0ed03dae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027674, "uuid": "255589c2-bb34-4d1a-b920-32b7969515bf", "comment": "Malware payload (Formbook)", "value": "3430617a5eee23a3a14e2537900d5e66bae0ceb76f0b3520316727af0f9c7e8c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027674, "uuid": "8e7bd50d-c274-4df1-827b-d15ceff5b581", "comment": "Malware payload (Formbook)", "value": "1abc9627d817ceb19d57d08d920771dc2451a83f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027674, "uuid": "44a5868e-1099-40f9-a10b-180d729ff3af", "comment": "Malware payload (Formbook)", "value": "f5927483386a5268e5223ed6695c1d22af3414d58bf948818e34e9a73bfe50e4f1f31df813ad6b65e2479b78cba01b3f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027674, "uuid": "f2c196b1-f5b4-4da3-a63e-77594731e7b7", "value": "T15CC302D4BA649C14E6D28FBC4B671410CE532CB7DB373F05782A3A1E6A3833764A152D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027674, "uuid": "26cfc6e7-c852-4b63-9ef5-9a31b6822cb1", "value": "3072:nTm5efl0vBzf4+GWFaZcOQlYjIlNCZLOyAYnEuCYW:qm2dFagYj0knEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027674, "uuid": "efc77c32-3057-48e7-bb58-5c99e6af71a2", "value": 118824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027674, "uuid": "b23a3b33-b2f0-4d83-b18f-2c81b8844840", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027674, "uuid": "6d52c355-468c-4795-bc5e-d4eb849b00a6", "value": "PO-22-3194.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffdfc01-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030924, "uuid": "f6d09800-4792-479e-9de2-05e2c48aa1ec", "comment": "Malware payload", "value": "3d935e657ed2b35cf4a7bea39653d6e3", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030924, "uuid": "0bed9195-5509-4e32-9ac2-21b3b8bcdad3", "comment": "Malware payload", "value": "343a01aea6de710765af57680925afa9bb6d720b78484a07b2fb65844b8ff21c", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030924, "uuid": "864de2af-ccaf-4a69-a49f-51421d29a2ff", "comment": "Malware payload", "value": "220c22f3100f71f976ac4a144e6d778d250a8fec", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030924, "uuid": "a294d284-98f6-4fcf-bd53-c18009b98513", "comment": "Malware payload", "value": "41ad973ae9bc090b3dd6daf08921d3770a1a943e2ff98a6680fa1df9211656152df10eb7a1ce8270a6700d39b8a666b3", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030924, "uuid": "98fb33d3-b177-4d2d-9bf4-69ea072d9bb1", "value": "T15C8451D72DE4CD7D400583E3CAE2D0D862ABA0751B8BCE7B56BA11F4C609DAC2FD6158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030924, "uuid": "29376f70-44c6-4ab8-be75-6841c4492c51", "value": "6144:izATDR9oh1n81/eYV0VFEGlle3dYAHFUYj5oa/RMcq8DCh8fgfj:CAfR9o/n81/eYV0VFEGlle3Aa/RMcqeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030924, "uuid": "3a69d65a-875d-47f8-abf0-78e1b01bfd51", "value": 391256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030924, "uuid": "cc3e3a20-c14f-48bc-bce3-10396091fc29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030924, "uuid": "2c1c3173-2320-427f-b907-105cf42b63d5", "value": "clase3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e79786-29c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662014123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014123, "uuid": "83d04bdc-3473-48b1-874b-dbbca902c8ec", "comment": "Malware payload (SnakeKeylogger)", "value": "e95b44f1f00637d521dfe2ffcd2951f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014123, "uuid": "a9ac728b-1265-4add-a81e-be9df49f4949", "comment": "Malware payload (SnakeKeylogger)", "value": "350c6c70aa15c43da19ee0cb68f7bb945520503b59b09dfb310feb4300513a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014123, "uuid": "631aea0f-5d83-478f-a07f-6ac52c3960b1", "comment": "Malware payload (SnakeKeylogger)", "value": "38bc1ebb095d0060eb04e92d7d41880c0a5692cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014123, "uuid": "e7004c0d-8469-435d-b4c6-22a50197646f", "comment": "Malware payload (SnakeKeylogger)", "value": "554d26f0e6e97cede5b755877279068e872bccb7806fb43780934d7c048da2cfad4d56253317b402e82b59d4dc6be9f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014123, "uuid": "673a7553-7c18-4443-a59e-b979184823f4", "value": "T12B156ECDB150889AEC6B05F1EC6A553014A3BE9C74A4C14D559BBB172AF336E209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014123, "uuid": "42327826-7883-4bf6-af06-3691b88040c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014123, "uuid": "0a1a6d55-b3c1-4cdd-9b28-59494887d27f", "value": "12288:pl1z7jwQcXwCbw1po5xpd06iu/UrWttekLhXELBKftotnm:fxw//YyN/vvtt9L2Ift0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014123, "uuid": "6673011e-ff0a-4a8a-9af2-406deba1b35a", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014123, "uuid": "27a1e4b3-5636-40e9-9a2b-2addd6fb6f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014123, "uuid": "7c13d74d-1e13-423d-8f05-bec691c63889", "value": "PO_290054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe044296-2a4d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662074998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074998, "uuid": "c687a7ca-a5ac-4f3a-9721-fe6e553f2f90", "comment": "Malware payload", "value": "8c9544cd97d9411c5ed39374739bdee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074998, "uuid": "b86d0cf5-1601-4323-be8a-d9fa11db7268", "comment": "Malware payload", "value": "352ea19a9fafe511f35b50f77f48a67262be61f5f97b28637874ebd118ff25b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074998, "uuid": "c5a21965-7e74-44d6-8976-b7e8c4e554e2", "comment": "Malware payload", "value": "7217fb17e333e2b587dc94a334b0b5175e8d430b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074998, "uuid": "35ad4592-9bdf-487c-9ba1-39c84fcd569d", "comment": "Malware payload", "value": "282e095a11e7d9e9ab27d206a80bb04ed006854887691d7a3427f4296943fe8c652c975bd8c103789f82787e9529006c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074998, "uuid": "a8d4b051-7386-4a15-b1d5-3b441b8ca0fb", "value": "T121648D00BB90D035F5B612F8467A8378B93D7EA1AB6550CF62D42AEE57346E0EC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074998, "uuid": "c9579954-0d17-4c76-94f9-11086bad8eae", "value": "e83a01fe2b7feb7901ae7dc6f1953768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074998, "uuid": "2dd7ee24-a27d-49f3-980c-d9f107f6ad8e", "value": "6144:HSF95BjpCPh66d815p2VVOd9IzitSQDX4/m0az2yExax0mE328D:U9sPh6m8PcVVOd9IzsXem04EsWKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662074998, "uuid": "f3786cd0-7636-4573-b11e-ada4ee145cab", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662074998, "uuid": "2e3e7e82-8eae-4681-8d6c-6787e55532bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074998, "uuid": "41f66629-d65a-4220-80e2-a2de88f95ba6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2613998b-2a1f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662054878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054878, "uuid": "032ed2d6-b5bc-4183-94ae-d16cfbe6fa16", "comment": "Malware payload (Formbook)", "value": "11e5919e2e2247f894febff407ed5d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054878, "uuid": "144c2975-79c0-4108-876e-a48c9d56ddc7", "comment": "Malware payload (Formbook)", "value": "356bb90d01b865c7c559e2d7494013918d41169a742c0ee39084fcfd1f9c273b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054878, "uuid": "3a6db002-474c-4e01-b301-cdce4cca02b1", "comment": "Malware payload (Formbook)", "value": "3a76bc08975da0f8bd16e8eb493e5e76e2af1c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054878, "uuid": "8d2af1e4-2f9f-4fbc-812d-c70577f67c37", "comment": "Malware payload (Formbook)", "value": "4066e2c0a7c54044f7adba09c601ef1a8fc7ce38b7e2dac272bb449a96c91c8a8ec9b4971ac85b5a037c683d73a250b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054878, "uuid": "44320ff7-9594-4578-901b-671a15f94200", "value": "T15EF4D08462381F6AEDBD47F96022D82187F63C2BB5ADE3594DC238DB3977F01061196B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054878, "uuid": "7f840156-7762-4423-b11a-174c23048a50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054878, "uuid": "eb2e26b9-dfc1-4d5e-a7a6-96e41fd44023", "value": "12288:WwtL6nOIgBVPMdVKRCy2tV04Q9RMd6uB8rVfrKiFMbTCx0crh4K34DUBEHslgDaa:XcRrzKAy2K9I2lfkY04f4DaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054878, "uuid": "caa16c7d-cd8b-4927-9067-3dc3621a3a6e", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054878, "uuid": "f0105345-d053-4f82-9fb0-4f13bb7122b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054878, "uuid": "eafdcfc4-5fa0-4b44-9193-9bdf8148ae90", "value": "PO_3912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e2156d-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662027865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027865, "uuid": "bf33821e-e28b-45b4-be8d-e0bc563954e3", "comment": "Malware payload (ModiLoader)", "value": "7f572fb7d6f371a4d1cefe8ed399931a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027865, "uuid": "249c64cc-a957-4dd3-8c44-da2d791948ad", "comment": "Malware payload (ModiLoader)", "value": "357ae03eb446bda1838949465952c7f02df92790e38c321573e6385ea83a1c64", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027865, "uuid": "89e9c9c2-e91d-4d7e-9fbe-3bee09656557", "comment": "Malware payload (ModiLoader)", "value": "27e67c5928d3ce3aec647c6950181101e3fa1573", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027865, "uuid": "569c9b7c-c518-460f-a701-1918217b28d8", "comment": "Malware payload (ModiLoader)", "value": "bf9e213c5874d41dac06bcd558461a5ff0fd71afa802e8b4daf9b7937a8815c19fd716277ca184f00941a5359c541d9b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027865, "uuid": "a3b2eba7-3745-4f42-b5b6-9e296a6a72f7", "value": "T1EC15BFF6B2E08A33C4231A7DDD1753A8DD29BA511E14755F7BE1168C8FB8280383B967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027865, "uuid": "09c1724d-eabb-498b-9a32-094da7ae264f", "value": "e44b1ce3d13e55963ede0f334a1c0840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027865, "uuid": "8a4b53ab-00b6-4210-8df7-26385323c06c", "value": "24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027865, "uuid": "97e839f0-ef5a-4821-a720-d47dac38e765", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027865, "uuid": "59941ce5-aee2-4194-af49-2b435edc3ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027865, "uuid": "1bc6bbe8-eaaa-4baa-b5f7-0be5e4a756a8", "value": "DHL AWB shipping document 3452778287,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e3ad48-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024295, "uuid": "b0953d0c-246f-4885-b095-79ab058cb8de", "comment": "Malware payload (SnakeKeylogger)", "value": "ac7a6dd4cd6778a6bb8804ac5f32977c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024295, "uuid": "bb541158-bc7c-4bfe-92c8-7b9c9631c990", "comment": "Malware payload (SnakeKeylogger)", "value": "36e87dac79bfcb21ce7aa9441977afff6b16c3f654685b1000cbf037a90c26d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024295, "uuid": "57fbc81f-102e-4500-9e76-9a7a567c9255", "comment": "Malware payload (SnakeKeylogger)", "value": "2e76f79c1fcaad08bb6b4c946bef3f3cc9fe7ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024295, "uuid": "ab01c1d5-5f9d-4320-957a-7f8943a43181", "comment": "Malware payload (SnakeKeylogger)", "value": "8d19e78f2a363eb8c9ae54bf98f025dd6d0d76a7a3694856b217171816141fa6588f994a5e2c55c29b1b944b573dac4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024295, "uuid": "36c461eb-1b03-4ff2-b3e6-a6331f5f8e3a", "value": "T10B049762E884E6DCD8B51CFA55B4B257D8C87CF3E8429EC6F349B9D9C5324DAA10C40E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024295, "uuid": "4fc57c04-938a-4b30-9c35-8f5158df393e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024295, "uuid": "79b33f8c-43b5-4936-898f-eec83b6520e9", "value": "768:BxWjpKQ5/RMIxX84sbGRz/iNHAzvVVxmloN/:BxWgU//xX8Rba/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024295, "uuid": "77d3c8be-da9b-4156-bda0-1fc5c0cc0aa0", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024295, "uuid": "ab0c69f8-2b3d-4242-8239-34243dcf766c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024295, "uuid": "0b934fe4-cfc8-4862-8ab8-49fe9d977f3b", "value": "VESSEL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c93ef05-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014570, "uuid": "b5bd661e-e792-4905-994b-92b49223eb7f", "comment": "Malware payload (Gafgyt)", "value": "3d16df6740519d29be64cfcaf956bd81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014570, "uuid": "0637be8d-34a4-4740-9f8c-85a12eebbbfe", "comment": "Malware payload (Gafgyt)", "value": "36f924989bf3c22630c857b3b8ad1ef728e79f7d475cd0fd8aa2cfdc5c04760b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014570, "uuid": "f2b97f32-3f15-48c9-a4c5-34415b86f07b", "comment": "Malware payload (Gafgyt)", "value": "1b8bf55a5379be5a4a98ba245893bd7a79b0b40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014570, "uuid": "143ba2e7-494d-49e7-bb72-493da4647c11", "comment": "Malware payload (Gafgyt)", "value": "3f88e5f507ee5bdfe9f47d1e04318c63ff307fd21913fd5cc43d61ad30928771666819070c383ea43cc172f7b7c5af20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014570, "uuid": "cf3a4ce4-bde3-41c7-b8e6-5e92bf537cec", "value": "T15A734D42E652CAB3C8930BB6029B5B264A31FC3A1E2B9F59F31D7CF49B124C87217755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014570, "uuid": "e60182f4-3498-4bc4-afd3-00fc9ceef54b", "value": "1536:0+xNVpGQWuKv8xKBnq5PeOj5zMLkS5qmLI2VOCjXUfJRk:nNT830xKBnq9eGrS5qmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014570, "uuid": "36e2bd14-96c5-49e9-a4c8-473d4e0e8863", "value": 74017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014570, "uuid": "0caa9435-c0cc-42be-9dce-329ebc73bc7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014570, "uuid": "0c48d447-2341-4997-a769-f68a28e32b35", "value": "3d16df6740519d29be64cfcaf956bd81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638ad191-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024058, "uuid": "2fb1f23c-7e90-47bf-9ae6-36ef3700c1c8", "comment": "Malware payload (SnakeKeylogger)", "value": "7e8aa27ca8f42ca3488d8c56a8b33f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024058, "uuid": "517bbeab-1348-432f-b10d-5fcece5313dc", "comment": "Malware payload (SnakeKeylogger)", "value": "388eea4a3eda0e7987e13445de22c24693441f473744f5b3a0754ddbb883a1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024058, "uuid": "2ebd8c5b-24d0-4ac4-b40e-5513ed4865ae", "comment": "Malware payload (SnakeKeylogger)", "value": "f0ae42d6bea25cf9e351a21ae18160dab9fb83de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024058, "uuid": "6de7fd94-0d8c-4cfd-b484-ef9e7af642e0", "comment": "Malware payload (SnakeKeylogger)", "value": "7e88368a342a55efea86f2515bcf0872eee66fec435f5bf07efbb1f4caa2cd0ef5adc54a4659e6755f3c288bfb2f9e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024058, "uuid": "7c16520a-f2db-4878-a3ed-46746d3230b9", "value": "T139440150976C9F35CF3F777186A8552803E7AED21D86DBC8CB98DEC5308AB202936947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024058, "uuid": "b9e92575-900b-42ee-9db4-7af9e767b45a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024058, "uuid": "52958a4c-198b-4f4c-bdc6-6f7c746f9927", "value": "6144:RDBkuri/tJaY3j8jOuTBLbCnpd75KALmQvpK8GRFx0:R1kwMAC8bTpenpbPiQxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024058, "uuid": "d72eace7-84d5-4daf-b48f-1ebf9c0437ff", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024058, "uuid": "e873dc90-af66-490c-86ed-7df8a0dc007a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024058, "uuid": "983ae713-9c33-4176-8a22-48d2f1f71052", "value": "Drawing Sheet Purchase order 10261166 from ElringKlinger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18a9557-2a1d-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662054361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054361, "uuid": "f1b5f216-ef00-42df-9ea1-32ab52f0d47f", "comment": "Malware payload (AgentTesla)", "value": "d5312baf43e357b104ef72a06248c33b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054361, "uuid": "c23381a4-0833-44a0-8a5a-7967703b2cc2", "comment": "Malware payload (AgentTesla)", "value": "39c77a8d695cb01dea623bf54e70724b1862b8046691a3bd8bd2d0cd8a56a01f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054361, "uuid": "c2f495e5-bca4-48bd-b7a2-6e500f0cfd64", "comment": "Malware payload (AgentTesla)", "value": "d348728fce338a13272cd4750abd3ba58bcf816c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054361, "uuid": "44dffb12-ae5d-4754-a0d2-e0191e767577", "comment": "Malware payload (AgentTesla)", "value": "edf3f1dddbb00fbb4bab090ac729e4740015e6eb6bacc44b7ce7d0e615fc9c1f856894980e9b5a024982a9d0c434ef6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054361, "uuid": "2ca5da32-e16e-437c-bca2-bab4757e0ca8", "value": "T18135121B52D94B26E8903FF446B0E21152BDAE259074C789CEFAB3F415F5B9BEC0250E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054361, "uuid": "4b43a5ec-698c-4131-872f-7af05026ed74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054361, "uuid": "cccbcb48-e15a-4dfe-b53e-b8e2e75ab60b", "value": "24576:FEwJZ5Rx8Efj2XY+mzo3bvFxWcjYp4Aty4Cz5M+3WSUi3b:X5R2EUlmzMIOEy4Cqc713b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054361, "uuid": "ecae6ef9-9d07-4414-9ea7-e5627127429e", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054361, "uuid": "c525cc1f-57aa-4d56-86a9-039d55ec4a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054361, "uuid": "abb8f97f-d75b-4be8-974d-fa0512a0a506", "value": "ESTADO DE LA CUENTA DHL - 16065616743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34268a64-2a2f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662061774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061774, "uuid": "7db767f9-5ac4-48d6-9d1b-a457ac01e119", "comment": "Malware payload", "value": "21c3898220868bb62d0c7a3deb750127", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061774, "uuid": "52dc1680-1139-4ab4-aaf4-c4b6ff40b3bc", "comment": "Malware payload", "value": "3b327211fa4302c16189045ba75c64974f376fdb4bee8b2428a9800d42dde9e6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061774, "uuid": "e8bfc233-bf57-43ef-a57d-dfa5a6101b7a", "comment": "Malware payload", "value": "915658f51dfaa3b4f7db5b73642e00a3496774ef", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061774, "uuid": "00583575-ad5a-4e37-8c4e-54a22d59e7d4", "comment": "Malware payload", "value": "c4ed9751e35bec4ed77e7ce6097d0541611643b584ea187d061976e664eb881e9180f3f84bc81fbb4ad951067b3a0b75", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061774, "uuid": "9be6bd59-bd65-4cf6-8a49-8b9a2d3220ee", "value": "T1E0D423A5AF614D857E0F2B30008F5BF9B495359F7200A89DD98284973CBFB553A80E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061774, "uuid": "8a5f0e4f-6bfe-42d9-b05e-5a40a50ebd35", "value": "12288:LnciupG2Oi6/xMUBYfqaLfTV8yC+h/Td7kxHKBYJT/0hNGzaMe4:TcieGH/xMUGqa/dC+BdyuYJTDzaMe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662061774, "uuid": "05831220-4181-4d04-ac71-ff1bd44df0d9", "value": 630578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662061774, "uuid": "bf42e7d1-f650-42a9-b9e1-cfc2ea3c660e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061774, "uuid": "40389836-dec1-4b5f-a56c-f820e3804585", "value": "New Purchase Order 0012323_1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0ab703-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045309, "uuid": "258150ca-09a5-45e6-8936-3bf80c13cf2e", "comment": "Malware payload (Mirai)", "value": "8b209c1ccac7233f776a73882e715643", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045309, "uuid": "fb2c6365-126c-416c-8f34-4ee09386d216", "comment": "Malware payload (Mirai)", "value": "3b7caa7207642d11d69e0fb5f565ff179dc14a59ab55911ef5c4f06ce283b20d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045309, "uuid": "a6a7abff-4a47-471b-a7eb-627c6686b7c3", "comment": "Malware payload (Mirai)", "value": "22061acfd626a8ac59b847a77f922a4dfeb66847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045309, "uuid": "40b6fab4-af75-452f-9b63-6c1be06c345e", "comment": "Malware payload (Mirai)", "value": "805666852fd7f6dc1bdb8346e058dff16db6536cb98f45a205b8ab68ed6319164200e32a010916ae873373814cc5904b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045309, "uuid": "3a29e51f-ad4e-458c-960d-224ac6840178", "value": "T1A3A2E019BF28818FC832297555E9E5D21397FC61F2EDCC096540C16FF5A33A92834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045309, "uuid": "863ee708-f387-4de6-bef6-777cf7edfc5d", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkGadmTb+502F2vwA9dWuMW21bAK1oT0:O98o08kxofBE+ZkGaITbp2F2TWul0c5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045309, "uuid": "49d2f30c-fe9e-4a62-b2e1-9ff6d2c0b5ca", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045309, "uuid": "2aa66860-c58e-4f73-bc1d-85d36bf695fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045309, "uuid": "f4b67714-6ff4-4ba7-ada5-c22052cb44b5", "value": "8b209c1ccac7233f776a73882e715643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e2a007-2a03-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662042960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042960, "uuid": "040ad3eb-98c0-4ae5-b463-9b0cd016e381", "comment": "Malware payload (Formbook)", "value": "abc620af065a765cad9dc45093e73c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042960, "uuid": "7337ec97-be40-430c-9680-7b29db7ad580", "comment": "Malware payload (Formbook)", "value": "3bfc405f340396a4b679a770d8232aec67f5e42d43c9f8b14aa3b689d444b917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042960, "uuid": "134a14a8-23ed-427d-a029-9bdcd3f1817e", "comment": "Malware payload (Formbook)", "value": "6e4f8ddef8748984c15fa7166b2fabd8516d73cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042960, "uuid": "ff1dd53d-7b76-4323-830d-e1503d9442c7", "comment": "Malware payload (Formbook)", "value": "298464e48b8cf7c22dd041072f2f9037e791850464bedb3d8815c94b5cce86b01a337fa4d77909f2faf0750b6e268207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042960, "uuid": "54c4051e-d028-4e76-bf42-6dd88979e1d1", "value": "T1F5050184359CE546CB5E4D754113CF4C8230DCE3E99EEB82AC88F6A9207A3E9CA5175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042960, "uuid": "6397a59a-30a1-40aa-997b-62721a20e9e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042960, "uuid": "840ba3f7-1e08-46e5-a80f-c3988e999c3a", "value": "12288:V+2wrYNEHslgDau6nGKDcrL63xejFTZEs47658e4X28LFAZCxsq9DrgqdWQhTWK3:VvCwXaO5ssBe4X286Z+sIXHfTWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042960, "uuid": "891ddcea-ca69-4255-9e56-c97b46534128", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042960, "uuid": "acaddaf4-3afa-42a8-bff7-b4bb45951f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042960, "uuid": "85ebbeb9-e05c-404f-8293-1f0584b69b87", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64502b87-29ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662033938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033938, "uuid": "84b5fb7e-fe92-4756-83b0-64aa09f0805c", "comment": "Malware payload", "value": "3aec12ded2174a98e8cd61fd890f3d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033938, "uuid": "913abc1d-e79d-4204-aad2-d8a1b4865962", "comment": "Malware payload", "value": "3c7b4e3904f7815a0e141b26fbe04c0ab46bf10aa67e0ed131e95abec4ad1be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033938, "uuid": "ee0a5b3a-b69f-42f7-8483-a32458a0b901", "comment": "Malware payload", "value": "9ba6055e58c2a12a11c85d438daff90f95e621b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033938, "uuid": "71bca84f-a745-47d3-9ad0-9b443e9277f8", "comment": "Malware payload", "value": "25210cfa4035f1b43d16b87a3954ee4f6250bc072101e67a4a79bd1815e86f860eb6d218a3d24b3e469624aff57e624f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033938, "uuid": "f1b30e19-31fb-45ea-90ae-3b6b2fb5354a", "value": "T1E2F533841F4189A3D89644703047AAB73ED1CC71A360BEF3ABCE255D7C613A2FDA4999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033938, "uuid": "ee0297ad-2d4d-4d70-99b7-ed683c41c787", "value": "efa5f35372e4d62ace30c793506bd914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033938, "uuid": "a0a724a5-f5aa-4af8-bedb-9d36e2f994ff", "value": "49152:YUd8g4X/jCb21UhH35rTHhrnwtGVyaB3C1CvEqm+eYIDNVU16j/dbr4imHHXNv/k:Bd8/XrU21ArTJnXVyoIqcYAK4MicHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662033938, "uuid": "e5b4068b-2a5b-4f3d-be9e-419ff6fc7300", "value": 3327000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662033938, "uuid": "0c693818-357a-4a46-be40-545e3b8a5503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033938, "uuid": "0f6d2a6c-7b2a-4393-9711-8dc564ce8abc", "value": "3c7b4e3904f7815a0e141b26fbe04c0ab46bf10aa67e0ed131e95abec4ad1be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a888b9fe-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662040065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040065, "uuid": "3976decb-7172-4670-8879-26fa39b6aaef", "comment": "Malware payload", "value": "88a0d61494c4dc8e9614febd1c98d97f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040065, "uuid": "0728ebce-5b19-4bee-95d0-ea938f6f1efa", "comment": "Malware payload", "value": "3c968a51021d17597d9de3b6eaaddf35b02036bf06ebd064e2874c462728c6ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040065, "uuid": "60d53f12-5878-4e51-bf5e-63b12130768c", "comment": "Malware payload", "value": "48f55dbb3ce39b4091a9ec58949ed477ceeb59a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040065, "uuid": "ade2303e-2aad-4cbb-8fa3-ae2e4d50d0a2", "comment": "Malware payload", "value": "2f1d6585e69b15b652c558b5b40ad7e54a3c0a1b47d41c36212d89f82d5795b28dbe92a3798734bc5cbd5341bee8c5af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040065, "uuid": "43833656-376d-466d-82c0-9a70e983e70a", "value": "T183247DCE5DA2B5E2C7D431BDD26F60AD5AA4070C4236A7BB0B300E585C6B99BC1774F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040065, "uuid": "6610411f-a461-4def-b97b-f41aa6c8e1fd", "value": "85f77de3eec12491615702633454a32e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040065, "uuid": "c2ba79a5-5454-4aeb-b845-986333a5d251", "value": "6144:9R026LgcpHrsuIGtYrGGmTxxxxxxxxS08ioagLe9ayrapDvgHU5f:Y2ypLsSLGmTxxxxxxxxS0zoagLe9Kvg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662040065, "uuid": "5ccd777c-a809-4718-9743-082aa81a9c5f", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662040065, "uuid": "fb54befe-d688-4d90-85d9-412b9bf92eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040065, "uuid": "a8c77426-0bb4-4690-be54-3ea6b4ff077a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f92ca91-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662031299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031299, "uuid": "4071832b-b734-491c-ac2b-b4df0f40e1e8", "comment": "Malware payload (Mirai)", "value": "ddf146638e60674be57e5f8120101e2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031299, "uuid": "3ab7ac23-959d-4bf6-b089-98e94ce1bc87", "comment": "Malware payload (Mirai)", "value": "3d7088169f2fb4e249984a58367dde2ab0ddd6645a01c6959bfe987e4fb6143f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031299, "uuid": "ea27f5ad-bb46-475c-b47e-394d1954ab05", "comment": "Malware payload (Mirai)", "value": "f12a4dbaa79960631267869b55345662ddd164ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031299, "uuid": "c4c5764c-4a25-4dd0-8eca-cc5c0c527756", "comment": "Malware payload (Mirai)", "value": "d92cf0ca7f78fb15137ab6afbe5bc7fde32e519c947e71b0ec6418f3325f80a014558275578c349daebd379c5c84c5eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031299, "uuid": "b929e2f6-41cd-4398-aaf8-7c4c2bd7ed4f", "value": "T171633AA6F800DD7DF80BE77B8417450AB631A36555830F3B639BFE53AD321A84926F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031299, "uuid": "eb51a662-1735-44d5-a8ba-630c8ccae87d", "value": "1536:/8DrCpNdkb2FqW4I83uYnhuRVcLgNIt8dAASTAfKmGVMYS6qsQkq/:/8W83uL+ENIdArKbVpTq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031299, "uuid": "cc5da93d-f386-44b0-91cc-31ab9994f00b", "value": 69032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031299, "uuid": "8d80df5e-0020-4530-98d5-6442b503bcd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031299, "uuid": "bbb3e049-768b-456c-a576-d611636868f5", "value": "ddf146638e60674be57e5f8120101e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8972ffa-2995-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1661995881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995881, "uuid": "bc1478e8-78a1-4094-afea-747e7f9af42b", "comment": "Malware payload (GuLoader)", "value": "9fecd530d0c11ef0066ac64d8acc1eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995881, "uuid": "4a18e887-3ed4-451c-9f05-e67fa4975c95", "comment": "Malware payload (GuLoader)", "value": "3d715fab1455552a0c842dc9666ccb29d2c85522c38487d86bb861416d1cdaed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995881, "uuid": "f659309c-ebc8-4b3f-9d77-60989e2f6ab7", "comment": "Malware payload (GuLoader)", "value": "aaa1fdcef4ff5f8accb7579dce6ec458f57cdb4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995881, "uuid": "612598be-e7a8-47e0-b632-890358716491", "comment": "Malware payload (GuLoader)", "value": "406f1935598fa62db9feb0999bea9996d5c8495f1634fffaf36389eb49ff70a5125a5c899ef019dad47ab5879b5fcba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995881, "uuid": "cb09e5a3-d12f-4545-bda4-20681a6022c1", "value": "T13FF4124336D4B256D5508A34E8F7E395DA76FE184D7049477314EF2E3A38383A90B36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995881, "uuid": "f1ddb65d-66c7-42fe-8f7d-c51c972e7cd5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995881, "uuid": "e24cf05f-aa62-42fa-8b8b-5e979810ee9a", "value": "12288:ZqUyPO6sfIg5fIhUH/tkzOHHVzmz9xabYtleahPrNC4T6ouo8yi:6W6h0ffe8I9tM4uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995881, "uuid": "087f9dfe-7196-432b-8bd0-a8f9c792a550", "value": 770720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995881, "uuid": "8a300fa3-b8e1-4499-87c9-7e049f5ed313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995881, "uuid": "1bd667e5-4348-468b-abe0-21ba255ecaf1", "value": "SecuriteInfo.com.W32.AIDetect.malware2.8414.13334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cecb453-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1662027939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027939, "uuid": "55e1b755-7276-4830-b279-260ec3ec1007", "comment": "Malware payload (QuasarRAT)", "value": "f53d6a0d4693488835b412fb558a75d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027939, "uuid": "daf13215-0ed7-406b-b38f-6989636fc614", "comment": "Malware payload (QuasarRAT)", "value": "3e2842c40ff26c60b69e08934b9b80fefe0cd2d091fbd6fa91a2b97f3487137c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027939, "uuid": "8e048cec-711d-496d-a707-a44f8abf5ed2", "comment": "Malware payload (QuasarRAT)", "value": "802139308484ab4905f5af9b40f17d01568a9790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027939, "uuid": "eb68f6e8-4a28-4c78-be3c-2fb9b7004bf3", "comment": "Malware payload (QuasarRAT)", "value": "2b807517b9e64f1dc78bc38b40553ce9d3f0d8d7723e11cbbf853f3567da52f968e5bd78a7795c23fafcbbf003344f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027939, "uuid": "d096cec6-fdb0-4e7e-bff8-2e7895dc7359", "value": "T107150249AA84C3B6F4260BB011B1F12581BDBE159271C2DCBFCFF2EC49B4B129257A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027939, "uuid": "1da79fdd-6ea9-4446-bc50-19ddd386a735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027939, "uuid": "48cec0be-a963-44de-831f-f632790f2395", "value": "24576:3Z5sXY+mzo3bvQhPGbuYKeS0eVIUdJyh:J5qlmzMIlGan0eD3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027939, "uuid": "b424dd52-5c35-47dc-b43b-606d5178cbba", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027939, "uuid": "3a4a3c32-8eea-4e8a-a5bc-20b61d9eaf47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027939, "uuid": "9590916a-5cf3-4a55-8da3-be45a3ea89e2", "value": "Halkbank_Ekstre_20220901_060735_484554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b83133-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014582, "uuid": "ef54caa5-27df-43bb-896c-8e56807043b9", "comment": "Malware payload (Gafgyt)", "value": "12c4a8e32f9a9620182ca844e0aa3884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014582, "uuid": "0a30d8e7-7429-4611-ae79-da5ba7834e08", "comment": "Malware payload (Gafgyt)", "value": "3e3d5b3660cc62304d791ca17a42b844036b29ec51688e570af956b93438d263", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014582, "uuid": "e3a85ec5-a299-404a-8f45-c28590624c72", "comment": "Malware payload (Gafgyt)", "value": "a71ce836de251d6351b70a86d739998bbd5a720c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014582, "uuid": "b9fa18d2-c512-4bfa-a8b5-d242236fbb80", "comment": "Malware payload (Gafgyt)", "value": "1a8688263ddb453e052f45f90543139805e96c58e4878d9b49ce06d254c5decb4ad920c0b7d86be3b262f717dbd8d8c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014582, "uuid": "33acd01a-05ae-455c-9ca8-77d234bcfdf7", "value": "T15BB33901D5508B27C2D2277AFB9F425D37332BA8939B33215A24BFB42BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014582, "uuid": "f3db50ad-77b7-49cb-ad55-88138980ff16", "value": "3072:wdAkae+l8tZ2hWJJonXDELqzQbmTQOWsXAOn:wykae+l8BonXDibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014582, "uuid": "2feada5b-75b9-42c3-bfb2-1bf829f8f65e", "value": 111521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014582, "uuid": "87a8966e-80f7-4bc9-bcf7-1c32eda5e5ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014582, "uuid": "6b292f94-aa70-40a2-8577-27194c14951a", "value": "12c4a8e32f9a9620182ca844e0aa3884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b4ff2e-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049078, "uuid": "cf81e313-e022-4b8c-9cc1-0351807b7d95", "comment": "Malware payload (Mirai)", "value": "7a67ec0c60eb1da0b0a8a1e09b285aa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049078, "uuid": "84f368d8-c7ae-4767-94f5-7df30ccf6bda", "comment": "Malware payload (Mirai)", "value": "3f52b412e774c5cc6091f08d6486ccad6fc2ba2394e5a9f046291cf71118829c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049078, "uuid": "e49963db-69e7-43ea-88e2-f53af90dfdd4", "comment": "Malware payload (Mirai)", "value": "aed9a0432cf8b0e47e943f6b1dd0cc2b962a639c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049078, "uuid": "1a686d7e-4a72-4fba-902a-66f05ea92a62", "comment": "Malware payload (Mirai)", "value": "0cfcd92b3496bc4a156dd6fb3786785d3c9e249874f284f20b9a048b6f0779c6ebebc3dc12ec7911227aa4611aaf0f08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049078, "uuid": "c9d67ebf-c274-4e14-b51d-c6eb7e3e8e03", "value": "T1553319D6B801AE3CF94BE67F84170A09B630635441930B27A37BFD936DB32949D26F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049078, "uuid": "79454901-c05a-420f-a8ae-2e9066d6659c", "value": "1536:glEAN8dphEe3/2GI3eP75V4FV6+TBE8Oc:jAN8RGmPe6+tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049078, "uuid": "f538bba7-0f53-46fe-af8d-a2dcf5fe721f", "value": 54884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049078, "uuid": "1baa5b3c-6b87-490b-8f07-f7891b570d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049078, "uuid": "5cdd701c-83cc-4d65-af38-25a304735944", "value": "7a67ec0c60eb1da0b0a8a1e09b285aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459a3988-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014559, "uuid": "09fa3089-dad3-4e62-a1ee-30605cd76d11", "comment": "Malware payload (Gafgyt)", "value": "bf8ca88d276d8087d94c2af32a57e587", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014559, "uuid": "160eac08-bcbe-4dde-b905-b52141ff2c1e", "comment": "Malware payload (Gafgyt)", "value": "3f5e92323b9789571bb45018dec432b07978df238de93155af6d56ddeb160fd3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014559, "uuid": "d6529f9f-bde4-4aab-8536-b89e618865dd", "comment": "Malware payload (Gafgyt)", "value": "a876669280aa5f2c31cc2688b35c3333a3943787", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014559, "uuid": "6a6c4465-9a90-4f8a-a5cb-bb35f018b06c", "comment": "Malware payload (Gafgyt)", "value": "bcf2ad6fd85ea7a22a0caa91840f8630f311af33c407b0cda7fc9203cf951b18eac9ba8bd6773d8293aa729b204d50c1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014559, "uuid": "0604d32d-a6a4-429f-b0be-1440d3589672", "value": "T16A836B23A651C67BC0875BF92BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014559, "uuid": "5f9e47b0-1ad0-4d76-8075-6cd3350d352a", "value": "1536:eB7cH1LhKlBqIKVhuzdPQq0aJP9sWtjG7ew3ngLWODPPmoIYuOVje+ZNne:eRMhKlcluzdPv0o+QK7ekngL1DHmrYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014559, "uuid": "0f1aed8e-7dc1-4c10-8fc9-40c277849143", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014559, "uuid": "572d349e-0fc1-485f-a0f3-075b5f1111c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014559, "uuid": "e7c6cb21-2ae5-4c52-bf98-4a9e6f7ea50b", "value": "bf8ca88d276d8087d94c2af32a57e587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6692e8a2-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030935, "uuid": "92c85326-e178-4cc6-9756-bad0a7164fd1", "comment": "Malware payload", "value": "ac4ecf17c8b9894aa7589ef410d9040a", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030935, "uuid": "349349b4-68bc-4e77-9078-3389759a45eb", "comment": "Malware payload", "value": "40b7aaa2d91e895a945c4cd2430842b0d4a4b0de942a802bc2d76b7f4ec08469", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030935, "uuid": "aa02b46b-7fdf-407d-829c-a69cd6662086", "comment": "Malware payload", "value": "5ce06c9bd833e1afa56f1d8405a99fc05f9207a6", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030935, "uuid": "c158e5cc-e2e8-4481-9e1c-33aa067d11b5", "comment": "Malware payload", "value": "05a59a913dbb603c3a2bd1de6c8e0eced9e106647d6bd1ce0de31476b430cb244e91cb22d776be6e116990e86d7a2bb7", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030935, "uuid": "807d2c21-3515-4ab2-a267-2a9bc5d7796c", "value": "T19044582C30AE213DFD37EA459AC4B4B5CC8EDB336D46B6F546A103036689D83DD91A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030935, "uuid": "fda78384-cd51-4915-bd63-4b29212ac9c5", "value": "3072:WhzbQv0WMebSHw8+0iz4ZFqkBVZgjWSV6OlQiEiBSh9iYEGS7nEgwknvmgGEp83f:y7rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030935, "uuid": "89a98de1-91d8-48e5-98a0-6619840d8b51", "value": 255402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030935, "uuid": "28e069e9-f652-49ff-98f3-cfa7f4869dba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030935, "uuid": "79c6e761-2681-4a75-b652-1412c1084c09", "value": "flechas10Pe.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca26658-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1662028341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028341, "uuid": "3cb963c7-8123-4fc3-9053-cebecbd62687", "comment": "Malware payload (Socelars)", "value": "eba5494bf0961148fe15033f1585f4c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028341, "uuid": "95c0aa95-b86a-4b66-92a0-be76bb33b3bd", "comment": "Malware payload (Socelars)", "value": "40b989916a3ffa6654631ab1ebda2e0493712f8cb38f936201701913c0f887fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028341, "uuid": "64d9ceb5-c955-4fed-bd88-51fc72246b37", "comment": "Malware payload (Socelars)", "value": "5d7c08dd0e8ca2ba277b24d8b62c28b2a35e0aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028341, "uuid": "d5191022-6fa3-4198-b071-4e2d79a6b79c", "comment": "Malware payload (Socelars)", "value": "23a531cbeae0cf140f0535848ffdc52150f67ad25ef6188648f9b6079febda8b9de6ce67b931354c2d55edfb665ea6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028341, "uuid": "e6533df4-de9a-4bfc-9e1e-f74571038dc2", "value": "T168659D11FB42E036E8E300B282FF5BFE9D28B621131894D7E3C45D695A719E23A37657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028341, "uuid": "ed225e7b-d2ee-4d07-92d5-e016c3ff6592", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028341, "uuid": "2ace4ea4-1814-4c30-97fb-0df8c6001a91", "value": "24576:y3MDpobXmmlFSUacscm2ns1CqSzqrNv+9IxPGSdEDKYHJinc:y2pI3t5XJixPGSSDFwnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028341, "uuid": "e6d768a5-ce48-4c25-8f7a-edc862a34f4b", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028341, "uuid": "52be8f89-20ef-4e5d-92d7-afc9a36e0900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028341, "uuid": "866d1ce2-3b25-4130-bf43-4fbcdbf86575", "value": "eba5494bf0961148fe15033f1585f4c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bdc090-29ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662041434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041434, "uuid": "19012458-198a-4155-b81b-e8b49ebe1267", "comment": "Malware payload (Gozi)", "value": "276eb618a19dba775527f985e9bd2dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041434, "uuid": "514f3298-7c19-445e-ac84-c2a9b797b013", "comment": "Malware payload (Gozi)", "value": "40dafe4e82513adde4bda0705f4a6992e26ef498587241c25f9bacdf075e36ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041434, "uuid": "c1dd8705-7578-42e2-95d0-ed150e4d4571", "comment": "Malware payload (Gozi)", "value": "b8bf862c00854116b11e3c724e108d85aeec42e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041434, "uuid": "64addc3f-1f4d-4218-bff0-9055813b9245", "comment": "Malware payload (Gozi)", "value": "fe590652cd04cd69707a745ffd018a224608c31bbeaebee29cdb06399cc7b24d487b1838b04fe12d5c21ae50277094d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041434, "uuid": "b57bbe52-91b4-4263-9a68-af51b39f2229", "value": "T1E9345B9AA3E51995ED6BC6B6CD53D227EBF234092B14D30F5370CAA66F17722B11C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041434, "uuid": "6af532b5-3f17-4329-bd3a-2cb2787ca0b3", "value": "3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjbQ5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662041434, "uuid": "1910e509-e17e-4c00-bdc9-38a810775566", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662041434, "uuid": "5aaf50e9-b19a-4939-9a88-32078767eded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041434, "uuid": "42c9e329-2586-412d-8ac0-98e565caa347", "value": "f3a0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae9e969-29fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662039290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039290, "uuid": "7aa0d313-c71d-432c-b96b-43141dd11972", "comment": "Malware payload (AgentTesla)", "value": "d2f0cdd0e4a51bb5135a5b9809d90935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039290, "uuid": "ba882ef8-5f6b-44d6-8a6b-f9bd061d3c55", "comment": "Malware payload (AgentTesla)", "value": "40e3deda4b8bcdb75c361660910b1f96532f31afa2f71d0f5d8134b679d89ac1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039290, "uuid": "2a454968-54ce-41d3-a172-33f365202547", "comment": "Malware payload (AgentTesla)", "value": "036d5ae67eb4be8605bdab051822e18e03b67634", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039290, "uuid": "453b32a6-8f79-44a3-b8f4-e8c439bfc1ba", "comment": "Malware payload (AgentTesla)", "value": "b7ead3ebf8d772ce45fb30ee68b0e459e0347a64367951db53e374c0a34a34cd7a6c27e90d977bb18fba609894148d94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039290, "uuid": "e7ca9623-6e1b-40e4-a29e-0544d14cb367", "value": "T174E47CAC749836FEC857D972DDA81DA4AA9264B70B4F124B845315BCCDCC987EF180B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039290, "uuid": "0668d00d-125a-433b-becb-16f73dee5318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039290, "uuid": "37d675f6-8500-47f0-8ced-209ef9666879", "value": "12288:TWt/mmFbQJKzU7g8OX14lDRjN0MbVb9lylSx1655gQ8tIiM9HihokWoFZK0:TqmCkAU7g8OKRjN0olk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039290, "uuid": "81e34a58-fc76-4282-ba88-bc059eba5523", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039290, "uuid": "2ce30ae7-9164-415b-af2a-73ff70929749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039290, "uuid": "61901f62-69f2-42d3-aa32-2a4695321e0d", "value": "Contract Agreement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faebc9d-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662043728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043728, "uuid": "069cd132-0636-4882-9f84-d6e04e23a20b", "comment": "Malware payload (RemcosRAT)", "value": "985625f726c8201c7431e64ca2303b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043728, "uuid": "50b109e4-7f68-47ba-801a-30d2ede7c00e", "comment": "Malware payload (RemcosRAT)", "value": "4103842f2d2d2b92d2f424d800bd1006685a58f6ca5950689fc9640978346fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043728, "uuid": "3aadaaf4-3711-46af-a2f9-4355947c0282", "comment": "Malware payload (RemcosRAT)", "value": "6f039b70d961b8665277c4dea8227c256caa0737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043728, "uuid": "39eb720a-0518-444b-a3db-62dab81e0eca", "comment": "Malware payload (RemcosRAT)", "value": "39a56efcd363ae9067665c5c6cb798bb688dd17c5386f1f8224ba32ff2f1301f3210b161b24ac4f62312cfc74d969fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043728, "uuid": "6f24f130-6203-41c8-a0ab-37fdc8685e14", "value": "T17C45234E85885B22F46D1F7586B0F21642FE7F2E5072D7C98CC9E2F419DA327861AB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043728, "uuid": "ec77b70a-741f-4df1-9e91-78c626616dad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043728, "uuid": "d4bb4c77-eb1e-47ee-83c4-ac376cb8f748", "value": "24576:RZ5HXY+mzo3bvAKANivQEX0cDwlkfEL3OuoSlsJNhc/9NSpF7k:L53lmzMYKANivQEPDwlkfKO8zFNa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043728, "uuid": "508709c3-869a-4cdb-94be-2b74570776b5", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043728, "uuid": "af498575-4014-496d-80a6-a70ec9e04927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043728, "uuid": "755d060a-d831-43b9-bb9b-306d8cc85738", "value": "STATUS DHL RA\u010cUNA - 160.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ed1a74-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662028355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028355, "uuid": "f2513a80-fc01-4c34-a53b-32ab61851d4a", "comment": "Malware payload (RemcosRAT)", "value": "8bd74195c18fea6ddaa472d6d78f4ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028355, "uuid": "bdd6f74b-511c-40e5-a606-c1c227a23bb9", "comment": "Malware payload (RemcosRAT)", "value": "412a694c19663771576663125556c5e3e2377f20291f5593a4b0faade79b68a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028355, "uuid": "89839811-26a9-4f5e-b7dc-3a8f383146ee", "comment": "Malware payload (RemcosRAT)", "value": "ee648e3e6e77e7fed8fdc12c345b97e27da29bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028355, "uuid": "ac2620da-f13a-47d2-bc0b-425daf2c7cf1", "comment": "Malware payload (RemcosRAT)", "value": "ad1044ee23425dae80d14b44532b6515001e9a907ab70d854ae314edd7fd7be5c1d4e7d797bb753a2d6d6c91502520a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028355, "uuid": "ed2564e6-97db-4ecc-a7b6-e7b76c45c0fb", "value": "T1A21623B353BB8201F4E6CC39C12BBDD572F7076A5F42ECB869E6A9C125524A0F312953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028355, "uuid": "e9aec65a-4097-431d-afbb-99e5a9dd7533", "value": "24b92ccf1e266e626a6cc7126f975fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028355, "uuid": "b47995c0-b4fd-4182-92e3-00c9264f9d18", "value": "98304:N9nrW9imEg5V8+LFYhBfrsqcl4KYHgJJ2I:NJgimEg5+Usoqcl47qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028355, "uuid": "214c7c2f-16dd-45ba-97e8-906ecb8097b8", "value": 4337664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028355, "uuid": "c799b7da-692b-42d0-a705-d44db20567d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028355, "uuid": "59d38fe9-2843-439e-9466-cee5a053ad36", "value": "8bd74195c18fea6ddaa472d6d78f4ac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67effae4-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662043393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043393, "uuid": "aea7e6cc-8dc3-44cb-a5f7-66a380c96155", "comment": "Malware payload (SnakeKeylogger)", "value": "16daf7ab0517a6714a31cd875ca652ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043393, "uuid": "bc0d6b88-474e-4a7d-8373-d3f79bb979ef", "comment": "Malware payload (SnakeKeylogger)", "value": "416e19c1a9bb087d6c1d2ff675e7c9cb2583eaa5bec5856b429a619f5f5416c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043393, "uuid": "f7dde967-0c8e-4770-a611-27e2e0b69d95", "comment": "Malware payload (SnakeKeylogger)", "value": "3dd38e5d88ee43fac660293e8be8dbc9dfd1fc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043393, "uuid": "3299f4e1-66d8-4b73-9266-cdb3aa66b163", "comment": "Malware payload (SnakeKeylogger)", "value": "a3760caed2765816ab891490015a77272a4aaeec945ef8c170e7f036885682b2655aaa26a2e22cc6d7efaa626bd04fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043393, "uuid": "a4d70e4e-fa51-4edb-8548-6f9f9d3f1ffa", "value": "T19A25121E8A894F11F4543AF402B0E25192FDAE185074C74ACEF9B7F829F8B9BDC4661D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043393, "uuid": "db473aee-a857-438b-95f4-c76ebb9fe771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043393, "uuid": "1544bf9c-14bf-4e9e-aa4f-7da8edb0db2a", "value": "24576:qEoTZ5Rx8EfjiXY+mzo3bvOm2xGSbsGIHMbW7:25R2EwlmzMmmSvbY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043393, "uuid": "dd0a9b5b-64cb-4801-a3ac-bacb8e2f63bd", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043393, "uuid": "b4be19cf-cef5-4e81-b56c-c87a368c2ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043393, "uuid": "a16b9ec3-ff35-4ccc-96ca-7ca11b475d8f", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c691f8-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045296, "uuid": "cafc1fb8-32c3-4431-a8e7-a4aecd1af46a", "comment": "Malware payload (Mirai)", "value": "6d946b56b4a605f57ed4987c0c33f932", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045296, "uuid": "c76670b2-d6d6-4a34-970a-5a03f3bface4", "comment": "Malware payload (Mirai)", "value": "41b87fb00d6ecbee582c971d2877902b29c7010944823c50f72376b77d1bc123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045296, "uuid": "54674b4e-dc9a-4bb0-b72e-757747b60afe", "comment": "Malware payload (Mirai)", "value": "c0d9fcfb2ee9f50046e45fcb497c124218b1372e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045296, "uuid": "d20d0cd5-5f72-45d5-9cf0-524b4a7e03f3", "comment": "Malware payload (Mirai)", "value": "30e532e6b0cf1fc42dd8be610bdf98ef6dcb1607e2a852e305055d6364cd1da161cc3f4dd18559b7fe2bd307ecca3e7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045296, "uuid": "2b534944-961b-4d89-9bb2-0954e262a680", "value": "T13AB2C0ACA88C3086CE5D6C7D365ADB018F4D52E0A3CEAF7CE361CD4867F598A7049578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045296, "uuid": "ddfd1c95-fb59-4411-bf0c-e87151906a5d", "value": "768:cGrQlS07dEv0UXqUhvQE+CXH4dk0OTp/BusCZqUWvL:vQlS07FUXqIYSXHKLDsGqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045296, "uuid": "2cc50952-2c14-438f-9bd8-6ba0ab48628f", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045296, "uuid": "753c3b54-b1fb-4b89-9586-517f692b597a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045296, "uuid": "7e1f1a9a-c250-41da-a209-7115363fed66", "value": "6d946b56b4a605f57ed4987c0c33f932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f86b8d-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662031466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031466, "uuid": "2f0e33de-6ba4-411e-a3ab-0dc4713be2c6", "comment": "Malware payload (Formbook)", "value": "5f5a185621768509b2f0b53c182d3ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031466, "uuid": "3ea096f2-9d98-4b88-bba3-09bf8572da6b", "comment": "Malware payload (Formbook)", "value": "41cd3397a694531836178ec9ceec2d7e2b127049bcd9e6a8bdd483728809624d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031466, "uuid": "86c037a9-13b8-4d4a-9d6d-14bf829eb253", "comment": "Malware payload (Formbook)", "value": "5c0bab854b18a887b0c21931cc69d8123f3cceea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031466, "uuid": "e5080b6e-2e66-440b-92a6-a97d2d049ec7", "comment": "Malware payload (Formbook)", "value": "fe05eebcc7b341e842982de0bc3a61b3e206338f476a79ca2e3d32ab625fe319b1e01bf4d81555224a06ca31b54e8890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031466, "uuid": "47c094c6-9e58-4899-af6c-b6de9e51dc1c", "value": "T16A1501293B56A98FC463CD798CA49E60F261A3275707D747611B266CFE2D3C6CF801A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031466, "uuid": "d30d4bee-cbd1-403d-a053-aa2598e9272f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031466, "uuid": "c0c6ea0c-ba0f-4629-9913-531d3911af33", "value": "12288:yCpCc6+aG6xFjjvuEHslgDaz7zibGyLwJEbTQ+jt6NL165OlW2uxq6fd6q6/xWv1:1hC+ziKyUibTto65OgM66q6/xIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031466, "uuid": "03b1401c-2a76-43a1-b156-95bffbd66f66", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031466, "uuid": "7b4206b3-23a9-4d6d-93c3-d467518beacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031466, "uuid": "6e9cf71f-db98-4ce2-b1bd-2709be163c1f", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fd206e-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662024329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024329, "uuid": "a84b881d-2a39-47a1-aff4-7ccc8f80bdca", "comment": "Malware payload (RemcosRAT)", "value": "8e0f282c15d5878f2be1a2bb1d03b282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024329, "uuid": "6ab65193-6a32-48a0-bee3-2e63b45ef69e", "comment": "Malware payload (RemcosRAT)", "value": "43315db8e2478daf8fd752a5414bb8edd127db7222b47ecd2156587112544346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024329, "uuid": "230e3c60-2870-46d4-8f0a-b1009337ee91", "comment": "Malware payload (RemcosRAT)", "value": "98ce03811ee41e3d38cf1d50baf99050e6372a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024329, "uuid": "7a933460-22bf-4bf6-942f-abd60f002f90", "comment": "Malware payload (RemcosRAT)", "value": "5e3b72da4a2e69b4d1ba321636deccdc9e912c7c7979a705cf713fc9b2baa7a6757ceb060846c94d4bb89ce4874d9441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024329, "uuid": "4af2caa4-b14b-4e75-aa46-31c6c73c8ff1", "value": "T10B45225ED244AB33F4590F7097B4F70143BEBE06A1B2D7994DC9B2B098E632B4647B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024329, "uuid": "595a8c04-9d74-4ea9-b661-22add703fad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024329, "uuid": "bca7ce41-b1c5-4739-9a31-3ca0e830e00a", "value": "24576:ZZ5eXY+mzo3bvrqX9DjOTBoVPSbP06q+d+5b5aClTTwVOuK:D54lmzMjQDSNpTd+p5zTkVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024329, "uuid": "c4b45c2b-5b84-404b-aeff-9cf7cd7dd5cb", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024329, "uuid": "4fc8d2f4-6045-4920-9d74-9b0a25f30d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024329, "uuid": "02ca404b-d7f7-4f4d-89cb-f9b25b30ba20", "value": "F?YAT L?STES? TALEP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9075f44a-29db-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662025851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025851, "uuid": "749146d9-9887-4358-af08-8241c612f702", "comment": "Malware payload (Smoke Loader)", "value": "bf8fd38ebd168ad1f7d6d6c646aeec7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025851, "uuid": "a8143a56-1d80-48fc-b737-8adc6ee383e6", "comment": "Malware payload (Smoke Loader)", "value": "43641933ddaa0ddae33716c155e648ec6f7bff65167e265ebd81086204f6b725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025851, "uuid": "668029a3-ce0c-479d-a10b-0f0b2540a65d", "comment": "Malware payload (Smoke Loader)", "value": "b7823db4468f1ed80224fa2f9764679b07e5fee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025851, "uuid": "f124068a-e1e4-48ac-b6d0-c7dcf94ec608", "comment": "Malware payload (Smoke Loader)", "value": "a95023ca26c5338cb9c1a5f067c4aa19869bfa4232cfb0715ebf47312fe0b85d9415da3a14ce6a80a1be9c97dd94ae75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025851, "uuid": "d3dbce9b-7cc9-4774-8b7b-fd649999089f", "value": "T19D54D0127991CC33C41215B16468CBF26AAF653136B405473BAB3B6F1F7C2E2E67931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025851, "uuid": "4138cb29-12ea-49c8-83db-b6f5814da8ab", "value": "87441594d3de44f1a0456f0d6f52e874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025851, "uuid": "7603b6e2-71ce-489d-9321-7fb88253d92b", "value": "3072:mi5zI0AuLNV/2o/3xdvBe4kXvVr9BpZULcOgIkPTe4w:BxLNVr3qx9hHOgIkre4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025851, "uuid": "b76f1e6c-7ced-41e5-8887-c3c73fbc0c35", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025851, "uuid": "a61d5cde-d9e0-45e9-9007-11ea120470ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025851, "uuid": "765c41bb-f652-4f21-85b0-1df624d98eaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17166e7-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031034, "uuid": "7d064d2f-c1d0-4d5d-94f0-033cc82767cd", "comment": "Malware payload", "value": "8a9b92febed491814e5478cf3196e32f", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031034, "uuid": "080ef9c9-0b3e-4802-8bc7-522268e8d06a", "comment": "Malware payload", "value": "437b1e97c1de937f626823eff73fccc2e9fda0049935ba426b2fcb1b2f61a002", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031034, "uuid": "5ffd9b60-9773-4dcb-8887-38ead5f34604", "comment": "Malware payload", "value": "ffa14bfeade3039f461d9349a347a29075d69506", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031034, "uuid": "2dfb4ff9-eb04-4fb3-ac4e-c03ee6514536", "comment": "Malware payload", "value": "bf3b37370ba75b8fe8a57debd564a6725d0f85c370d383a6550ab9eb6570e03efc286bad871cbe31d4675c4d3a9e5c89", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031034, "uuid": "53017789-8f5b-4a90-9c38-38fc3e453d3d", "value": "T1FBD21A331D43FCD45FBA0D47F646B9800D8E3E5B83685EA8FE98085524A5616DF6E83C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031034, "uuid": "bf67290a-7195-48eb-afd6-2e38b807cb60", "value": "768:nRNzPxPpBD+MFzqLlmh09yDVQZvO9xIQPAx7rI5:nLtDxFakqyKZW9x9PAxfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031034, "uuid": "03803945-4c25-4f62-b4f3-b723e0d84201", "value": 29356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031034, "uuid": "378193da-84a6-44d8-8206-8539e9b7489f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031034, "uuid": "16f4bda1-0d60-48c5-83e2-b6904b8e3359", "value": "dll3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b339c6d3-29cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662020756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020756, "uuid": "bc245ff7-6d3d-4051-8574-cc3467017ff1", "comment": "Malware payload (Smoke Loader)", "value": "5198cb0399af9419efb648911a370003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020756, "uuid": "0d4f0d43-81ba-440c-8600-4ff78188b3b9", "comment": "Malware payload (Smoke Loader)", "value": "4422311a48777ead5428f0021a01cfe09fd8afad452320067baf1bb331b0df81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020756, "uuid": "af913934-3763-4867-a66c-b651b8bf9e65", "comment": "Malware payload (Smoke Loader)", "value": "86246271324e90dbb609a1fdc5c99ea8bb9f8c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020756, "uuid": "e6d026c8-769e-458d-9069-2b0b8c91db46", "comment": "Malware payload (Smoke Loader)", "value": "8d400c687c4fa714ac8971cf24220872358a9a8168a9f90f67b0e72c86d80d38204e3610497c48af75c716b2d3981a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020756, "uuid": "b97ccb7f-3b9a-4032-a08d-57239075da9f", "value": "T17254E002FE83C4B2C052D5719876DBD01ABFA4311611088727A9277E6FB07E28A7737E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020756, "uuid": "12170a72-fb6c-4f7e-a14b-a7be21d9811c", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020756, "uuid": "0c37ebb3-b3dc-4203-a082-b80ed9d82e19", "value": "3072:UfXpitV1PcOLNCi5r2oJiOOaaerQqvg7rV+ObyPelVacK97TGih:euLQijiLqgt+OWPebg93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020756, "uuid": "cedc2660-212e-4b52-83e2-d76167976113", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020756, "uuid": "7aa67194-452c-46db-bf8a-b1c51655c1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020756, "uuid": "89918377-5083-4ee6-b20b-68b9ec8df145", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9286330f-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662028432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028432, "uuid": "aa9150c8-8ea0-441d-af4f-d6936b34d5fb", "comment": "Malware payload (AgentTesla)", "value": "ebb8ebba542261bed13c5464a060d117", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028432, "uuid": "9c5845cc-5294-46f3-aab2-8a0602f53ea0", "comment": "Malware payload (AgentTesla)", "value": "445770605ada900e7c1912f5773fb9aa03ee9cc5a2b5807c9887b611f2793f91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028432, "uuid": "3b2c3972-9189-4efc-9ca5-ead5ad16c92d", "comment": "Malware payload (AgentTesla)", "value": "c5caebf243d0499de70680b8c4bbc0ee05599a30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028432, "uuid": "7dfd23c8-b809-4461-aede-de4ae0c122f1", "comment": "Malware payload (AgentTesla)", "value": "a7de74874f1d2c63784c7cc10ddb56e52cd6bd479574f67e202ece1ddd64c3a0c54ddae30cc4f12dc343ad9688c65fb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028432, "uuid": "7a396ca8-26b7-4b89-8e4a-fb3b3dadd9ae", "value": "T1F3251249A9C4C3B5F4271B7021B1F16486BEBE119671C6D9AFDFF2EC05B8B029217A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028432, "uuid": "f3739b59-e194-4b1b-aba6-dc22737dcf8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028432, "uuid": "d89b1101-d371-45df-a460-0a33cf25d901", "value": "24576:+Z5dXY+mzo3bv6BLdNuH6IwLWiu5D0ePUk:I5BlmzMCBLdNuaIhmePU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028432, "uuid": "006536b6-65c7-4f21-bf28-acaf7388dc7b", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028432, "uuid": "da1a515f-4b3f-4418-8bc5-cdfd5873edad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028432, "uuid": "578cef71-71df-43b2-b6f3-78fa5fc5c2cb", "value": "ebb8ebba542261bed13c5464a060d117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ce0817-2a00-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662041609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041609, "uuid": "f6485d53-68c4-4ca7-9090-0e2f49fe25d0", "comment": "Malware payload (Formbook)", "value": "f60b0ea182916e9455703286990b383a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041609, "uuid": "ec7dc759-6de0-4d0a-86f2-095c380e2bd4", "comment": "Malware payload (Formbook)", "value": "4576cd506ab4b77c1980727f782ae608e154cb21feacc745b5ad11a7bacaf20d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041609, "uuid": "6b5c0c63-7b54-4d78-96bb-debc584ea66f", "comment": "Malware payload (Formbook)", "value": "771d1085ba3dc78b0603349a952aa4a41055758a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041609, "uuid": "5b40220c-57a3-4935-a849-6c24cc344dc0", "comment": "Malware payload (Formbook)", "value": "bdcb2d4d6a71494aff7a3e7ea50a0dbf09d43331014cd07799dbf87f173805adeeb974a2e92bf33f19f88261fa7e9b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041609, "uuid": "c6e4c30a-ba49-4840-95c0-c79ce8a6f8ef", "value": "T1E4E4E02536FA1FA7EABD5BFDAAA0211443F8651B101FE3AC5ED270EF1966F444900E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041609, "uuid": "3d32c0bf-6b7e-479d-8e4f-3189ebb84b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041609, "uuid": "d47988e9-59db-4de8-83df-7a776822fb22", "value": "12288:RIS11R/5PvNm1lcba5Z5QYmOPQgPrNCCYWvToMLECp4vIv1z6n:JPvYvcbapAOPQgDNQvCpVtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662041609, "uuid": "23f43e91-e124-46d7-9f5c-f7910451a29b", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662041609, "uuid": "5a0f98ff-6d7d-4f5f-8bf9-460332d8d0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041609, "uuid": "f3d6b554-88c1-4114-a625-5784184bbfda", "value": "S74J3VmrLppqqUy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b97f35-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (PureCryptor)", "timestamp": 1662043798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043798, "uuid": "827729fe-c58a-46f0-ae1b-f4ee831c4268", "comment": "Malware payload (PureCryptor)", "value": "6967c6f2309812938dff5cdf51ed2643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCryptor", "colour": "#6E9CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043798, "uuid": "24fe5c56-9d65-4f8d-8b66-35ce44cefba7", "comment": "Malware payload (PureCryptor)", "value": "459402e839737411be96df513c2c48e83055fb1fb92f4773876275de2acb47bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCryptor", "colour": "#6E9CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043798, "uuid": "21a5b542-ae46-4461-b0dd-280449a3dec2", "comment": "Malware payload (PureCryptor)", "value": "0267d66f0045917cc526d92b38504e1fae43823f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCryptor", "colour": "#6E9CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043798, "uuid": "be3fd837-d6b7-4ef8-a64a-0942edd36ebd", "comment": "Malware payload (PureCryptor)", "value": "112a4a50ca2f356abd2ca93edffab7fba38d2219941569e22d55521e9a20306bbc1fc197e299cbdc823e9441df8277b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCryptor", "colour": "#6E9CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043798, "uuid": "be527288-4231-4ed8-b43a-ad9880d0b9dd", "value": "T17034E0326325C4ABE86D4F71943B262649E2DC929FF18E0AEF50B44F7D352C2D45F628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043798, "uuid": "263d6707-94ec-4a42-965d-5ebdb8ceb4b5", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043798, "uuid": "c10d1ec6-9353-4034-91b8-600cd0bb2fc8", "value": "3072:fNRCywDw1DiJkunVZWKsx8VTPIuVy8082adOd8NWxPrbWIupRq6Tu3KuH9bzj0h:fT4Dt+KsyVTQuVy808j/EP/+Tua2zS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043798, "uuid": "43a7a6d3-a22c-4efd-b102-d964f42d173c", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043798, "uuid": "98e0abf8-5610-4e48-a59a-f7aeab923735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043798, "uuid": "6d2c2bcd-dcaf-4a4c-8ffc-292d20a7441c", "value": "FEDEX #09111188811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4660a839-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032169, "uuid": "76ea4870-a3f9-43a7-82a8-e1edb41b15cd", "comment": "Malware payload (Mirai)", "value": "76c3fa364381add4e6ad4d2491e700e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032169, "uuid": "7c132168-1953-41a3-8ded-e524e68fcc66", "comment": "Malware payload (Mirai)", "value": "4751ced6a14255a1bdf886eb2c2a06164172f66594215c9378e4ed43abcfb474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032169, "uuid": "51ea3d82-93a0-4196-a1d9-43d284a570e1", "comment": "Malware payload (Mirai)", "value": "1a9ea6f38e42188769d663ab7b6197cd4c27f762", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032169, "uuid": "101fad09-1843-47fa-83d6-5b95e1524fbc", "comment": "Malware payload (Mirai)", "value": "fa3b4d163467e51b44ee95bfde53f8663dafc75d0f4f2cb24d0ba19bb9204b663cac97c393f088ccba89b652d71afd32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032169, "uuid": "eeda1120-d4e6-47c0-99f7-4179c41799de", "value": "T167230951B8C39A27C1E0237AF6AE958E332063E8E1DB3217DD214B107B9552F1CA7F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032169, "uuid": "ec9cb6a7-fe54-499e-892b-abadeed989f2", "value": "768:tGNlgqFAnAdHAj6KP++V4WnKVsKsd9aNf3Z3xXXD2SH0E0zbQf6zMg1dLOTmmAPI:kinAdHS6g++KWn1Ks65Z1h01daTmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032169, "uuid": "f0b56f6b-f191-4342-a105-97c0559e68ca", "value": 48340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032169, "uuid": "42788ed1-e187-4b36-8c8b-e3cd5a6394eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032169, "uuid": "54757427-bde7-4325-8506-79d49440fd99", "value": "76c3fa364381add4e6ad4d2491e700e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f2f788-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022156, "uuid": "67c546ed-8958-4dde-be43-212cbe2fb926", "comment": "Malware payload (AgentTesla)", "value": "3cea73c7495bb889a9cec7d65358b70f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022156, "uuid": "46e70bda-f376-4dbc-8dc9-93aa91954f1b", "comment": "Malware payload (AgentTesla)", "value": "47965318f00506a9ffa88f2ad722774a43021fcfaf95c6e1cf3daa6c92847824", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022156, "uuid": "63bf4f62-e5da-42d3-81b1-3b6dd26ab1d9", "comment": "Malware payload (AgentTesla)", "value": "699acfd0aba7590ef3dabb55070eb551bd4694ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022156, "uuid": "d8354772-3f1b-434c-a5f7-c110d9f47a2c", "comment": "Malware payload (AgentTesla)", "value": "685a13d3494d1cf4ac1972812fc6b7a20dc3f916a7685963c36d503e331ef7a6989a8bf073dd66618789ffb6783c0e5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022156, "uuid": "4e6c789a-97b3-492b-a48f-2458ea390ab1", "value": "T150A423AB0F020B1D3B8DCC1ACF0E99BB1797D50A7955E0DF352E5A1E7173D2B05098AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022156, "uuid": "c4d2887c-6ade-428e-9778-d4997536644e", "value": "12288:qejBfEkShnfrHYfUuG97cOWxPDFMYXvp5WfRAccA98:Bdc3rHYfjOWxB/XjWfRAcFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022156, "uuid": "bde8c280-fdf5-47d4-9e82-d93303eda9e7", "value": 450602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022156, "uuid": "3ee5ba43-0c0f-4e0f-9cc8-2209ad1993d3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022156, "uuid": "531d4386-aa1b-4b57-b906-c94e09fbcff2", "value": "Rem_09837653tee-30987635.WD.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19d45f2-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662022149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022149, "uuid": "3940f48c-ca33-4f11-a867-1e6ca3faa0e3", "comment": "Malware payload (RemcosRAT)", "value": "82b1ad836b2dc8d695abcb1fd4c70199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022149, "uuid": "9102c8d2-2050-4945-ac35-7691a2b98f30", "comment": "Malware payload (RemcosRAT)", "value": "4799c65c4548dde3a4a5f79b9e4ad364cf32d73f234b19926ee483b230dd8e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022149, "uuid": "eb3002af-348d-4d70-a953-2fc114e6cb4a", "comment": "Malware payload (RemcosRAT)", "value": "bf1c6295166ab46f86f79a47a17432c844d4db79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022149, "uuid": "f0e0f92f-5e15-4938-8b63-644c968acfe3", "comment": "Malware payload (RemcosRAT)", "value": "f7c5bf02d5ab8cb345e2b1661e4a104a3988407ded309ba118b01c94b1f2d14bc6a8f8c473ee8393437af4eb8cdcfdec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022149, "uuid": "6fcd9983-7883-4205-9ca5-ba724c120b85", "value": "T1CE42F894AB69DAE1C86206BE5CF75796176CF622D9069F1F39C8630B7C033564433B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022149, "uuid": "27129d08-3a70-4de7-b57b-6d0979448c4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022149, "uuid": "805fe2d3-7f48-442a-9af6-a8c8c2752b45", "value": "192:T+NGfsFTO9mJ486wVoPTRWLfiiLX2HS9yxSyrsRt8G3mSF6zN1m:T+agqUFvVoLRWziiay9ycyrsR2vZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022149, "uuid": "5ae42212-5112-4f5e-9386-176fe8281903", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022149, "uuid": "7b2a9bab-6a60-4546-8854-7785a70d6194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022149, "uuid": "8d6a7625-2583-4627-91c7-a0923213c265", "value": "ORDER No. 2210748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5201b2ec-29a6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662002983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002983, "uuid": "ef0b38f9-e524-4804-9fad-ebc9bde3c2a9", "comment": "Malware payload (RedLineStealer)", "value": "6b904b0047daa55ff703a2e8b9a9b1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002983, "uuid": "6e684a8f-23bb-4bbe-8881-0827d7bdc445", "comment": "Malware payload (RedLineStealer)", "value": "479a0ad3ffb8b00a030937613e4b771adff17964c737ab73be28c151bb15ba7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002983, "uuid": "1d4d4430-161c-4dc4-89c8-f5d30d1f2115", "comment": "Malware payload (RedLineStealer)", "value": "3dd210ac85c68c29c7a2efef29fd13340bdd059e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002983, "uuid": "ab0c40f6-f7fa-4b3d-96e9-1d700ad8eee9", "comment": "Malware payload (RedLineStealer)", "value": "68e90080b0f377fc7900fe800977f9489bf5627340a0f5627fe1cc41159f29d1e077b06d17dd1f9e0914b31bb95ac19a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002983, "uuid": "f1ab9884-bafe-4620-ad49-ac71e5a3608e", "value": "T1C8150249A988C7B6F0270F7011B1F12896BDBE15D271C2D86FCFF2E845E8F129617A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002983, "uuid": "fdf347e3-2875-4a81-98db-fffd640913de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002983, "uuid": "4696bcec-3e08-4321-96b4-1b1d73b12a2d", "value": "24576:pZ5HXos040JOMptmSOM52Wty1XY+mzo3bv:z5HXg4BSYSOS9tklmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662002983, "uuid": "a1495772-df41-42a6-b1f6-52ba2b388799", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662002983, "uuid": "d687beba-e78b-47cf-8e0f-2dbfe6ec7270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002983, "uuid": "65a57443-94cb-4405-9470-08a11e5423fb", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28905.19659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340dce6c-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662027844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027844, "uuid": "0a0a00dd-0676-46c8-b6f4-863a00db7ee4", "comment": "Malware payload (AgentTesla)", "value": "e53700565a7d5b6db8399dc1e0370d32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027844, "uuid": "234ed9a7-1e07-47ef-a53e-71cef236d4c1", "comment": "Malware payload (AgentTesla)", "value": "487565b6c8aa619ef5a997f36066013d4a3ebfc00a95b010cd6f5960a55d1be6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027844, "uuid": "f2fa7c16-a03c-467d-9505-7bf6c3bcbf5d", "comment": "Malware payload (AgentTesla)", "value": "5f5d92ac0ca381d5ebba534d66e410a66f2642f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027844, "uuid": "2ee4021f-cc7a-498a-873b-2c204009f824", "comment": "Malware payload (AgentTesla)", "value": "58039b98859b76dcd5bbb9d75bc42f97321e43b63ab5c65a0b744653ac49bfd3584e3c0a96b87251c568cca326eb2ff4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027844, "uuid": "93a0a6a2-27a1-453c-8078-5bddcf69a346", "value": "T110D46CAC759876FFC817D9729DA81DA4AA9324B7174F024B895315BCCD8C987EF080B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027844, "uuid": "0607f546-040e-40cd-869c-6d48bcb92e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027844, "uuid": "5a2d80a9-3781-4fa2-85c6-455d4a9e5357", "value": "12288:9prGnxNYOTf370rafZJpaz+kbMTGcjnhlylSx1EgGUcVmCo+JG7nMwco+5SnJ6ue:9pinYYfLgaf4z+koTGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027844, "uuid": "f3585c20-fbb2-4028-a335-f1baafb503a0", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027844, "uuid": "5b527034-3fde-4ab6-b5a9-73d95e6740c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027844, "uuid": "bd522dc0-591d-4176-8862-b8ee8a5be4d1", "value": "DHL-AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1f9bdc-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662023993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023993, "uuid": "29af8502-604a-44d7-93cb-a9530271521f", "comment": "Malware payload (Smoke Loader)", "value": "9c2b00e8e49fb3bc8884fb18d9791b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023993, "uuid": "598ed606-4935-447d-b1e7-d8840fc61cbd", "comment": "Malware payload (Smoke Loader)", "value": "49276d33aa77228248fbff2629d64424edc8ddfe0c5848e8b181aec1edc04a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023993, "uuid": "63bc4ae6-0344-46b7-8cdb-6ed096e90e8f", "comment": "Malware payload (Smoke Loader)", "value": "eace054e3da83e3d454c205a62aa3f036daeff0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023993, "uuid": "15a29553-3031-4e82-8cd0-0256f2b8eabf", "comment": "Malware payload (Smoke Loader)", "value": "bdc2a1120322af106cb97189e4b68c412fc2b9d36565f3d73338e5d3dd1c99282bead4c747007c99f5285cf47f9e74f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023993, "uuid": "27259feb-e016-4870-97e2-c602f77d88c2", "value": "T1FC54E026B9C3C773C91205B04475DB846BBF98312A7005977BBC166EAFF06E169B234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023993, "uuid": "d2a29c7e-8e9c-442d-b4da-d725d4db4940", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023993, "uuid": "0a504b9b-80c3-48ca-a40d-1ff814ee1344", "value": "3072:DdXkc8awHdDLo11xBr2o655/7AHZ2i9SFszpWelpqv7SdSVQ:NsL01e55/GZl9SizJbuS2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023993, "uuid": "4c5a58df-671c-4a6f-bdd8-cd9dc65fd48b", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023993, "uuid": "3913aa72-e60b-424e-bbab-32a8b43e994a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023993, "uuid": "dc427555-c27f-4275-b543-a425870a0b85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4207883a-2a18-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662051919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051919, "uuid": "bca920a3-11ba-430a-b210-9a0fe721639c", "comment": "Malware payload (Formbook)", "value": "f9e2d58e90d226da6efc803733290eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051919, "uuid": "2f414315-73fe-4fc3-bb4a-46309097745b", "comment": "Malware payload (Formbook)", "value": "49357eea6bdaa8334590e3cae0e14a265730944feef1792298bce6a13d7d54a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051919, "uuid": "cd75c7da-e6cb-4efd-afe1-83bbf96bdfc5", "comment": "Malware payload (Formbook)", "value": "23cec5b95f9394f831c258e5eb1cccf0969ed504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051919, "uuid": "02ceb22d-1dc5-4dfb-adab-1b1f8213f331", "comment": "Malware payload (Formbook)", "value": "0a92b7e73b542983ac9981343809fd3e9a89ede62c7ebb460c6f56094076b57f29ab9a1dc85b683c2ea15ba630a7d177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051919, "uuid": "3d845bb2-0a9a-4213-b359-73513aee115d", "value": "T1C405BF153B6BED13E37C53B6C1C2442453B0998BE25AE78F2FC521C61A12BE658C9B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051919, "uuid": "040b6ca2-363a-4c8d-996d-a8398064adf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051919, "uuid": "0f8f0675-dbac-4545-8d3a-ee8d40fd323e", "value": "12288:SlUfXB3JLsB1It11R/5PA6n0urE1P+o8OQoLd2grHhQVVEVh3dI6XApCJlXKXi+8:tB5ABCPV0uI1GttgrBLdIg5lXKAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662051919, "uuid": "a5a43494-2c32-45ed-a4e1-14e7acf60b14", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662051919, "uuid": "3fc5a4cf-3f04-46ca-a961-ef9a23abdfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051919, "uuid": "85d68a02-2315-4f05-a730-a276870db8e8", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e29088-29d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662023466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023466, "uuid": "4ac677e9-1fcd-45cd-871e-6a138051660e", "comment": "Malware payload (GuLoader)", "value": "eedad83a00236f6eefde743d34b521e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023466, "uuid": "a82bc32a-fc61-4089-a776-0443971e9d1d", "comment": "Malware payload (GuLoader)", "value": "4a154c182001eee1ef08c2ef4460065c80ae25cb2dce3d5a41f5ab06f8c9ff8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023466, "uuid": "70eb569c-c5ec-478f-b3b4-b0c180c59ebf", "comment": "Malware payload (GuLoader)", "value": "24a45907f4812c02b6a6d586f807871cfbe17fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023466, "uuid": "a616703d-a394-40b8-9e47-ad592cb7dcb7", "comment": "Malware payload (GuLoader)", "value": "614c09d5abdbd92b14e4c6a39c2d992ac63c5aea99d08f79f8ac9a0c7abc030013458e0a2d26318c779be4bb6ecd295f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023466, "uuid": "65f94baa-addf-4b54-abda-b437b3899971", "value": "T15AC3D011B5B0C597E1229BB2DD29C1F227627C22ECA5424B37E4BF1E3971542CE0B76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023466, "uuid": "ed485e05-7008-4b3b-bdd1-c180ecf11e56", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023466, "uuid": "9d6629b4-557d-4937-a76d-9d2ba5e5e9a0", "value": "3072:WuxVUg3yGDRb8lc7uxRhYDpJ/bLTNEDEIbOaL:JgORaBTYzmDrOaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023466, "uuid": "a2ca026e-dbf8-47f8-b881-98388638a24c", "value": 126531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023466, "uuid": "8e86e1a6-82ae-4d8c-ac37-5f02ede62fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023466, "uuid": "8ee731c9-fb61-4149-a367-ffe055adfbc8", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.10313.11057.8394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37a9ba2-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031171, "uuid": "33d492e9-b401-429b-9d24-d330789f2009", "comment": "Malware payload", "value": "8c43231ec38ef82c5e665a0555eaf512", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031171, "uuid": "48315601-2c40-49d5-a7ed-70d9561b4848", "comment": "Malware payload", "value": "4a2069df3c553d7018ba774b8159a07d2f68e1d3d13079fdbf93045394f7b2f4", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031171, "uuid": "02542912-b298-4662-b7e4-91c9ff6376ff", "comment": "Malware payload", "value": "8c8eca9534abcfcfae8987ec6f93c14c6364c188", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031171, "uuid": "f2de80cd-9e91-4596-a859-202df4740163", "comment": "Malware payload", "value": "9f1d563c1d2d4cf8364d3f396bab3841356b131d5ca1cbb7678a6b92103d61e3bed600324ba3532dd371ebe80563f6db", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031171, "uuid": "6cff65dc-045b-4838-9015-237eef2beaee", "value": "T131935CF60617AD9F8A5B0E45E41C1300DC6CA8BBB3D894B8FF895AD15AD941CCCB4DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031171, "uuid": "65a84457-e8f1-4155-8432-762287b17e0b", "value": "1536:cUTP5/ZTfCnau2UsDlhr/Xmmh2LCCivec6lArBxGjo84tvqPLLN:jTP5xzpu2UsDfrv7mrivAUG0Dtv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031171, "uuid": "0777a9cf-77bf-4929-ab29-b5886780c042", "value": 89432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031171, "uuid": "e41db8c0-333c-43d1-9429-1478d5927ba5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031171, "uuid": "b7d9ea2a-b8d8-46b7-86ba-66c27fd6f2ab", "value": "AR1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc0c0ea-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030950, "uuid": "b93dacf2-a610-4f3b-97f7-49b498c3f018", "comment": "Malware payload", "value": "508391baf8f55d9b2fd8ecac8ae69b2b", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030950, "uuid": "52cc345f-8886-4fd9-9be8-c8799f5917da", "comment": "Malware payload", "value": "4c532165e4486620f28ba596fb606ad9fdb61c83d120b7fa85c19e34643ee0d9", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030950, "uuid": "c385de5d-9f24-48cc-b869-bc0645ccd66c", "comment": "Malware payload", "value": "2d907c73f151d96de27124b0a78be2cd39c505b8", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030950, "uuid": "fe22d657-9339-44e1-aa1e-b0d76ab34473", "comment": "Malware payload", "value": "0a2a285e36ad4887cb88eda23a7f829708b3db14ca5793a876890f6f980240279c7e86f25222a9b7dafa96d645d5746e", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030950, "uuid": "c6204182-a186-4a13-b4e4-7450b3fb7a79", "value": "T13EC353F99A171A9F401A0E28E50D43146CECDD6BE3EAD1F1DF0F4DB6AE5981408B1E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030950, "uuid": "8e2dbac3-a4d9-407f-b762-43e3527dacd6", "value": "3072:Ql2JwGaZukWFQC88X/FZDEznVQ2jomrMZ2cZbUXyRjBjJst8EBMV+vaYM:sHZvWyd8tEznrMZ2cFUiVBjGZaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030950, "uuid": "2e4394ee-1e1f-4999-ba55-c04e263d13a0", "value": 123564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030950, "uuid": "c7fc407c-ac6d-4d62-96ab-c83d06f0b196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030950, "uuid": "b9279c8f-bcc5-4dcd-a2a7-89a17be1ab17", "value": "ARH2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f19de0-2a0c-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662047016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047016, "uuid": "b04ec0e5-87a5-42c6-abae-7d3e33a945ad", "comment": "Malware payload (GuLoader)", "value": "a706893ba2baf6a1fe3cde067f294c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047016, "uuid": "8f57ad14-c68c-403e-9f2f-762cd7cb0fba", "comment": "Malware payload (GuLoader)", "value": "4ce12b9469b0b46eb73e2bb8f409d4156675de487f2bdc553262d0aaa5e47cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047016, "uuid": "ed429979-f313-4128-84d6-697c4de44293", "comment": "Malware payload (GuLoader)", "value": "f407fedd9f2a014a8568da1dd0048ab8be5d809b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047016, "uuid": "b3da4116-d17a-42b8-a809-8b0ef0e4e7d8", "comment": "Malware payload (GuLoader)", "value": "a5ecdb3455908a188a7b869305b676eed0191834fe1ef5e04b66372536a8df377bbfc1625ee7117ffe314eaf087e1e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047016, "uuid": "c652e855-d8a9-4e97-a910-6393e721e819", "value": "T190C3D002B161C653E0654AB28C7989FD6BB6BC1AD8A4470B3354BF1E3E35352C60F3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047016, "uuid": "45ba00e9-2f3b-4440-8c60-e9100f4f32fb", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047016, "uuid": "3ccad40f-a77a-4bd4-8c6e-2475f57e41cd", "value": "3072:WuxVUg3yGDRb8lc7uiWS9a/gFo1+njIbVMUC:JgORaSg/gFoBil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662047016, "uuid": "27705b67-886f-4932-b2ff-a7f53f90e461", "value": 126544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662047016, "uuid": "31e92394-3e0e-4079-808f-5ad3a390ccfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047016, "uuid": "97216bc0-834a-44eb-8c7a-477d6ed79d05", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.10313.26457.31031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a8e3ec-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662039872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039872, "uuid": "b7b28930-84a7-4164-bfe5-579ab3e8780f", "comment": "Malware payload (Mirai)", "value": "023d58b49365af1553dd893c8facc3f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039872, "uuid": "d7b0d0e6-0a11-4bfa-ad7d-80881dddafd7", "comment": "Malware payload (Mirai)", "value": "4ce9e0d53fece336c61ff29313c47d55a0327e78c7e2e6ca8b1429069246fc9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039872, "uuid": "80a4641b-0468-4337-b710-c97788c06f32", "comment": "Malware payload (Mirai)", "value": "8e2cb50b230b6b01ca2638e8c341a769a622afe7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039872, "uuid": "f0a45513-6e10-4346-9b9f-eded0befff15", "comment": "Malware payload (Mirai)", "value": "58e3144567e16c301ee8ed9c9b64de01df38120bd10117575c6c20750c6fd7343269bc84eef15de5b4d9d37144648ab4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039872, "uuid": "36cfdbda-79ee-4419-b09c-34946c3c1f5d", "value": "T1F3C2D027032049DACAFEC47593447B522B740BF2A943AC11A1ACE6D74DEE63574C25E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039872, "uuid": "425d5a4a-9c1a-4d93-aa69-cfb5f38deeb6", "value": "768:7rdymOcfIyUthSyVjMxdefgaXfJgGlzDpbuR1JM:XvORptJaEldVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039872, "uuid": "05a0f42e-147f-428f-aaef-9a609b2fd927", "value": 26084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039872, "uuid": "f252a4bc-0d73-4d0a-91df-94d79ea80c89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039872, "uuid": "00e91eef-c0b9-477a-83d5-a2c040d72210", "value": "yakov.mips-20220901-1344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4991b56-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662007121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007121, "uuid": "9c664a6f-dfa9-4f5d-842b-49058b5b4884", "comment": "Malware payload (Formbook)", "value": "2157c6493f6126d3cd077adf842e2515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007121, "uuid": "66a293bd-26ba-45f2-beea-de693cd687f9", "comment": "Malware payload (Formbook)", "value": "4cece430fe47c584014f22676866c0b4328d878aae3856b544bc11a9ae308b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007121, "uuid": "6f390858-3180-4663-ac00-65cb455f2333", "comment": "Malware payload (Formbook)", "value": "5eb54435c52d56ee577c84b6b17518c2aadd93f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007121, "uuid": "f944b67f-7a97-405d-a658-cd6f2f4984f3", "comment": "Malware payload (Formbook)", "value": "dac248c3fbbc735b2a7d17fcbb29a527c0b164bcc1035f0354a931eede402341ab8f8cfafb7fd7f8a383bf3b41365ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007121, "uuid": "8bd0580f-5d2a-47ea-be2d-e5f389bdad72", "value": "T140E4129063A92B16D8F65BF3107E94435B753E62AC81E94E5CD432EE4D32B1CA702F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007121, "uuid": "9cd7558a-bf99-4ccf-aae3-32761ba3616b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007121, "uuid": "d0dfd655-5de9-48af-84a7-81a00a20e935", "value": "12288:+/LMFu3XDG2blC7+xmxNZwKx6iB9xIfa3FI3shWuov3IMsY76z:+/LxG2RhYxPzafkI3sJovT6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662007121, "uuid": "7ed07541-ad50-499f-85d0-c7650630fc42", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662007121, "uuid": "19e91038-67d9-4eec-9e53-61c99b52c543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007121, "uuid": "6cd0b379-6c7c-4f16-90f3-92951927ebea", "value": "New Inquiry Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a27de2b-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662027827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027827, "uuid": "51b5fbf9-467e-427c-b0d8-719135ebb96f", "comment": "Malware payload (Formbook)", "value": "e87fa090ca686679fb226033133aad8b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027827, "uuid": "f07ccc0a-3574-4453-88c4-1cbca72c166e", "comment": "Malware payload (Formbook)", "value": "4dedd48971ab795ed071cb84b38f894f1844c5f2f05ec08b3fd693b7d906bf20", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027827, "uuid": "9b868b93-3768-401f-a98e-fce40688f996", "comment": "Malware payload (Formbook)", "value": "6fff79fea950e49e6856bc207f7626d62c6934fa", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027827, "uuid": "8e607ae8-9179-4175-bd52-3e1935e9679e", "comment": "Malware payload (Formbook)", "value": "cf888e850eed5eccb4f2cedd432f2f158b006e923c48b493988f4f145564d62913b5395e85af93652721b2cbbcb64af4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027827, "uuid": "0c3a609a-91f1-4e87-a439-32459f1bdba7", "value": "T1C374E041D3E60993C94FAD3DA50B5BB312E1930B7B97075E7488A35B3CCA2C66782E85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027827, "uuid": "a24fc2dd-0edd-4036-883a-6c513477c078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027827, "uuid": "171c6be3-34a7-4f76-8435-536f25606b8f", "value": "6144:xFqhs13ZirPzkbs2RzhDF4a46VCVdKrLNmjBPQy0SoJ8L:2yq8rRlDZ4mCi/cyHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027827, "uuid": "ebd1eef3-a9c5-425f-a7d5-7bbb1ba9fb7e", "value": 358680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027827, "uuid": "92c4f15b-2e9a-438c-9d2a-699d6f075993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027827, "uuid": "a8d36e23-9b56-4474-ae49-769d842873d7", "value": "DHL Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb1ca1d-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049065, "uuid": "476500c1-6c2e-4a54-8ad9-94a071665325", "comment": "Malware payload (Mirai)", "value": "1fe311a1de580db71693c438e91b4f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049065, "uuid": "978f8f79-0d2a-4868-914f-b06f4c2e6d7c", "comment": "Malware payload (Mirai)", "value": "4e6595928aa266c451da9786cc4d8a1866d0226fee77e417cce2a1ddd0ddf871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049065, "uuid": "cbf4871d-de44-4b8e-b0e6-a405631a57d8", "comment": "Malware payload (Mirai)", "value": "596f14983be4608a60006c236b3c3850b941ea70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049065, "uuid": "8636a47f-1fcc-40f2-9fc6-3e5454beed20", "comment": "Malware payload (Mirai)", "value": "2f17f900957eeafc10e8b9a6bbb0545a0b91ebbc7be82c598c38c8792551e1ec38ecc508ad92b172ad695a68a8c8a751", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049065, "uuid": "47f14046-ada1-4ab8-9efa-2ddd43ce3ae4", "value": "T1CE63B61E2E219FBCFB6C873547B78E219758339626E1D581E19CE9005F7034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049065, "uuid": "edf23017-cf2f-484f-b986-45ee638ee865", "value": "1536:JhGgv2Q14L2ub4EwotI2pICkZAfc535Fj0gRmQO:Ogv514K4ztI2pFAHj0g8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049065, "uuid": "ecf92c16-7f37-47f7-a11a-40a5374a5715", "value": 68456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049065, "uuid": "5c97cc51-3be4-45af-9bbf-142670b17c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049065, "uuid": "4f108170-4126-4b1a-a05a-abc4af219861", "value": "1fe311a1de580db71693c438e91b4f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8257fd-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014495, "uuid": "7c92d6d1-9a23-4ecb-9cac-1676b1ef17f9", "comment": "Malware payload (Gafgyt)", "value": "62b7ad4857f644d2af893161d876e7ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014495, "uuid": "d0f9c388-d653-4d8e-8466-ba442a1b90d1", "comment": "Malware payload (Gafgyt)", "value": "4e6bfd133e9234eda902428a02b8ff133042518ce51ad6adde845829932783a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014495, "uuid": "12c49a0e-c59c-4ab5-a45f-1118d303eee7", "comment": "Malware payload (Gafgyt)", "value": "d8a1fb7f5b75fd814a656d38816cb0dddba3ca94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014495, "uuid": "13ec9777-796c-45b3-978e-31626944b27b", "comment": "Malware payload (Gafgyt)", "value": "b567863c2b3ee06f8c208503c993fc010cf5a3a99f8a0539d6e7e74d3e01d7b6f8c4ff4e28fcd0f8bee7e416997794b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014495, "uuid": "61d31587-47c9-492a-85f5-8b4affffe604", "value": "T129B3C517AB618FB7C85FCE3306AA850120CDA55612E97B2FB2B4D92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014495, "uuid": "f8a92637-fb28-43d1-9989-d4c60942ee5b", "value": "1536:ZLeTukthhSMOCMQS+ZjN4pjuIxreg2OstWklwUmkiSFxfC7xbXe:ZRHC3S+dUreFtnwUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014495, "uuid": "1422c6ac-41b8-4724-9df6-c6239b56c2d9", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014495, "uuid": "45cadb91-2097-4305-998f-0e73edd0c27b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014495, "uuid": "36c61324-13fd-4b9b-a0d3-e68e67b88856", "value": "62b7ad4857f644d2af893161d876e7ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5a8a95-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662027800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027800, "uuid": "481db5d7-435b-4cd3-9d41-a14e687c8714", "comment": "Malware payload (Formbook)", "value": "97f5235127d985bff0343659972ee0bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027800, "uuid": "38353d35-7d05-446d-8975-82f035f6d1bd", "comment": "Malware payload (Formbook)", "value": "4e6edc2171798a1acf95f1fdc4060c60df53316681e19d703d197a4063eb5c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027800, "uuid": "45b8677e-ad2a-460d-b289-93e14bf0ce9d", "comment": "Malware payload (Formbook)", "value": "64a3ec0d7a27d2cad041f2ce87a44fba12582321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027800, "uuid": "24b77895-8141-47e5-972f-5cba40dcb86b", "comment": "Malware payload (Formbook)", "value": "dc691e23998ac74d14365fd2c76ecb8855489ba4a5f55203612a8a61d708631132230e95ee74433fb33644a1bfd45de7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027800, "uuid": "95545676-eacf-46ba-becb-3bbc2317d0ec", "value": "T168E48DAC755836FEC827D932DDA81D64AA9224B7174F024B895315BCCECC987EF180B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027800, "uuid": "3bdb4d2a-e2f7-4f19-8d50-fa1a1f1db0f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027800, "uuid": "bea10782-269d-4762-9be9-d699c024e3c5", "value": "12288:VWQ77CtO7fbIrj784nAWdvpmQMJJBaE1v9lylSx1ZEnbpuSjfrYcwZ0YhICY0f:VlnJTSj78pSpmQMJ/aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027800, "uuid": "4950a54f-0794-4cff-8828-a026c81ce7b7", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027800, "uuid": "70d32e4e-4b34-4c04-8d08-091cb72c9ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027800, "uuid": "137944ec-4a64-49b8-94ac-5d7f2fd824af", "value": "TNT Shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bd50d8-2a14-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662050268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050268, "uuid": "31d74203-925a-4817-9a52-d80e83e8a9fb", "comment": "Malware payload (IcedID)", "value": "db4e84cc61a5435c29c0d464570e2e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050268, "uuid": "2c8d10c2-3883-47e6-a9dd-f8dbba735bf1", "comment": "Malware payload (IcedID)", "value": "4ed8f43ba4289ed2e69b6055f5f8f66ec7910e72120895baff71dd6c57a6ca6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050268, "uuid": "c4ab1dd9-07f7-403b-9a37-06efd8bcc0c7", "comment": "Malware payload (IcedID)", "value": "4f25dfe43765ce3e95bc4ce28db5225a1f43a888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050268, "uuid": "924bb504-0e3d-45e8-81de-b5665b663408", "comment": "Malware payload (IcedID)", "value": "0ad60109538cb39c9ac2ecaf17d50e3caa8bd66eda8bcbeeafc67e4e3bff56a0ac28c1832a638726b8f8eae8e7691020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050268, "uuid": "101bae85-6ebe-40de-bd27-3122ef2252b4", "value": "T1657419DDF255B4BAC2666775C12F5909A23C28F2764CBC80D99A84D81E341B93263FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050268, "uuid": "4e133aa5-8822-4d2e-b7bb-8e674f5aeafa", "value": "68cb9eca6e860ada0621fd925dc693e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050268, "uuid": "1c3a62b7-34b8-4fe4-9783-75a393a04c82", "value": "6144:pryu2FszVI4r750Vk6HQL5Y0jHwNKa/PY3RuJGsv:NyTmKUN5i4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050268, "uuid": "3529fff7-2dd1-462b-9702-9b3199940685", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050268, "uuid": "a6b4fe2b-7de1-4351-884e-7bb1c1610179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050268, "uuid": "d78baa96-3077-48c6-b25c-7d7018e13130", "value": "screening.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677620cd-29ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662033943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033943, "uuid": "8fbbea3d-d905-47fb-9a47-259fcb807558", "comment": "Malware payload", "value": "d114ab7cdf87377d68c6f833da5f5eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033943, "uuid": "53af30f3-296e-4dfc-8698-521a201dc2ad", "comment": "Malware payload", "value": "4ede89d604d103ccbd2f639499bae14227ba7fc5c78b5157173eee424c7898d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033943, "uuid": "da14bd41-1f06-40fa-9218-cd2a61900a76", "comment": "Malware payload", "value": "1951ce1a5dbbd13f3efd580264fd903fd716ac62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033943, "uuid": "99c7cf12-f6ef-435f-bf3e-d10d0b24153b", "comment": "Malware payload", "value": "77d19e88d6acea88016c606371ee7e5cba9dcb007982ba6d3f53596d11f3469f056dc11397cc46cb014719b0183bde46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033943, "uuid": "4b87652b-bc38-417a-8e50-f8cc486d683b", "value": "T178E533881F8289A3D896417074476AB73ED1CC31A3A07EF3ABCD251DBC61362FDA49D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033943, "uuid": "e74d7479-0007-4331-a618-3115dcca8366", "value": "efa5f35372e4d62ace30c793506bd914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033943, "uuid": "1d65bf7a-df5b-4b02-ba84-eb30a6f6adaf", "value": "49152:LUd8g4X/jCb21UhH35rTHhrnwtGVyaB3C1CvEqm+eYIDNVU16j/dbr4imHHXNv/k:4d8/XrU21ArTJnXVyoIqcYAK4MicHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662033943, "uuid": "5c406ed8-29ab-4e43-8827-5cc39c9bd8ea", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662033943, "uuid": "b16dd5d4-15d0-4602-ae21-256563b94258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033943, "uuid": "8f32a11a-d40f-4b2c-9611-6ebe6510e6e4", "value": "4ede89d604d103ccbd2f639499bae14227ba7fc5c78b5157173eee424c7898d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0477476-2a22-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662056372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056372, "uuid": "78bde1e3-1cdc-4d4e-8f13-46d950e1042f", "comment": "Malware payload", "value": "7e17838c3dd3e0601be15ea091b7debd", "object_relation": "md5", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056372, "uuid": "60b33c88-1a4c-4a1c-b9d6-9832fd4b63d0", "comment": "Malware payload", "value": "4f5ad0439562b425d959309c4e8be09bc6f483c284afb155fca41af46e4b06be", "object_relation": "sha256", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056372, "uuid": "4d3f23b3-eae7-4a09-95fa-d3d9323c1d35", "comment": "Malware payload", "value": "f75285b37a82c54614c5bbadc055835cf805e547", "object_relation": "sha1", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056372, "uuid": "fccd81bf-0371-4dc5-a2e0-640b92c99792", "comment": "Malware payload", "value": "e3f52b3f2e09b801537ae85d10beb3ce78b0e280a152d5d35aaabe4b80b2d90e8ce880b17ab8d5b4072b1f80405c6fb2", "object_relation": "sha3-384", "Tag": [ { "name": "3021898880", "colour": "#5D278F", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056372, "uuid": "778a8051-ef89-4bc2-9ea5-beaeb8af955c", "value": "T185A42B99B686717AC3672375C26F4909A23C24E2764CBC40F9AD44D82F355BD3263F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056372, "uuid": "d00ea726-a9bc-46ff-9456-b0e68f3b13f4", "value": "6144:vJlgiryu2FszVIAr750Vk6HQL5Y0jHwNKa/PY3RuJGsAF7OmC+Jvs/upoxM:vnyTmKcN5i4b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662056372, "uuid": "0312b4fd-7d15-443c-884b-a7c62aa92531", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662056372, "uuid": "5364390b-762c-4f45-8e74-949305151125", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056372, "uuid": "50c5ce9d-9410-47e5-a41a-fb84db8b5468", "value": "Invoice_september_01#0023.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb53f09-29dc-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662026086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026086, "uuid": "2051bb43-93d1-4344-845b-1b51d60808f1", "comment": "Malware payload (SnakeKeylogger)", "value": "1845a776b4efccddfdb167a04de94141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026086, "uuid": "22ce9682-140f-4c67-8c29-5ab2f8dfe8a9", "comment": "Malware payload (SnakeKeylogger)", "value": "4fa89634eb4cec2d104fb6e4fe4d2a366c2c0439245d31827c8e487bde065a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026086, "uuid": "893af887-a412-44f7-821e-9c890ebd8af8", "comment": "Malware payload (SnakeKeylogger)", "value": "826d2c3c357bd04bb42460ea9f747dd90ee99354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026086, "uuid": "ffc0bb89-67a0-4bdb-b252-6a9ea282b503", "comment": "Malware payload (SnakeKeylogger)", "value": "e8a67b6c8b6725950352df0245932a5830b89366df517380e23a74c90c2d812ca0d674adb71dd42223cfc11b14610e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026086, "uuid": "e7980b2b-a3a6-43ee-921b-7f1a795e03e8", "value": "T12F2512AA7268DF11C2503571C5DF902803F9AD83A272D7947F9E72CA89517E64C0ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026086, "uuid": "f1aec3cc-6a77-4e18-bb65-4d0fc0be1bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026086, "uuid": "d370355f-630c-4b85-bdef-3623ebda95f4", "value": "24576:PorWPbg7TXSb55Ft4OJFxB/2RJrLq2SYERAALaAVVW:Meb5+AWJUNRA4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662026086, "uuid": "a2eaf561-4d3f-48cf-bbcc-dd071cb4915c", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662026086, "uuid": "3323620c-4c42-4a7a-b265-ecc8cf48c4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026086, "uuid": "56576764-93ef-4a3f-a758-bf2d8c5ceebb", "value": "P.O 0109342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfb80b7-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662028286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028286, "uuid": "77d48d2a-d338-4e26-89aa-d63bd11eb77e", "comment": "Malware payload", "value": "e1472a293c0aa4f09e5311170c806fcf", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028286, "uuid": "8088ac3c-2bf0-4ced-8247-30b93e89f005", "comment": "Malware payload", "value": "4feb4c7e07e5e584bc072b9aaf152c0e8884d0554a6464731492784a085326aa", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028286, "uuid": "5f2caba0-3d58-411a-9375-b1da11ded878", "comment": "Malware payload", "value": "03ee0235b9a5d0062fb03abe992e70141509f6f1", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028286, "uuid": "d6fe28c3-cf8c-4c6b-9753-96fb39d5ef94", "comment": "Malware payload", "value": "fe172d638a655076321287cdc1cd2f045994b65a879d652a5da2d01b456d1570d486893ec9e078678092ae1f9b651fbf", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028286, "uuid": "6d1b8d72-65e3-40c5-89e5-7526b681081a", "value": "T1E8A63344096F6FC7CA94DCB144699B92C20A2CF5C9D8FE4A4B3AC2E65C2B01D5DFB1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028286, "uuid": "7c779f57-71ac-44a9-b29c-a0e82079a67a", "value": "196608:rcpYOZHbDxSxw827V06/asm5pF22tRRKIbBnxVhAcBOhQ:w97l+wth/asgpF1wKBnxDYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028286, "uuid": "6ef7e090-b8a9-482a-9390-dcae021e78b4", "value": 10131774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028286, "uuid": "bd5ddefd-f14d-4507-82bd-8d5dca83a34d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028286, "uuid": "f0bd48b1-3fa1-4722-831d-f6d13ebb682a", "value": "ibra31_out.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07753885-2a23-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662056545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056545, "uuid": "4d7f86cd-6891-4eb5-8943-3ad3756317ca", "comment": "Malware payload", "value": "d297a81eceb5cf19597076a3a14de680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056545, "uuid": "b0410ab2-c587-43e5-8889-9ffaa917d6d0", "comment": "Malware payload", "value": "50abc4dc4a5a0e8f384e113a51cb098ec0df1bd39614eb2f3cdb5e038396adff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056545, "uuid": "3d2b26b8-2cf1-4f30-8d66-0df789449b1f", "comment": "Malware payload", "value": "32efa89ccbad86ba58d6ce49e22b706058c2fc03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056545, "uuid": "53ffa91c-910e-49e8-9af1-5a9d137804cc", "comment": "Malware payload", "value": "574de081a05f2188b8e5e22779ac3ef1d0b90ba03c3dfbd24f49c2b6d7a8ae6fee94635e4a3e62a5b67891cf55e54c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056545, "uuid": "091b2674-f03b-4628-9928-3d26a5c4b69f", "value": "T19F05C1532BE0AB21C27D33BA31447970B3E5F4D68A61C787AA4CD0DE3B776426BD8542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056545, "uuid": "c10b7a52-74fd-4382-8c6c-3b1f7c1dd8ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056545, "uuid": "20685afd-02fa-4ed4-bc50-116b523b056f", "value": "12288:qI+y6f0NAnD4mPyhTLeb9h7f001mWfFVVq3I5y:ef0NGPPkn/SFVVq3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662056545, "uuid": "c5d01417-1fe7-4e0b-8ebb-42aeddd93649", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662056545, "uuid": "466a7881-1208-434f-bcf7-0ad9be1521c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056545, "uuid": "159b0adb-a300-4eec-accb-280c252a75eb", "value": "SN_094876546-3098763673893873893--.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2be9ed-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662027080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027080, "uuid": "b3a2e3a2-9774-4649-b069-64aa29d8f9a8", "comment": "Malware payload", "value": "780252b0b66c6581034dccaa7a57c5ba", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027080, "uuid": "85615375-5474-4ec7-a06f-a086506c3c6d", "comment": "Malware payload", "value": "51d2c4de175d11254fb26186238ac3c68a858cdaefa668e1a18a05bf749cad78", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027080, "uuid": "7ff4c0a3-5103-42ac-827e-c4e60e5f9a4e", "comment": "Malware payload", "value": "a14e4c4c59d2ab8317b5956ee1ba0ce15eb449fa", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027080, "uuid": "c52d78eb-6b0f-475f-967e-42ec11de50ec", "comment": "Malware payload", "value": "4dce169e6e519b63564b5cda627e04bd960d2f0746de9c51236504259f4115e0710eeb045eff1ef5b789f6509ac07e72", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027080, "uuid": "cf8ce4a4-6490-429d-8200-b8dafc87352a", "value": "T1EB26125921264BC3FEDBD830DD9E4785F6410AFC82B85ABF63ED12C6858FA9434B3491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027080, "uuid": "6d5cc012-3bf7-4d97-9599-145306ee24f6", "value": "98304:OzyB3l0gecxM2mEcSFQw5d6U+dREeYYuQlQFaT3kmQSw:OeVuBKMWciQw5wdTxuQOFA0jSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027080, "uuid": "eb2177c6-47f3-48fb-8ace-924630dc4f77", "value": 4829325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027080, "uuid": "af1f1614-987a-41b7-bb40-1a2db127688c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027080, "uuid": "51bc2ecc-9b0d-4ace-969c-628de9de0627", "value": "Archivo.EndesaFactur010922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bbecdd-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030173, "uuid": "0572f089-ebb4-4799-b728-d5fb60c1345d", "comment": "Malware payload", "value": "e43889e785ad02844432fa9645f3418d", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030173, "uuid": "48eceb2e-b0e3-4c8f-b54a-bdd3f82e41a8", "comment": "Malware payload", "value": "51d53ca36a662b4aad5878987548f0f22f2a53545790577d8043373b6bf7eb75", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030173, "uuid": "e16cf8ef-8e96-41b1-bb3e-07ce3b900474", "comment": "Malware payload", "value": "a3fb8856ec6ec662e09206e3a9b8a2a93af69bcf", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030173, "uuid": "1de9f362-121e-4d7e-af9e-3031359cc970", "comment": "Malware payload", "value": "ddca973c1d8f2008ee93e0f525f41df20952a71734f836305d67136278f82f37f5b14dbdfc17a507c3c9c90df0e77dff", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030173, "uuid": "0dfbf3d1-6913-4713-a63e-b6e0b2b43640", "value": "T1A831260432EE0721D371AC377C7DE30555B27822AE238BAE22A4D289B555840D939B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030173, "uuid": "11d0fdd0-e8e6-45f4-8085-1f842b767238", "value": "24:824o0LxnVzHo0fwjVuWAbMlfdLqkdcH8X7Z8i9CNO:8JoQxJoZjjA4fdescSZyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030173, "uuid": "f030a1c8-6329-4217-83ce-30fe9a3f63fa", "value": 1533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030173, "uuid": "10c6a553-2b21-4bff-bcc5-0451845daba1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030173, "uuid": "72e5a51a-465e-4620-93fd-c1be86df0a3c", "value": "Password txt lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc84b50-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030892, "uuid": "fad699be-1f17-484d-aa4b-bc28e5fe799b", "comment": "Malware payload", "value": "b00866e8441f10a03f05074c5274c288", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030892, "uuid": "b3ee91d7-88c8-4561-a86a-d75c3d46fe52", "comment": "Malware payload", "value": "51fa3fa28b7904d2a4ac1fde96010c898df42d1999ba99f01738d280bd7a3e15", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030892, "uuid": "0240b1c4-e432-43c6-8fd5-9b70bd37b350", "comment": "Malware payload", "value": "6310ce9ab6a4f28d2ae7ac40ef7f6ffd2789d483", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030892, "uuid": "3bcdc39e-a17d-4e4d-8286-a1335ef56799", "comment": "Malware payload", "value": "c1dbcf583b53688ad1bdcac21bde07acb03ae9b411260d24e016c15fd61be21f323c5e7d7d37a973e2e0c6955729a158", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030892, "uuid": "e725109c-c495-44aa-b798-79983fb82794", "value": "T178D4A0B95294AC9F0F1C0E66F808174B5C5D48D7F6B8C2B87A82B4F886591A44FFCDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030892, "uuid": "a2ae471d-af40-4e4d-b95c-674451e9b5cd", "value": "12288:BJk6/3dpFNXXd3J8VMA2+G2/jS2roN/ASHH:BJhvFNxKeEG2/jSso9BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030892, "uuid": "ab1f08b3-2f59-4fb8-a6be-e10ebf06a122", "value": 633516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030892, "uuid": "be4e6b55-cdd3-4784-8d26-58e4c0d0aad1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030892, "uuid": "81b532a5-4649-47a3-b21b-6e5a8e1109d1", "value": "R.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d8ddb5-29eb-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662032834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032834, "uuid": "52282257-c27f-4e3a-9243-fc7fb535ed96", "comment": "Malware payload (RedLineStealer)", "value": "76000a1a15850fcaa06877e21f7eb348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032834, "uuid": "0c463982-4d61-44f8-84f3-dab620143219", "comment": "Malware payload (RedLineStealer)", "value": "52558d772708fed5fea4982d2f5ed377d47d1e4f9bc6d04a10a75817887fdf01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032834, "uuid": "01e093f5-16e4-48ec-87a5-257e3b452de1", "comment": "Malware payload (RedLineStealer)", "value": "755f0dbecf5ef2868270d34ced20213a4d5137c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032834, "uuid": "73eb59e9-3f3e-4bba-9ff3-c6d5e4218373", "comment": "Malware payload (RedLineStealer)", "value": "f781331dda75b6b42144cfde8473b4daa30f881abda07268b69998b6943e6355f106d6d750cf6269bce4fd71d093364e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032834, "uuid": "26f0592b-82fa-4509-879f-a38d825a9209", "value": "T140456DB6E783C0F0E92314F0004BFFFB9630962A54318C6BEAD8CE55FA72D926565359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032834, "uuid": "d142aa7a-f4cc-4970-8b63-c3d1a2f87ce4", "value": "8158852f6b90e52e53896ddd8d866836", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032834, "uuid": "40889271-8ec9-4c52-a83e-4849ce103233", "value": "24576:tBdQ7HTJbH4do4sbvJL9HhWVzXzKVo2ioIunOwFdAfrE/Y7sc+aD43MgEke0qn2:t8vJhhWVzXzK62srE/hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032834, "uuid": "3c9bf2d9-bbd5-4115-89b1-cbc1a4012245", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032834, "uuid": "ddcbfa88-f8b6-43ca-a172-95d957fff4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032834, "uuid": "b2d8449b-ed6a-4a82-91f5-ed8e015fad93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67bdd78-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662024304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024304, "uuid": "f1387c22-0b00-4fe6-8a77-25ecdfc6c100", "comment": "Malware payload (RedLineStealer)", "value": "0d39cc16fcf1fa439a5c8fb719d8270e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024304, "uuid": "b48e1c5b-57ce-4d5b-aff8-b8f9416f635b", "comment": "Malware payload (RedLineStealer)", "value": "52651bd3091f375b41b38aeeffd45d4df8fe0b1763fb6788756b473e6f96b5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024304, "uuid": "051c775b-b686-48e0-b431-3cd0c0049185", "comment": "Malware payload (RedLineStealer)", "value": "ca78e08c38fcceea1b8a282715dd1eb4493648a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024304, "uuid": "62a7c35b-0be5-486a-bf33-e88e7dabb11e", "comment": "Malware payload (RedLineStealer)", "value": "1ad760d26fd642901fe8f8ec8d1e6d2de792ea216826f8ecdb8229223fc171eab47753ab2b2bf6cfe332258a70704425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024304, "uuid": "8635bcea-9d2f-48bb-8e65-8ff6fd45dfd7", "value": "T128A49D01B672C0B2D5778D329C6D931A653A65140B2349EBBFE429B42FB43D21AF0F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024304, "uuid": "1630c5c3-9d9a-4c4c-91bd-57cbf5026606", "value": "e3b8a27053e73ab9de508e2b8d74566b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024304, "uuid": "50fe957f-7c38-43ea-a844-d0a837170be6", "value": "6144:zk+WC1ebskSQqYDOtlhxvkMB3T6krRSN7fwj4Ddrt1qlBw5n2UTRcUr7CAO9TecW:rt1eSzOOtBkUrRSN7rmlBwAl4O7icW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024304, "uuid": "be1282ee-6ed9-41dc-aa09-08ab1135cac2", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024304, "uuid": "bbd6124e-321a-4451-b7ef-9b90d6346179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024304, "uuid": "c078c81b-987d-47f9-99f9-5c12903cd888", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ea0e50-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031140, "uuid": "2b3437aa-5bc4-4924-b3b9-d2b1ca1e5a5e", "comment": "Malware payload", "value": "a44886a1843f230b1e555aa6ec828fb4", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031140, "uuid": "f1cf934e-a6e0-474c-b48a-7cd8abb53c20", "comment": "Malware payload", "value": "539690a71dd05fed9d139014f8414b0686013b28c30a52d5851e1d3e86e4cf28", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031140, "uuid": "3722aec4-a529-4d0c-900f-2f9f2e87bb89", "comment": "Malware payload", "value": "b4ec321af24919915216e5e6cf66800f0479c1f5", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031140, "uuid": "a28f5557-f9f6-4b05-91f6-0262c4e699bb", "comment": "Malware payload", "value": "a5aa731e8cee5bafb8c81d0878933e494d1e7e6e4613b011faeef2859ced7659c16f6c19eae9523024ff6d208f878823", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031140, "uuid": "fa67e34e-4f96-44ec-a890-1f4aeac24a1b", "value": "T18D131AB30623BDCF57270E41E50C2151DC59ECA761DD9DACBF8888E58BE41289DB8EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031140, "uuid": "4b1fa4e0-6510-4a65-8b5c-7d0edda65ae0", "value": "768:7thUEt4KaeqDA0qjvfUaAoTZRmxBb2kfgnt/XpXc3D:7tCM4KxqDAp8aAoTZwDKkfgt/XK3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031140, "uuid": "3ffaa6b8-43a9-46fa-b705-0c04d03a7da5", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031140, "uuid": "35f58d2a-4753-4b00-8f8f-201cb1afce4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031140, "uuid": "f3edd9fe-7005-4f2d-8480-1c9bfe3bac84", "value": "Nx.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec1b0b3-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662018601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018601, "uuid": "b324e919-d7ff-41ce-98dc-dc34ee5d6c52", "comment": "Malware payload (AgentTesla)", "value": "2fb7b5ab3daa430304e18a83a6827ebc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018601, "uuid": "857700a9-66de-487e-ab5a-7da649fdbd0d", "comment": "Malware payload (AgentTesla)", "value": "53b1f6f67cddcf85f6df4d8c8a7cf3ff580ffc7282a441d07d53e3b4e4343aad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018601, "uuid": "dd6dd676-faf8-4322-b82a-f4e02827038e", "comment": "Malware payload (AgentTesla)", "value": "6bd74669f4066b5b785ea87d1777e921cb22cb59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018601, "uuid": "088354a1-60dc-4eee-96fa-d5e33406fff3", "comment": "Malware payload (AgentTesla)", "value": "5c03dc0b33680022cadbbc2c1d71a4f5c10729a5eabeb5aed5d0db808bb2f88b6b9fac9e606bffb94078c47003cddea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018601, "uuid": "24ba3ff0-94f3-489e-8514-c72c52392833", "value": "T15215AEB9656896B6C139AD39D4A50590CAC3980B0FDDE7481EE968FCE8F4142FF1C18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018601, "uuid": "e7bf1e0a-bde1-4c30-873d-801f28536e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018601, "uuid": "1a8c832e-190e-4b14-8b2b-0eef99fbf5e0", "value": "12288:5vADbqi4lylSx1XiXQwUkHUn7M+Lk3/HDcdea6Twrtp9LQmEvHjKioR55KFesmQ9:lXwULM5HQOTwNLQmEPjboR5EVdNrkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018601, "uuid": "3008a5f5-ec12-4ce6-be3f-59aaa80fffcb", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018601, "uuid": "5311b72d-438a-4750-beaa-3c04b7bfe0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018601, "uuid": "edf2f8d3-57e2-4083-a9f4-696e9ba0e021", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a55f61-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045269, "uuid": "667eafdb-79b5-4d6d-b2cb-feef04ad6a46", "comment": "Malware payload (Mirai)", "value": "328eaf418025e509aa0734c3b35c67d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045269, "uuid": "0d1181f7-29ae-4443-ac27-753b9418ed11", "comment": "Malware payload (Mirai)", "value": "552cc9e982beae27486b7dd9fabd0bdb86852448c616762eef99e64056de3825", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045269, "uuid": "c404a5c9-b235-4ff2-ad5e-413b3f64fe29", "comment": "Malware payload (Mirai)", "value": "56ad00ede0335a3f40bb4e5f1dab375c6fdb5982", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045269, "uuid": "3357bb00-bd48-4fb8-92ad-477f54399ce4", "comment": "Malware payload (Mirai)", "value": "b50c0ed9bfd8e9b9acd84db8f96828897df4ecbd7a0778610ffb2ae8f5f5b4f6abf6e1b886fb3d0ec61cc059726f374d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045269, "uuid": "94f24994-b877-4f74-bfe4-db33f35a194e", "value": "T1D0432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045269, "uuid": "68644356-2bbb-46fe-b810-6e5d011f2b34", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFINQKqgESnmC/xO+KpAw5:RqtmZPuutfbltZFBSJsBcfDSTFIjBE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045269, "uuid": "fe5cad62-df42-44c6-aa86-8acc46361b1c", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045269, "uuid": "1c71230c-117c-40bb-a27c-5d6072f65ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045269, "uuid": "2dcfe0bc-14ba-4fb8-aec9-0e4b39fad64a", "value": "328eaf418025e509aa0734c3b35c67d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2fef9d-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662027961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027961, "uuid": "9dd5079b-27a9-4ba1-ba1b-45fc11578a24", "comment": "Malware payload (AgentTesla)", "value": "11427694a8a1bd5e91cfdce1eeceaef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027961, "uuid": "7c681d46-c8da-494a-a6c7-b5181af6b09b", "comment": "Malware payload (AgentTesla)", "value": "55840cf45596e5c72b2f43e6ce7c2d5dec4e090ea591c3fbc417804bf790e659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027961, "uuid": "52d4493f-cba1-4302-8fa1-35c260924817", "comment": "Malware payload (AgentTesla)", "value": "01cba572d80faccaaf6873a70ea885777c044a72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027961, "uuid": "7162f2e1-8aa1-4e67-b95c-3b4b83b3e70c", "comment": "Malware payload (AgentTesla)", "value": "5c80704bb46ae114c3beaa38f54a70eaac2b213fd2edf25ef484a2021442d01f9d61298eebb92190ecb30d894f065222", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027961, "uuid": "7a5eb816-7408-4fc4-a0ca-bb7c45844184", "value": "T13E05BE3ADA4C7EF3C42259748458568E05E396631DCBE39D3EC979F8C9E1780BB0825B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027961, "uuid": "dc844205-d7c8-4243-b39b-ae05a0f86f91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027961, "uuid": "56f385e4-a7b8-4c65-82bb-21f18ebf39c5", "value": "12288:Cig1qi4lylSx1XiExmGgOvvQYSH8vBW/OgoR55KFe:5rW3fHIBiToR5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027961, "uuid": "ac270c2f-ada3-447e-a7dd-44240be8c055", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027961, "uuid": "5f3adbcb-1224-4ccb-80a7-a80b960d1f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027961, "uuid": "0c96d2fd-81a7-40e5-be2e-c8df3550c6f3", "value": "Bank copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147c6d56-29d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024784, "uuid": "13b69771-a6a8-47fa-81ed-facab0e573a2", "comment": "Malware payload (SnakeKeylogger)", "value": "5754d895073d8480ffac49cf504e28f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024784, "uuid": "de1dbb21-bd47-4645-b0e5-b21207604c93", "comment": "Malware payload (SnakeKeylogger)", "value": "5603f40696725dfa018e9d5e679bec84f6a95f3aaababdd5c2351abcc7d1c9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024784, "uuid": "af5f8c9d-9ab9-4caf-98cd-7fb08ad9d803", "comment": "Malware payload (SnakeKeylogger)", "value": "8b1e45163c54451ddfe45703084eec6a599f51bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024784, "uuid": "0bd9305f-e760-413f-a839-da528cd8f14c", "comment": "Malware payload (SnakeKeylogger)", "value": "a8ef93b34c1e3c61904bbb1c9fb5223878214785f0bb653d498da1525c383dcc94f6df8c2dfcbce83ecbe73e58edf0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024784, "uuid": "bdc91d79-c558-48f1-9183-903fe18e9a4f", "value": "T1C4049762E884E6CCD8B51CFA55B4B257D8D87CF3E8429EC6F349B9D9C5324DAA10C40E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024784, "uuid": "4455b9a5-1b15-48bd-a4a5-103da3a34dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024784, "uuid": "88b8760c-f76a-4dd8-9bd1-c827117b5df5", "value": "768:S3BNkj57RUIxX84sbGRz/iNHAzvVVxmloNI:S3PkjFXxX8RbaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024784, "uuid": "1f6a798f-d140-4519-97d8-2c13a9cd2f6f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024784, "uuid": "16fe65e6-7e8e-47f6-865c-f633326a291f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024784, "uuid": "cd844ac4-e8cd-4283-a62c-2eb911de0a12", "value": "VSL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef090e2-2a01-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1662042008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042008, "uuid": "99374b74-cbf9-4d90-b530-9f80c34c8ba3", "comment": "Malware payload (Vjw0rm)", "value": "bbfadcb3da4438fdd85da57413c04a06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042008, "uuid": "1fb863c9-635a-40b8-8450-99439431514f", "comment": "Malware payload (Vjw0rm)", "value": "5659d489bba4bd87060b5ab0b852b850edb7b2de191a9b6679ffcd42c4c0087c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042008, "uuid": "2d0e142f-2531-4e7c-aede-5d6cfd929707", "comment": "Malware payload (Vjw0rm)", "value": "ddfd8c316ef9a87533d04cb697d5e4b438320132", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042008, "uuid": "32ed78fe-2f35-4fd2-9923-d5fc15eff3e3", "comment": "Malware payload (Vjw0rm)", "value": "901b22d0a591b018d25f7f3eb6cfde173d0315c62fcc95f68f4b1892298ab6be30e9ac8db7e840045ff4dff325dce012", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042008, "uuid": "6029770d-c08f-4495-8d3d-300cc65b83e0", "value": "T12E63F9EC10F8B479A7D46908A3680BD9F7B85975F1847687763CA4044FA9C78C0AF9F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042008, "uuid": "12a8e772-1dca-4b5a-aafe-badb4439a955", "value": "768:AjXGlfwU5XGhnGYxf5vq4htgZTQf7WnwIIfmTGlSYjOiS7MUnKoRjAMOnIWGyNU2:d7OOalSYjO8U89NU7V8h+oxK5PescJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042008, "uuid": "ee56cfb9-25f9-4048-82a7-bc44dc86f16a", "value": 72047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042008, "uuid": "4973aa49-6906-43f0-bbb4-1bcfad4ffe26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042008, "uuid": "709875fe-cc73-48c8-a075-b0383b27f79c", "value": "JUZGADO SEGUNDO PROMISUCO MUNICIPAL 4545664-55525985-65444586.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cab5c0-2a1d-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662054344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054344, "uuid": "fe316ca9-a263-44a3-9da7-4cfc845213ee", "comment": "Malware payload (RemcosRAT)", "value": "0187cee67350661ed4cc05bd02d32e42", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054344, "uuid": "acf07092-4d73-4ea7-9fbb-44a963a10a6f", "comment": "Malware payload (RemcosRAT)", "value": "5684c0b80fa72a77c2375ef5c68db2083036412fe9348c7684845dc44c2670d0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054344, "uuid": "717d1afb-7700-437e-8a95-3539c64651d9", "comment": "Malware payload (RemcosRAT)", "value": "aa1a5a13e396b2bb3d6a0dadf4b7f3741dfb1917", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054344, "uuid": "bf3a70d5-423f-4e8d-ae85-f1b920388ce2", "comment": "Malware payload (RemcosRAT)", "value": "6ac5f855fd4e64d518ff9781617d87ed8bf0df5649627ec47602888567b9a9124ecf5d074ec3d07996a332fb6c8fb6cc", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054344, "uuid": "ea129201-04f2-45c9-bfb9-76aeec91638a", "value": "T17625F0189C9CB7FCC922DF3964A54AB211D35D722D8EEB2C1F893578CDF6642B50890B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054344, "uuid": "dc483bb1-38f4-4759-aa21-6cae9be7ffe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054344, "uuid": "23071eb9-cc65-441e-84ec-639521f15e4d", "value": "24576:tqLV0QbPTX3S1q0qzOtQsO7y1uxOAnetN8mthtL:MLxfy1q0HtQsywinYtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054344, "uuid": "6368de4d-7a10-45dc-b99b-d07f3fca3858", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054344, "uuid": "900bef40-8e96-450e-9881-040dc27a0f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054344, "uuid": "66662b20-bbcc-4c0b-8362-95d817c2920c", "value": "Recibo de DHL Document_ awb 2032675634,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca3617b-299b-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1661998545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661998545, "uuid": "d48bbca0-5ceb-4a9c-8976-f2404db5af0d", "comment": "Malware payload (AgentTesla)", "value": "96ea969b22d3f8254a7deb65018d8441", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661998545, "uuid": "1b65c592-1c4a-45a7-af7f-5dcd0e8f792d", "comment": "Malware payload (AgentTesla)", "value": "56e5ac21432f48facf45d379aa14ef49e32b317707394d7f8c42bcf54dda948d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661998545, "uuid": "632e7d07-63e9-44a8-820d-94a64718e864", "comment": "Malware payload (AgentTesla)", "value": "d826a133e891ed0f4ded7e9527b8c63cf09f6cf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661998545, "uuid": "5469c6f0-f327-448f-a0d8-571ad11b463b", "comment": "Malware payload (AgentTesla)", "value": "c3dd0f3db8f26523e5f5ce3ad1abc66f7929b14d8ceca302b9aed682a79b75e05d6052ebfc3773f74bd5758c8036968e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661998545, "uuid": "9f61d893-b847-4845-abef-07cddd96cd3b", "value": "T16AF4EF633D293827CAAC45B35021565C1BBA6DAE7DE2E38B9C8D72DDC7B37E24601047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661998545, "uuid": "d8323d76-0cec-4d9a-acff-ebff5d4370aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661998545, "uuid": "1c874d64-9db6-46d0-a556-44609fed4f87", "value": "12288:rE2olu3XDG2e8iOsNc2nkRT7b7AiO6KOQ9gwp+XA0Mx+HXPxETRTgQmQvlLSKIlc:JG2e8izkRT7frKOQ9gwgXABs/GRsOvQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661998545, "uuid": "08a6b4ea-fa20-419e-844c-e42b8579ccc8", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661998545, "uuid": "230a18cb-5a5f-4dcf-b679-776dff5e98d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661998545, "uuid": "6ac8c3bf-bec2-42ec-b64d-a2119cd36e99", "value": "doc-537280275637839-937766625627376.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b78b1c7-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662028339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028339, "uuid": "657cf4b1-e513-4e0a-aebe-1ae51558ed34", "comment": "Malware payload (SnakeKeylogger)", "value": "93a5b0e83cc74f229e08396869484cf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028339, "uuid": "5dccbe45-4150-4d3e-a110-d13d2cc137b2", "comment": "Malware payload (SnakeKeylogger)", "value": "576f82be5f1a3c4a83f02a3c3db7c48ba32419513786d094a7068d40263d9d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028339, "uuid": "53367927-a1b3-4cee-9e8c-df34ec1e60f5", "comment": "Malware payload (SnakeKeylogger)", "value": "9ae1d2bd29e74743de52221a7dd2d8eca8061840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028339, "uuid": "37454eff-b22e-4f83-a236-4e2accc6fa5f", "comment": "Malware payload (SnakeKeylogger)", "value": "b80830d800568874bd1e36df6614b66762a6597b46f8a17b7df3e25c8c319e2c269e31367d0913ec10d8d447c134dce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028339, "uuid": "dca19d7f-b3b6-43a4-aea1-7538c39b9bad", "value": "T15EF4E10DFAA6C951F1A51B33C1E092144335AF59A023DB5F29CD63A91D433BB8D8BB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028339, "uuid": "b19c8f6c-f329-4891-abb2-4ea0136e466c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028339, "uuid": "5af34089-ec99-4bc7-83b8-05c2f5db67d3", "value": "12288:Nrb23lc1q2r9/5hF75e9G72wDGLAiXc2UDK9+vCTNkZfSHpnMnuhH2dRTLHOG:NO6Z5v70Lk2UDK9M790nguwxjOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028339, "uuid": "5a0077d3-f1c3-4f53-8848-1132b4dabec2", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028339, "uuid": "6137efce-f0f5-4857-98b5-293f2f427c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028339, "uuid": "97b366fc-adff-48b2-afbd-fb8a080cf100", "value": "93a5b0e83cc74f229e08396869484cf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22aee5f-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030176, "uuid": "e84544e5-0ae1-4a5a-92dc-5fe242219e97", "comment": "Malware payload", "value": "4cadefa553cf8775c2d879c7c0c44b98", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030176, "uuid": "10c41b53-868a-481a-a873-8f255e110ec1", "comment": "Malware payload", "value": "57959c2be2ac6349aa37edb73cd8a88fe8d3e69678cac4b38fac401bd3141fdf", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030176, "uuid": "1c3e4a52-cfec-47ce-b789-af478e1b7195", "comment": "Malware payload", "value": "3c3ab091ff27be626e5bde52fffc21128cf2f2ae", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030176, "uuid": "e0e69fe8-9939-4d74-a046-7d747e9f0975", "comment": "Malware payload", "value": "b3a55caa9fedc59a72a8a21ffdb94b328674f0c9a9eda1ee79a504fdb65afa74938bcca27903b28c0c4898e483d9bdd8", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030176, "uuid": "37c9f29f-328d-446e-aa11-246017e9b4c8", "value": "T1F731CE1137DE4714D2F24E37687BE30089B1BC156D23D76D0AD0E29C6455A44FE39B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030176, "uuid": "3ef91bd9-c6ca-4b1f-bf8e-938909f18b45", "value": "24:8B3cJ5+Cy9s+TqAeRYWDv8S8o0B2ARjVuWAbMlJWDzTj+/QT4I0G:8B30mhZwnvYoJUjjA4JYXfMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030176, "uuid": "7ec091c7-0814-4b38-b495-2c40a82f2f74", "value": 1861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030176, "uuid": "fbd76d40-4da2-4c24-b1cd-00631367f31b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030176, "uuid": "f3ac6ab5-ecc1-4898-90fa-7b6bb09241c2", "value": "Password txt lnk2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462aa588-2a0c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662046772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046772, "uuid": "75d6dfc6-77a5-49a7-9c75-5e7828ef0214", "comment": "Malware payload (AgentTesla)", "value": "6311817274ab3c8795ee228cede77357", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046772, "uuid": "2db16e3c-628a-4937-8561-4888fde74e19", "comment": "Malware payload (AgentTesla)", "value": "57eb4c586ff538740c9c29eb318ff8740819a614fdbce387256b87a856672dd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046772, "uuid": "67d25357-e564-475c-a77d-4249709b78fd", "comment": "Malware payload (AgentTesla)", "value": "21d578a01d2b299f43092806c256a7aa4e4838cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046772, "uuid": "eddf5b26-22fd-4a7a-83de-747028d0a2b9", "comment": "Malware payload (AgentTesla)", "value": "7227b36bd9e6b7cd138df1c3e5efdf44f765e001ad19ab869f5e5978ccac744fac8c1d4d470bb092575774af19f4fc41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046772, "uuid": "f7d1af37-2865-45d8-a25e-e9e74667e261", "value": "T15D058B277EAD0BAEEA7C8BF95570161013F069EB101AE6D87DC2BCEE5D61B414D009E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046772, "uuid": "0781728a-969b-41c1-ab82-b444eea84621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046772, "uuid": "0802a743-4f34-46fa-a2c1-09b3e3e66c92", "value": "12288:pI11R/5P46n5IAPJkq2Di6p6mdNYhtQKus75SWTfi:aPt+LjDi6/OzGWTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046772, "uuid": "e493d150-1af6-483c-95d4-cb574558c6e7", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046772, "uuid": "c70147bb-cd15-4fa4-9b5a-71c0616416cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046772, "uuid": "dcbe6e3d-52b8-46e0-8c57-0a4acede86df", "value": "AMT_637930256Y23-3773273730_____________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb90fd3-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662028346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028346, "uuid": "a02a721e-2cb2-45cb-924c-ec7652f26225", "comment": "Malware payload (RemcosRAT)", "value": "599563fcb90a39d3d51f44fab45f39fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028346, "uuid": "ad4491be-4d8f-407e-a52f-cd8387fbe169", "comment": "Malware payload (RemcosRAT)", "value": "582867f54f2961f3249d0ebb19effc6e9adb068b5055cbf3be38ac6150462f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028346, "uuid": "592cc88e-72f0-4e06-a5ba-ef69640d9c8d", "comment": "Malware payload (RemcosRAT)", "value": "3cc06283167ae5032373d65329eefa3ceeb10cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028346, "uuid": "a8e1b85a-be12-443a-80d6-7a2550ca9c3b", "comment": "Malware payload (RemcosRAT)", "value": "426006a0376005bdf300c129b3f7f06ebe566cf3daeea45a1580f19d412f682b38c8493360e240e0fe8dbdd241c250a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028346, "uuid": "7c75b5b4-fc8d-42e6-8461-254b83640241", "value": "T18416226213620006E4D2FCF99523BEE172F51E2A4F41A87569B679CA35324A3EF03D5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028346, "uuid": "79ab8320-c8c5-437b-967a-3b52b249c60c", "value": "24b92ccf1e266e626a6cc7126f975fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028346, "uuid": "98e24ebe-da65-4464-b0d3-18c62ced6fb9", "value": "98304:BdG2jxBVwQ1J+SARMR0p7f/tPYgmT5oaScB10D:BdTjxnJ3wMOF/SJ5tB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028346, "uuid": "bf40cd50-4c0d-47bd-9eaf-c1a5b7f016fe", "value": 4356608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028346, "uuid": "4da5614f-ec5e-453c-a0cd-ee3c3781d03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028346, "uuid": "0dc3c949-0cd4-4750-be2c-d6f0b2b43252", "value": "599563fcb90a39d3d51f44fab45f39fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7745ce3-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662022132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022132, "uuid": "3850ec35-825d-4a8a-8906-69d13afe37eb", "comment": "Malware payload (ModiLoader)", "value": "62e448bf5d0cf52e038f30aa4ce407a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022132, "uuid": "6015ea16-9424-4d50-b3e7-c5b2b1b7a196", "comment": "Malware payload (ModiLoader)", "value": "58314046b179013943fc9d92d2ae831a044b6aae9d7f3077eb66b7293a1616d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022132, "uuid": "62a9ea0c-aabc-45d3-9eb4-73478a9938ed", "comment": "Malware payload (ModiLoader)", "value": "b1dd2537b30ffabe4500916bcb74ee3f42faa0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022132, "uuid": "7561b49a-7f64-470d-8b2a-a5efb71f23b4", "comment": "Malware payload (ModiLoader)", "value": "4865971dc7751c8832ea52ebc7a5d0c3ee505bc0904ce830c27b5f81a557d6971d8ef2223bd5e350eb7a4d0613c35a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022132, "uuid": "8f2e0450-6e3c-44e6-836a-2444be7a08c6", "value": "T17615AEF773E08A33C4331A7DCD5B53949D29B9525E44BA5A6BF0298C8F78281343B663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022132, "uuid": "ebd7c603-3c97-4ea5-bea5-b83c8e02e8bf", "value": "e44b1ce3d13e55963ede0f334a1c0840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022132, "uuid": "a982f30d-394b-43e7-a855-811a448043ce", "value": "24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022132, "uuid": "226e1b6f-8116-4af8-96d9-c5abca9b4cf1", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022132, "uuid": "7e806f09-b9c1-403a-8d38-9b951409f677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022132, "uuid": "d4e09f00-dc74-4449-8eef-208f98dfe2a4", "value": "EU0726620827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5ad4e5-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030918, "uuid": "6a9e2f23-e9c7-4de5-be4c-b880c2c72093", "comment": "Malware payload", "value": "092e83b39ac887b16d242c10eb6a6b7c", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030918, "uuid": "a2fd742c-bfca-4c59-9878-1ec14558d22e", "comment": "Malware payload", "value": "58ff099b07d8cd7d9b6ca716c0d1580c1e3ae735b48e5301ebd309ad0537f724", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030918, "uuid": "6157650d-0572-4859-9625-f77000a9b7d3", "comment": "Malware payload", "value": "595d330fa9d6a30a0d51e2a621910366e27ff044", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030918, "uuid": "99285412-2946-4243-bb23-31cf3648028b", "comment": "Malware payload", "value": "b96e9eba8431d72be4c726164546fabe59e69e152f9fe8e9ddea84b818eefc60cf95444962add13af81f1898fdb3beef", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030918, "uuid": "9b90f159-638b-4367-a23c-055234ca4e81", "value": "T1A7A45DBA1203FEDF5B7B0D44F4082645ECACB8E7B2D485A8BF440AD649E65589C78CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030918, "uuid": "a552da9a-060b-4da4-b6a7-cbb64edb1ac1", "value": "12288:jq+la3LI1oWlfHfTM92snf4PFy7O9Zw4OA93p3/AKQ:jq+lrIgPFyq9ZwJkp3/AKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030918, "uuid": "477c2c42-ccfe-4f01-9162-12b0a3a673b4", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030918, "uuid": "441ac322-8b13-498e-b429-dfe3c3ed952e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030918, "uuid": "d310e671-696c-4a14-93a9-0c8e34a18420", "value": "QQ2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a3d951-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022122, "uuid": "c3f776fb-1a32-4b38-84e8-246e78155edc", "comment": "Malware payload (AgentTesla)", "value": "989ef895b923a31dbcd2bb2f7677bbbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022122, "uuid": "8ae91fa3-fc29-43b6-9efd-30c9ed5db483", "comment": "Malware payload (AgentTesla)", "value": "59666a438740ff406eba7c3b3afe04b8c48cb45f2622fe351b79c25a446eeceb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022122, "uuid": "0c650ee8-390d-42fc-836f-466a66a396c5", "comment": "Malware payload (AgentTesla)", "value": "f876ae21e6a172cc1d76265d468232cb3bc61c1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022122, "uuid": "11875b5e-c72c-408c-bb91-b7583aa0639b", "comment": "Malware payload (AgentTesla)", "value": "6560491d7a61b200512682ecbb7f58c3aaea0275f13086d2d0b4f4a7dc5eef89126d188488bd3fac1e51c0f61b49a51e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022122, "uuid": "334f388b-81a4-42be-b38d-7c60bf5e6d3e", "value": "T1991533BD8858785D7600CB48FB0359AF310294987BE6A1F2FB160CF737F8946586B6D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022122, "uuid": "58ffcba9-a410-4b05-9eae-a3b3b4c10e08", "value": "24576:uj6dFZPqJJdhkT/cnklM6OBdR/yz2ph38vw:umdDfLCFyA2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022122, "uuid": "a69c8052-28d1-4d2e-b67a-c963981786cd", "value": 922335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022122, "uuid": "471d4250-2437-44f7-abb6-735e1445c8e2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022122, "uuid": "a6d94eee-7f6d-4dce-b235-185d5bf5fa61", "value": "ATMBanka Kart\u0131 Para \u00c7\u0131k\u0131\u015f\u0131 Bildiriminiz-QNB FINANSBANK.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c22c673-29b7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662010221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010221, "uuid": "c8949561-14ae-4f8e-83c7-d173865b081f", "comment": "Malware payload", "value": "ca2beeea2fb0d53b4e0874d310d7f8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010221, "uuid": "99c3ab92-2cb5-4a84-8b04-68289c84a3c0", "comment": "Malware payload", "value": "59e80bdc4ade6a3de158abd48ceaac8d51300c4e8e32331f80be3538b572543e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010221, "uuid": "ec1505c1-3cf3-4141-9aad-ed4c29ac5dbb", "comment": "Malware payload", "value": "df4d80da8a5e14eba92a3247ff6288647782d5ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010221, "uuid": "6da4d814-d0ca-4e63-b19f-2a1738c62b6f", "comment": "Malware payload", "value": "944a879007510e1b5e753cd286220709335550ad7bf70eee0e550580a701b2bef258b33814e2fb4338a7350166a84371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010221, "uuid": "90afec75-20eb-4887-8e4d-0724fdeffc8a", "value": "T1B3E48DAC759872FEC817D9729DA81DA5A69324B71B4F020B855315BCCECC987EF180B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010221, "uuid": "629e83b3-ca8a-4c22-8737-d5bd9a5ee93b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010221, "uuid": "9619e974-0baf-444a-af9a-8511e0628901", "value": "12288:W7DwM3zFWbFfDRp7oz3/mtUzjKlylSx1QzgLUiiWkvgzuPcfricI7qoNzOp:W7DwMjFWbF9pMzqUqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662010221, "uuid": "bedb6478-e421-482f-9923-ed156754f776", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662010221, "uuid": "93db751f-b7c0-43ed-b127-70ee047f5f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010221, "uuid": "b60900f3-2144-4f15-9a3a-659f1abbc05d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.4731.10513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e03192-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022121, "uuid": "fa813c50-507a-4448-a883-22d26e1d9754", "comment": "Malware payload (AgentTesla)", "value": "dc5b3f9704c53ea712ff6d7a62dbee03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022121, "uuid": "f8d082c5-478c-40a3-b619-8688c8b09842", "comment": "Malware payload (AgentTesla)", "value": "5a018cabc6bd7f42cb9c75261f093f71f97616ff53e8ebb92e7048824295a8a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022121, "uuid": "6f3e2b92-fdf4-4ead-8295-0025de504203", "comment": "Malware payload (AgentTesla)", "value": "e9ce54f8cbf16145d3747edd1f9e7d7df946dc4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022121, "uuid": "da5e6658-e458-4eea-9b52-2dd8db4dde99", "comment": "Malware payload (AgentTesla)", "value": "415529d8ec385b78061a361e2b3bd61ad84097d0d1fa368ca221c326b40de04ceb6d63bee6aafbaccedd40b40b17c530", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022121, "uuid": "cc363e3d-1cdc-4011-94c6-04ef45ddbe36", "value": "T14E2502995684C3B5F4170BB002A1F15492BEBE16D2B1C2DDAFDFF1EC59B8B129213A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022121, "uuid": "266ef3bd-6f2c-46b9-a3ba-ddae6f2bbbff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022121, "uuid": "6c7e9428-438c-47ee-8d96-61df4f5da441", "value": "24576:IZ5csaNUJI39pMW4np5rKj5TZogKk8XY+mzo3bv:q5cXNUJIbL4np5ru5uU6lmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022121, "uuid": "35cd1e31-5957-4fa4-8a9c-a053ab6542c3", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022121, "uuid": "35277a28-0355-4bb2-a5ba-e9f8cbd1a6f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022121, "uuid": "c1ee444d-fe62-4bb6-ae25-d57e6dd0778a", "value": "ATMBanka Kart\u0131 Para \u00c7\u0131k\u0131\u015f\u0131 Bildiriminiz-QNB FINANSBANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69ebed3-2a4d-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662074931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074931, "uuid": "85474fb9-6de5-4472-870d-f033a123fc31", "comment": "Malware payload (AgentTesla)", "value": "c0aa091a46cd01034a3acc9a5b1f236b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074931, "uuid": "eb666144-c598-42df-a78b-0e47b900cd57", "comment": "Malware payload (AgentTesla)", "value": "5a0d4e3cd14060e83aa0ae2b23ba15bd5583ecb43e2f8f71562deba702af1348", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074931, "uuid": "72af1388-df71-436a-b351-11fcdd1b3f77", "comment": "Malware payload (AgentTesla)", "value": "a07aa8764ce2d13f098f9c786415599212f1b40e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662074931, "uuid": "0b5e35e6-200f-455a-9b9c-48bba52ba9be", "comment": "Malware payload (AgentTesla)", "value": "15a74a143d505d22d2daffd7306a3bdaf96b8d71890cad2ee1166caf2c2836c8cc27b7a9c3a4c5069678b117cfc75ea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074931, "uuid": "56ead181-969b-4985-b589-0d7b285efd7d", "value": "T13615224FD290AB17F4880B7953F0F313427ABE1A96F6D7494EC8F3B816D435A8607A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074931, "uuid": "16afb19a-375b-4614-8e28-02aad9b44045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074931, "uuid": "b401ac22-fc40-40c4-ac87-4bbda30b901c", "value": "24576:IZ5mXY+mzo3bvbSZQfpDnDrHpEDkPB99r:q5QlmzMDSZQfpDHpp599r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662074931, "uuid": "f17a8fa7-b0ef-4981-b21b-96489a8d30d2", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662074931, "uuid": "88d92895-a654-4403-9315-589c88476d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662074931, "uuid": "fc5315d7-f77b-4468-903e-44647657e600", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1724b551-2a47-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1662072033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072033, "uuid": "3f5cf233-efbd-47da-8b72-01c5879f1258", "comment": "Malware payload (njrat)", "value": "000ecfed34691ea984216886f22b41c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072033, "uuid": "0eded9d8-6e35-43d4-8019-29667b96cec1", "comment": "Malware payload (njrat)", "value": "5a8b428d40e0e947b18c0dd00eb390fa02cb8b8b5e9acf64b476a4f0f9970772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072033, "uuid": "3ff87b07-be1b-4e51-ae56-857c23f45337", "comment": "Malware payload (njrat)", "value": "931acbd3c5663d7db6c6e0e741866c33517af684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072033, "uuid": "17854d25-966f-485c-957b-f376230852ef", "comment": "Malware payload (njrat)", "value": "2aaf1ac753919b1a04b428018c8723155f82629cc0d1e2db507da48f91e8440ecb9a15318648550e239868c8b73aba5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072033, "uuid": "d16e0f2e-430f-48d3-be48-04d1f03959b4", "value": "T131032A4D7FE181A8C4FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072033, "uuid": "3570fcfe-8c3d-4a19-be49-a5f6c361be79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072033, "uuid": "30693d99-b9e9-4a09-a8a5-b38ae9bc4560", "value": "384:BmOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3u:TFdGdkrgYRwWS9rM+rMRa8NuwGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662072033, "uuid": "aa9de1a0-7d69-480d-9aaa-4ec30f7e65f6", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662072033, "uuid": "547317a9-2596-4bf2-89b1-d8e762251ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072033, "uuid": "58879578-8463-4578-ad7b-195a68390b46", "value": "000ecfed34691ea984216886f22b41c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e62eb0-29a8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662004119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662004119, "uuid": "887918d7-02d7-4bfe-bdb9-17c57f0f4910", "comment": "Malware payload", "value": "56203bb4fc16c34e91829bcff83547ba", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662004119, "uuid": "7d018223-7ecf-400e-b914-c08849393180", "comment": "Malware payload", "value": "5aaa4462eec865596b58a0b11bc1e79fddf5e3dc6f2d2257dc9344c481a8615e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662004119, "uuid": "f3f1fb1d-5dff-4912-8972-cca115c539b3", "comment": "Malware payload", "value": "7c5719a9beebdb0f0bdcc6f7aa596fed0e0483cc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662004119, "uuid": "65024464-a9b5-42ee-be77-2a364ea4409a", "comment": "Malware payload", "value": "b334718c92abf4e9149a48a714a02e0f7d5fc3cbd020f9212b907594440a761af8bc60b7e79c9a3e0bf567f0f50ba9d4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662004119, "uuid": "2b35f05c-5f2f-4665-8f3e-5b3e4f5b61b7", "value": "T19D2733A35C0AADDAC4317435657E2344A875CA6E39F33B210054EEA7C2F3965CED9EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662004119, "uuid": "b009e8b2-da26-4608-8f01-2b62afd0d9bb", "value": "393216:JjOzvMsJA35z7A79L+xy51mbgafiubcQZzbHT9i/zVN2I+TXhZ0KpPbNiRSKcsnc:4JA35z7c5RvmbBffcqzFi/zVN2IkxiWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662004119, "uuid": "2300d269-50fe-4d24-9f21-7a323418aba5", "value": 21619635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662004119, "uuid": "e4f50ea1-c651-4df9-978a-3073c73e0c30", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662004119, "uuid": "5a91ef87-188a-467b-9683-a1963dfe3f7f", "value": "5aaa4462eec865596b58a0b11bc1e79fddf5e3dc6f2d2257dc9344c481a8615e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5a4eb6-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045282, "uuid": "bd089142-b33f-4749-b459-5a44fd25ed0d", "comment": "Malware payload (Mirai)", "value": "4b33f46729d9b0c3fda86737c62ff6f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045282, "uuid": "70e3b57b-e9a4-4b2a-ba36-a73a8db9eef1", "comment": "Malware payload (Mirai)", "value": "5b3246d3db293d00979765bcf244fe2161f26d759b118c966f00b005a5476fd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045282, "uuid": "b3d505c9-3835-4397-bbff-d9194dd798d7", "comment": "Malware payload (Mirai)", "value": "368c48164c147b566e37e9c92f5556c527833e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045282, "uuid": "91d8f65b-c642-4f3b-8131-972abc486cc1", "comment": "Malware payload (Mirai)", "value": "34fd21ff72edc81757ac9da456352fbda42dea13ab5323ede57bf6edef16396ee3a796394a143d4ec1cc5eda060559f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045282, "uuid": "12c8bf07-e9bc-4c4b-98b6-d7a6e2c6374c", "value": "T14FA2E12536E70F65D37A007DCE65C343B35727BC81F831BA22840220E6C854ABE74EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045282, "uuid": "ed50f93f-e2fe-4d52-b0a5-80ee3c66d6bf", "value": "384:TvtIoZxrSniaXs+qx+bwqPXy2Vucwz8Jt7c9qWSETs+BwhymdGUop5hT:TvQn4j+02Vucw4Je9qWS4skws3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045282, "uuid": "895ac820-3d50-4696-9545-d00b66c832f1", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045282, "uuid": "0bfbddb3-0e09-4476-9314-4b60f2f412c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045282, "uuid": "96e8ac46-2ab6-4ac6-ac89-dd77ea5b597f", "value": "4b33f46729d9b0c3fda86737c62ff6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a86ff5-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014470, "uuid": "e98e1adb-a982-4726-97cd-6f9138d392c9", "comment": "Malware payload (Gafgyt)", "value": "a37a5cac1b166eba1ac9d85ad1b90296", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014470, "uuid": "f8b1b6e4-25e8-44ad-90e4-b2913a5fec72", "comment": "Malware payload (Gafgyt)", "value": "5b4be7dfe4720047c633de7e8e3b707b001ce15ea0acfecf9502294ed363c981", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014470, "uuid": "c74e33f4-d5a2-439a-8a48-b2331c60cf18", "comment": "Malware payload (Gafgyt)", "value": "261c6bdbfeedd849c3119c10b3fd689bfe2e7583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014470, "uuid": "57623a84-f400-41da-a49e-a19ec039145f", "comment": "Malware payload (Gafgyt)", "value": "61edec57a34c6cc0dbbcb372ddccec2a1e5053cca1c23d07b631df41b826f41147d805e04cd33bd4568754d89735bed2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014470, "uuid": "164b5cf6-3ee9-43dc-bf32-ab64267a1a71", "value": "T1B9E33B09EB408B57C1E2277AF7CB425933339B64A7DB33095928ABF43FC27994E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014470, "uuid": "d2901609-9a54-4856-bcf6-cf5232150281", "value": "3072:bBnEaZUpFYZ6qAllzRohVinnFEM/9WKmpwfvRQfZn:blEaZUpFYsqwRozinneM/9HmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014470, "uuid": "e0260500-ee57-4c81-8015-5123a758fa64", "value": 150386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014470, "uuid": "5834468a-c8b7-4970-95cc-d9fc9e9dcaa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014470, "uuid": "34a53b82-53de-4d99-b073-d35809c57050", "value": "a37a5cac1b166eba1ac9d85ad1b90296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc8f6df-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662036931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036931, "uuid": "2dbc4142-7b08-46d2-b1e1-338de95ff875", "comment": "Malware payload (Formbook)", "value": "b910721eb73748685ec9bdc3715eefee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036931, "uuid": "3d216844-4d37-4943-b2bc-50b7a326c4fc", "comment": "Malware payload (Formbook)", "value": "5b67af0f063e8f0e6fcd95a91ff03307205cf53413e4f6f8410c168f45ba24a6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036931, "uuid": "4cadc1cf-5434-4f1d-8b93-c01405b97045", "comment": "Malware payload (Formbook)", "value": "2047960e518d782a20a5b0a29bd37c9cb74579c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036931, "uuid": "ec9bb95d-3970-48f5-adbf-43366c4aea1c", "comment": "Malware payload (Formbook)", "value": "b46e80145a78b3427e48c6d5699bdcf521102ab8b47ca47ee3d1c3f63f3cdf9d24ef2a711f3cb91c08c5871abc4e9aaf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036931, "uuid": "d5d1b2ca-1251-437b-96d8-252c3e8fc776", "value": "T1AE226C7CE142FC1AD126087CE05582F1E71A41577A22B92F2059B2AC07B1AC357DEDED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036931, "uuid": "de24193f-cbbd-406e-ab6f-81e224f808e5", "value": "192:ScIMmtPf+CUG/bA3/w2O4rdlJFmQDZ7rhhap30rV:SPXumAO4jJFmIZfhMFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036931, "uuid": "b1e2ee2f-1535-4380-83d2-651d01103d79", "value": 10349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036931, "uuid": "3f2032c3-fc07-4a4b-a751-ede057f31ea6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036931, "uuid": "a80d6484-f6cf-4383-bacb-e144c9400a43", "value": "Universiti _Malaya_1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2668af13-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662026962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026962, "uuid": "b974ff6e-02b2-4f6c-b2ce-76453f8688a3", "comment": "Malware payload (Smoke Loader)", "value": "f40aafa4bf0da265cbfb0f928a0e825a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026962, "uuid": "06e0ce00-5709-4273-9fbe-de2bd10be28e", "comment": "Malware payload (Smoke Loader)", "value": "5b83bc89fc115e05636a2ca7286eaaedd1f440dc7fe7f7d4a20cfc5a32050ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026962, "uuid": "cf6cf1a6-4adc-4cdb-9504-0a45c7c6acdd", "comment": "Malware payload (Smoke Loader)", "value": "8da8ecc32eaa838a7f01ac222bf1fe73383d7c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026962, "uuid": "75bed825-e86b-4be5-9868-6c96c1c3e658", "comment": "Malware payload (Smoke Loader)", "value": "381848262990ce4d70a45f09da3effd87448f5f5b0e7c331987ef353fc05c9a39cbd971dccbb3aced8d56f1e6f4810d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026962, "uuid": "2a51fbdd-7328-4371-bb10-16c63ca05814", "value": "T12E54E1227991C433C01614B15728CAD16DBE9AF10771178B3BA927EF2F312E2BB76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026962, "uuid": "bc85a137-92d2-4ed9-9f26-953ae3c0e8f6", "value": "87441594d3de44f1a0456f0d6f52e874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026962, "uuid": "2e0c88be-ea96-45f4-b0f6-3572d7b9bf20", "value": "3072:mWHLE1NEL7Jj2oRby1qxOGKv0VmLt4UTmW+f+3YhC:mSL7JA1qMGe0utla+Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662026962, "uuid": "75bc4a78-bcfb-4c26-87c7-bb3715873fb1", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662026962, "uuid": "94bcacc9-c966-485d-a6aa-c235bd1e4864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026962, "uuid": "99d9a35d-e54a-4b14-a540-28d10d3716a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a584be-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662048972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048972, "uuid": "f2ea342e-d765-4f03-b478-2c0ca35059c6", "comment": "Malware payload (Mirai)", "value": "8117c75e7537451ecf505bd1ca1a78eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048972, "uuid": "87b8d9e5-8507-4141-97b7-cddb69a78115", "comment": "Malware payload (Mirai)", "value": "5c17cc93aa35db328381adcc01981087629b5b4af273eb5d7b495a01ffb0a37a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048972, "uuid": "94d168a7-fa82-4922-bece-ad96f6ca0745", "comment": "Malware payload (Mirai)", "value": "c42d445ee09f264f3f325ccd09ffb15436a46016", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048972, "uuid": "841172b8-62d2-43b8-b8fe-997152786592", "comment": "Malware payload (Mirai)", "value": "76ab87f0a2a1562fa825a3c421b7d5d7e08afc2ed8cbc4ba9379d8d90f3dbf53bb023b690adbeb19176029962d4bc601", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662048972, "uuid": "9fb99351-79bb-4b34-82e9-dee03e825bfd", "value": "T170238E73C42BAE54D14882B4B9248EB81B63E405D6672EF64E45C66B8443EBCF61E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662048972, "uuid": "dda65d5b-c81c-4a24-9a5e-1a99ad9c92b8", "value": "768:piamwtZtIGkZeIU5IZJ3lwmmWF0MrTsynokPCLmoloHxNC98:piamwtZaZyIn3lwmmvMEkP85loNC98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662048972, "uuid": "87373696-1bac-4dde-92b6-a998591b2783", "value": 48464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662048972, "uuid": "bfb63666-12fd-4ed2-a5cf-8c5d3a30972c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662048972, "uuid": "3b6caac6-c4ee-4bd9-bec7-a76081d81808", "value": "8117c75e7537451ecf505bd1ca1a78eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9610516-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1662024631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024631, "uuid": "ef830817-b12a-4617-a45f-b3fd141f47e2", "comment": "Malware payload (NetWire)", "value": "dde1d2bff5076a07a34a3d079eb42603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024631, "uuid": "83deb328-7394-4727-a8bc-fc72a66026bf", "comment": "Malware payload (NetWire)", "value": "5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024631, "uuid": "dd62938a-d55a-4a3e-afd6-7be5bf72d0f2", "comment": "Malware payload (NetWire)", "value": "5255caf6bc8aa67a7b5c22fbe15b1dff34155905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024631, "uuid": "c7b37c87-9e19-4541-8c22-ab1402e37f9a", "comment": "Malware payload (NetWire)", "value": "d1b8d706d581564bb312974ba80547cba56c1cc37102d3233f0840765ee697d1ca60897e9b39caaee049386f0106b3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024631, "uuid": "fe90b340-b80a-4f03-9398-c54489a0452b", "value": "T12BF4BEDEED8C0344CC3607F5E8A80140E6E27DA9752DD68E6C637C76D4B239E427AE42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024631, "uuid": "9491dc96-2968-498b-af8b-bcd9fab69f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024631, "uuid": "311407e3-7a2a-48e8-a991-c6b04b0eee27", "value": "12288:UbpM2Tgxl6b6JBAdDz7/VFbxJxBsIfL+3wFtmTAnPmJDOLxAyIFmki9bF3:UbfggDDb7xFK3w9nPm5Zk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024631, "uuid": "d9834988-9c01-4e10-9881-f1c5064af5a2", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024631, "uuid": "c68425eb-c890-4037-b1bd-4ae2ec837da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024631, "uuid": "eba1a0a3-d676-4b18-a169-61fdc3644007", "value": "dde1d2bff5076a07a34a3d079eb42603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bb3836-2a1d-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662054260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054260, "uuid": "86a94e57-a423-4b2b-b6f7-e82f8bead607", "comment": "Malware payload (SnakeKeylogger)", "value": "ab5b36335f8db562fa39f7d474ce9ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054260, "uuid": "04e22f27-8672-4aa3-b057-8e9dcedad24d", "comment": "Malware payload (SnakeKeylogger)", "value": "5cb0f74b941dac8026c98e6efc4fbb3273e67f95b3b92774e5bcb7158f4ff729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054260, "uuid": "93a9b75d-8ec0-484a-8581-1d834fc3796d", "comment": "Malware payload (SnakeKeylogger)", "value": "896dbdd965c80f9e48812d91b61e81ad6a552d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054260, "uuid": "6a7bcb66-acca-4f4b-972d-45d2bf8e9b39", "comment": "Malware payload (SnakeKeylogger)", "value": "ac5deb0672577078cf9d100f97e28754750d93d0c7b2f0f3e608558ef0361d4c37ab9bfedf135f65a7e901e0740872ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054260, "uuid": "621f87a6-48ba-4417-9aa5-55372a6fd27e", "value": "T1D0D4CE1868DCB6F8CD23DF3964E546B291D392732C8FA76D4E89067CCDD66027908A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054260, "uuid": "cf46c3fa-56e5-4841-8ad8-0353eb22bc3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054260, "uuid": "504d30ef-83e7-4ac8-8675-27b2e1754629", "value": "12288:r6FSLG8/lgrhhHWqokWnZdaYAb4HZdiuulylSx1:28C8mthtokWZdaYmWjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054260, "uuid": "2a264969-3f3b-4a85-b99b-739677e0ea0f", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054260, "uuid": "1fc0c4e4-439e-4efa-a0a7-f53af367a081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054260, "uuid": "897c1163-0180-40cd-b0c1-f1fcf9ff3da4", "value": "PRE ALERT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f810fb54-29c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014429, "uuid": "374ea8d8-7bd6-4f2d-a22b-b13c6120ef70", "comment": "Malware payload (Gafgyt)", "value": "3a0aa16a03ae89ac6c50de3b0fa15416", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014429, "uuid": "789fbcaf-6b3f-41a5-9e56-c8a5b4cc00e6", "comment": "Malware payload (Gafgyt)", "value": "5d7c252ba56c48092b1e586cc165addf1e1435fa9f63d362ea4fa6c2d78130ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014429, "uuid": "aca07c55-0c46-4950-a208-e2818a3e8d4a", "comment": "Malware payload (Gafgyt)", "value": "35849c6f9e4c5522320efccb36b9b6a4bebb37d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014429, "uuid": "5710db44-4448-4d4e-a967-974db5cdb7ca", "comment": "Malware payload (Gafgyt)", "value": "10cf4eae1221316a063b10605365a02f1143d825919d8c74414c667811ec75a1b0d7d1df224c31dff30654a1e16a3a48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014429, "uuid": "632de7c8-de67-4f00-8c1b-d73b89e56cf2", "value": "T1FE733947AD659FB7C056AAB525A359300B13F8215F0F2B89713CAAF8470F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014429, "uuid": "43a54436-de7c-4327-81e2-78baedadc9a7", "value": "1536:Mwy558fBKepVIISJgtxqENpcCnS0oJismj9VqYLe8f26e:fYifIexSJgJccS0oYsmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014429, "uuid": "3b2b2ba8-8b2f-4202-b6b2-156052ee667d", "value": 77750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014429, "uuid": "e158e31b-cfe9-4e88-b833-3829463b1b4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014429, "uuid": "67034491-2d3b-440d-a79d-e5a3736e0a12", "value": "3a0aa16a03ae89ac6c50de3b0fa15416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adae21e-29d5-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1662023131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023131, "uuid": "cf2371f0-2496-40f1-ab79-8f5f3ad08c54", "comment": "Malware payload (NetWire)", "value": "1ae5aa67399707e81cf4fa93f127ebe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023131, "uuid": "2580f6ac-d03d-491d-99a2-c0f715be36b2", "comment": "Malware payload (NetWire)", "value": "5e6ed3f0eda07ab20f0de1f4c2f9e355a558de4f53b1f81cadae2f3b2d4609a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023131, "uuid": "b2c7b3d4-ebf3-4166-a882-3224c35441c1", "comment": "Malware payload (NetWire)", "value": "d3c62b37299568e548dff53b64aaf819d2af0823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023131, "uuid": "2800d50a-a684-4333-b148-37378b4bf6b6", "comment": "Malware payload (NetWire)", "value": "82e7453afafcee0b78ff9e8511a83ad4b4f5068c753512f4edbd53158f4c17f79de020e7c9b6dc194c8546abaf7df008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023131, "uuid": "2bd32e83-ed17-48bd-9dfa-172c2354d8d6", "value": "T1111502499684C3B5F42B1BB011B1F12896BEBE159671C3CDAECFF1EC45B8B129217A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023131, "uuid": "f17ca8f0-d55c-413a-91b8-0579ffc86472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023131, "uuid": "659ca617-76c6-47c1-be92-a9aefbfdcd63", "value": "12288:eF75eqnN7org1+XKeT3unq0jEnrDtyejzJegPwqoXY+mzoRtbvRT7:eZ51ndoNXHynlAnrDYoleXY+mzo3bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023131, "uuid": "b78a5219-874d-4033-881b-bf63f5f4597c", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023131, "uuid": "f81fd0be-37d3-43b9-bf26-a4e79b855b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023131, "uuid": "aaa9966f-d88b-4576-940b-46d1924a4c00", "value": "TAX_INVO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f8765b-29fd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662040217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040217, "uuid": "840032dd-52b4-4e99-ad51-c8d4790ae272", "comment": "Malware payload (Formbook)", "value": "25f196540f2d328f8f12cabce5fb6e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040217, "uuid": "e76e56b1-1074-422f-a304-9b5398a527b5", "comment": "Malware payload (Formbook)", "value": "5ee4a34b98bf2977cb74c70ecfe2f6d6cfab5db956584da0d24e7413ea12e816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040217, "uuid": "1d7102a8-b8ce-46d7-bba6-40d35f269c32", "comment": "Malware payload (Formbook)", "value": "c3ef6dd75706a777648c40741c99569dde7d8fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040217, "uuid": "f63fd894-4481-47c0-984b-1945f67dacc6", "comment": "Malware payload (Formbook)", "value": "9300714c5a0cbdb83e69febacbb6eba550bcc8fed7397a6e364f4812104e339fbf249c582cac21365a8461b2183be531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040217, "uuid": "c5bbbe32-f654-4fa9-b5d9-8ba413d0cdec", "value": "T1BE15DF5A91944650FDE92B365F78E93243327F289872D28D06F4BCB73BBA3534017A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040217, "uuid": "c08ea403-d8df-4ccf-ad81-2e1c574ec267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040217, "uuid": "3dff2327-0c29-45d6-a962-6b56aef7d426", "value": "24576:4oZ560Hvq7WhoV22G2mGBcKPcX6KKKKKKfj6:4K56WCfHGlKPo6KKKKKKfj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662040217, "uuid": "cc529e39-72ab-4e44-8822-12a36c3ca132", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662040217, "uuid": "c848b339-27d9-40ab-84d4-10abd79591a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040217, "uuid": "788f67af-a56d-4967-a249-a8fc2b003f0d", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69311e2c-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662046401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046401, "uuid": "90f5c8be-85f3-4459-ae85-f5ffb2fc2679", "comment": "Malware payload (Mirai)", "value": "61248e4bd51f8c4e07f83ec7ef9e3e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046401, "uuid": "ea8d752d-0941-4984-b18b-7c64c55dcdc9", "comment": "Malware payload (Mirai)", "value": "5f3e85a3c17f643b04c1cac65e524fbcf1e1d7a4909f85ce3b076e6f999358d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046401, "uuid": "b66e7c43-c4e0-4d57-9036-f984fa15da3c", "comment": "Malware payload (Mirai)", "value": "c7adbe2077581626a6b5529b2bba90b1ac929b37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046401, "uuid": "258ff80c-28ce-4eb4-ad55-400ad2176a2c", "comment": "Malware payload (Mirai)", "value": "65699fbee93592e42e1fba22cbf9ff9c673e069393e5dd14c116fd71d2c9c124d516ff2380a9ab9399fea77c95617333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046401, "uuid": "da75a333-59da-4a93-bfb1-8d7fd1e7759e", "value": "T15B330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046401, "uuid": "b09c09e2-192b-44c5-ac49-ab09e514a469", "value": "768:gduPBFnHooqR8qOCKq2lH4Kg9e+TK806MMUVjzkfQXObHud2oGl:r/hqaJ5Dg9eqK806MHdkfQX6HuCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046401, "uuid": "31219fdf-6597-41f9-8600-e89045718026", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046401, "uuid": "bfee4558-d4f8-40bd-b0eb-92a1b9815e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046401, "uuid": "ba6f32bf-08a4-4a1b-b2c3-5fc75c1cc542", "value": "61248e4bd51f8c4e07f83ec7ef9e3e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d43cafd-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662036878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036878, "uuid": "cc9e327a-a015-441c-9cfc-c3308355676c", "comment": "Malware payload (RemcosRAT)", "value": "81e596db7c5119ab26df979b66539205", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036878, "uuid": "51c69f73-2d75-4568-aeb1-a64b74f1c35d", "comment": "Malware payload (RemcosRAT)", "value": "6161413b14fec8168bd83c9d954ff7c2d4fb8c2520a0109d064e2a45463237fc", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036878, "uuid": "4acb0d41-1325-4389-9a6f-c9077f87777c", "comment": "Malware payload (RemcosRAT)", "value": "509c28707baeebf05f0ed991dfb6041195ed436e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036878, "uuid": "3c64c4ff-8d96-4fc0-919f-90bdf2dd3c32", "comment": "Malware payload (RemcosRAT)", "value": "60fdb26ff8fac6fa4b32c00071fda40938b6c1c46d759e440e619d5e611f5b20318ce0b184a003bb9135ab0a0447a076", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036878, "uuid": "da874e96-68f5-4643-a41a-56265933f09a", "value": "T12DC4BE18ACDC77F2C823AF74A8B455A100E35D661CDEA79D6FC93578CBF2682790850B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036878, "uuid": "2e6f4b08-c5b0-4a02-a978-74262b11040a", "value": "6144:tGH2Yj8GDog/uSnHbMXahSShweK3OqE0zK4d28UmyQCpmiEjFHZhT4ZyPsr3YUku:sDoWB7SsShvbn+nlm5li2blylSx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036878, "uuid": "6d99a1a5-0b4f-47f9-9c96-5410a8c109f1", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036878, "uuid": "81825cfb-efb9-4a46-bed2-74916457b7b9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036878, "uuid": "1a4f4e6e-9dfe-4dec-9344-dd31d5f86a50", "value": "Consulta de pedidos Q3404_8 31 2022,pdf_1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc7474b-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049013, "uuid": "bbaaa01e-c70c-4a6e-8f11-a509bc4d7567", "comment": "Malware payload (Mirai)", "value": "08a451330e072b1a1c9a3e68e85e97db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049013, "uuid": "aca5f33b-6cce-4e31-8b5f-2b18b9a8970e", "comment": "Malware payload (Mirai)", "value": "61911659b178a0ffb8be069c4ccf90f40d0955677d3d47a4da278c6264c68763", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049013, "uuid": "0b62ef03-838d-4ac7-8247-b418c690f149", "comment": "Malware payload (Mirai)", "value": "9d43f7f1c5324dedfd1716b854c4b8f0d572a902", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049013, "uuid": "f69009a0-373b-4c33-893b-486e69604510", "comment": "Malware payload (Mirai)", "value": "0f3bbb63a2c1b32b674374d75b354e6b5103663f30b84384afb8068b6a2fa05091351748332b24efcc8fa00780f168ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049013, "uuid": "642daa32-1c7b-4e8b-871c-b019c58890dd", "value": "T13C331985B8C2DA17C6D423B7FA2E418C332563A8D2DF7203DD262F51778A81F0E67656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049013, "uuid": "b7eeb81c-7135-4f64-97fc-90e14bc6d425", "value": "768:iHWG+Yp5jFsaHlis6oppsQz/1Y/DhxUlQoJomTcSPpt5heu4j/NPeX1po4ut:JGNpD6o4QD1Y/Vx26mTcapt5Mjq8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049013, "uuid": "d1f5caa8-5aca-4fa5-a6b2-b05c84cfe493", "value": 54340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049013, "uuid": "827b61ea-b940-46d7-b18c-6540ddd51f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049013, "uuid": "f8852ec8-4291-4f94-828b-2ce600184266", "value": "08a451330e072b1a1c9a3e68e85e97db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb58f937-2a0e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662047935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047935, "uuid": "d54abe98-53b1-468b-8e79-7ab71c39dd2d", "comment": "Malware payload", "value": "d3596adf2297f27f212f70fe1649c4ca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047935, "uuid": "99f73cbf-2d78-42fd-b15b-7d06dd45b75d", "comment": "Malware payload", "value": "626c52f344777cbdb7a865aecca8d029c582377aa57216d381d361a5b400e9aa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047935, "uuid": "8377652a-b7e5-4797-bdd1-cd0a5f3ddf27", "comment": "Malware payload", "value": "beae009b96b352d4e5695675c3f1edffe2fd46eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047935, "uuid": "b4e5b2bd-15ac-40ea-99c9-f22141307e8d", "comment": "Malware payload", "value": "026d6d4d1d372ddba8b1355d7972abe5cdcc3958f165e751885a5d8a835194604f2cc4a77a8fc83c22631e191e2257a3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047935, "uuid": "a7637095-ae8c-494e-8dbd-00dc17f837f9", "value": "T1F185339D66E36016CC8AF97D42642C603C88B06A198F97F4FFA5760CD1CE3731D869B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047935, "uuid": "3c832293-3cb1-49b9-9306-5ce1232898ae", "value": "49152:tUgfht88Sz++JBBiZylOraZXBurJfoaTn1MT0Ju9F3:tUm2zliZyMuZ0rJbTn1+aQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662047935, "uuid": "72b0d301-53d5-489f-9042-8a917a098c3b", "value": 1740821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662047935, "uuid": "16cb0765-852d-4865-87e4-a106b8cbf3d9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047935, "uuid": "a15b4943-2e05-4cfa-8d63-669b3a024c14", "value": "document-253.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2648140b-29f8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662038128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038128, "uuid": "d537a7b2-e448-449e-9a91-0b3fa6658010", "comment": "Malware payload (AgentTesla)", "value": "3d49887a07b3c73b83e95c0c1262380f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038128, "uuid": "7baa072a-2403-4a0c-8797-22a876114471", "comment": "Malware payload (AgentTesla)", "value": "62822677450b45f73be0de50a2275d8eae1eba8a358ed56039904ff0eaf0dad3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038128, "uuid": "649d6772-d7ca-4951-953a-a4037378557d", "comment": "Malware payload (AgentTesla)", "value": "3b34a1dc278be94cf8ce90686cd1dc381f68e977", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038128, "uuid": "373e8e4e-f087-4b48-94b3-bab3af761e0c", "comment": "Malware payload (AgentTesla)", "value": "73fdbb91771c964729b27d87408f61259c1b022e4652e2ac145fe053b3067d6726da54891d14617d6fa82addc73f3451", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038128, "uuid": "846b3dd3-16f6-47d1-9432-1995390b3728", "value": "T1CDE47CAC749836FEC817D972DDA81D64AA9264B7174F024B855315BCCECC987EF180B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038128, "uuid": "c158d96e-0487-4552-87c4-6d6a37d1b31e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038128, "uuid": "bba7fed1-5a6f-4f74-8f11-8e1432002479", "value": "12288:6eQU9Dsni0FrLERpghnPlylSx13teAKOjp0aZAFOr7n2Kw:6eQUKni0Frsghnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662038128, "uuid": "1451fb77-67a4-4cc6-802c-e99c154a61cb", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662038128, "uuid": "1c53868b-9323-41ba-9df5-f62d02cfd45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038128, "uuid": "3aaa7899-2126-4b14-bf9a-39674fd63915", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15090fc-29dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662026846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026846, "uuid": "cbc46dda-1df6-456d-93fa-7dfd7f69891f", "comment": "Malware payload (AgentTesla)", "value": "30ac8be3e172337e371c4f43c7d416e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026846, "uuid": "22b83a38-2d2d-46e3-b5eb-12e3519f2c54", "comment": "Malware payload (AgentTesla)", "value": "62ef7325e09f2a3b30ad5891e477cee7e16f28e82be13cf1fc38743d47735d27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026846, "uuid": "3e289de3-652b-4bc8-9917-5c60f2efecb8", "comment": "Malware payload (AgentTesla)", "value": "b02b65ad7894a0cd4efa79eb3da0b3cad94c3887", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026846, "uuid": "4bbf47d4-4f4f-4846-95d9-3be737ed8783", "comment": "Malware payload (AgentTesla)", "value": "988c9ec8c97485fcefdc4756ad8761f74532d3144a959ec232593c17b1acaf627ca3f3f1c66bd06c3ef049faec4a6431", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026846, "uuid": "4d9e87a9-9f53-478d-9593-82eb6ef8dd63", "value": "T15EE47DAC759876FFC817D931DDA81DA4AA9264B70B4F124B855315BCCE8C983EF180B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026846, "uuid": "4058f7f9-79d7-4e0d-b62d-e5375e1cc48d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026846, "uuid": "92bbe223-84af-46f5-b4c2-dada6318ae7a", "value": "12288:Xc80bF2zUbhL2KnM66aTvcsvDLlylSx1fK1emiPk+dLFQxRCamdJIobFXAQEzC5g:Xb0bF2zUbNdnMp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662026846, "uuid": "a632ee88-9240-4c23-86e1-46d32e731525", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662026846, "uuid": "9eea124b-1379-4bbc-8351-e8350b343608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026846, "uuid": "b8447764-21e0-46a0-a5c9-6827ddb79a0b", "value": "Samples & specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cd39b5-2993-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1661994690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994690, "uuid": "2ca627ec-c7a3-44d4-bead-6d135497ea24", "comment": "Malware payload (Mirai)", "value": "32b2d5374d52687279db7c77c14dedc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994690, "uuid": "5d99d246-eadc-40d7-b73d-dd3f255c938e", "comment": "Malware payload (Mirai)", "value": "6480752895cf92fbe6694e6b7f215b5ed1c322a7834a62f6d4bd222d8bb78200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994690, "uuid": "06453d38-450d-47f6-b03c-879b6d10fee4", "comment": "Malware payload (Mirai)", "value": "aeb88bcc60542573e2baa71d9cba299fa039b081", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994690, "uuid": "e49b95c7-0f8c-4662-814b-210c17569078", "comment": "Malware payload (Mirai)", "value": "d6995f16a3c1f600f495ac32633acb9747936c38ccd8158016034198a7faabea0d01814bd2d550674a36bae4a7396493", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994690, "uuid": "d2fa4a3d-a065-4bf1-8e24-08812ae0e1ac", "value": "T1B7833992F9929612C1E5267BFF4E428C331257EDE2EE7213C9295F2137DB56B0E67010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994690, "uuid": "b0826715-94b2-4e60-be5e-8d414c526ea2", "value": "1536:xw4n7B1eDpxKe+k+s8SqvFfgr+wBvzA8/dzPQ24/OzfOMZvZ:X7S1gmmSqtfK+w1/R45ORZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661994690, "uuid": "fe1115f4-f2d1-46a9-9a45-0518e776cc02", "value": 87588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661994690, "uuid": "8ffda641-3984-4df5-91dc-d62dabb57616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994690, "uuid": "86e49212-7e1d-4c92-a44d-44e3be0db3c2", "value": "32b2d5374d52687279db7c77c14dedc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241612b9-2991-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661993887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993887, "uuid": "ffdc8efa-a1ea-4f5f-a136-8a75b312b812", "comment": "Malware payload (Smoke Loader)", "value": "c4b48fe64772a69fc982b860360ac450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993887, "uuid": "eb2c5559-88d5-48b4-b00d-b80f5db11aab", "comment": "Malware payload (Smoke Loader)", "value": "6532bd5446d54ee65404df30e1ef26ea87036f6e6d81985101db421ba17d25ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993887, "uuid": "2a8be8a1-cad8-4da8-b5f0-59346c57f51e", "comment": "Malware payload (Smoke Loader)", "value": "bcf545b471060cfc09c4bb3fe2be62bec3442c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993887, "uuid": "3d54c9ff-e2dd-449f-ad0e-3f18def8a19c", "comment": "Malware payload (Smoke Loader)", "value": "e09a5e0c5b1d5e15ade0cdefcd47b8bd511ace90517c3f4bb5acb840960d92c67b838705971facab7f3623d9181dca30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993887, "uuid": "acc05982-ee18-48f0-a589-1509eec0bc8b", "value": "T1E954DF227D82D476C45522715478CF916A7B1830367016BB377B277EEFB02E29A3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993887, "uuid": "d221096c-deb4-4fbf-bcf4-be9ce3b81422", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993887, "uuid": "ded7b4c2-98ac-4d94-b65b-b97b2bba46cf", "value": "3072:NXpZ/KFrsB47LSo8YPIn2X8+vGoqZNJuFGTkNVNS9aELqaxjIHE:Ju7LSwIjVZNJuFGSS8ETIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661993887, "uuid": "3fe67a43-a97d-4be4-a5fe-e7fa31aaa2f4", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661993887, "uuid": "c7068690-35ca-4dc4-9c97-84913cce2e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993887, "uuid": "daf7e291-f7e3-47df-9502-bbdea87b86b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca389c4b-2a25-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662057731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662057731, "uuid": "e8c2d316-5b25-44a5-a341-190d5f66db12", "comment": "Malware payload", "value": "b7c12ce33a5c2de80bcd7083d839df6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662057731, "uuid": "22bbb204-ef9e-4b80-925a-b3d3db7dce75", "comment": "Malware payload", "value": "65970760831f083ce65c5ec185f5c1d1c73217bcf600de567f2960b592412c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662057731, "uuid": "f34bf25b-179c-4261-ac04-81c845965c53", "comment": "Malware payload", "value": "6d2bce616fc00cafeb2ae4c5499305b36fcfb4f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662057731, "uuid": "4e3392c5-f874-41a0-8e56-2eda39648826", "comment": "Malware payload", "value": "4a33898c6117a12c3a41041bbdcf4f19e7d5826e1e9ab01a7838e8aaf49add06fa280fd14d03da58369007fc3e726e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662057731, "uuid": "c6d84aa3-cd7a-4403-80fa-e43c8fc7fe46", "value": "T13526339C3210328FC8A7C83BCE592D14EB0598674357DA43A41712ACAA4DCDFAF596F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662057731, "uuid": "02ac7935-8b12-4205-9f77-12e49194e499", "value": "98304:Ha3DFNglg7shj9/X92ZmvG+Hc7supSg8MXGBl3Qbf2jYpvRhzPQA:q23V9/X9pvL+sWKMXGwDEYVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662057731, "uuid": "8da60037-91a8-4678-a7df-313e5b3f4d25", "value": 4723712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662057731, "uuid": "debcdbb7-df78-4cad-9922-380bc201795c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662057731, "uuid": "9e4babe7-6962-4d6c-a951-5a279e51ca29", "value": "SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cc020d-2a03-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662043174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043174, "uuid": "fb909d1c-4043-4ff9-a66f-acb5da764be7", "comment": "Malware payload (IcedID)", "value": "63e7cb0344fe170ac4a9875edf284151", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043174, "uuid": "4c5ebf5b-1095-409d-b9b4-5d6bc089a124", "comment": "Malware payload (IcedID)", "value": "659f552830a406b9da48337d9e8cf6ec7041b51e81eb2e4d270beecb4aecfed7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043174, "uuid": "4f6e3cf6-cc95-4ade-848c-da709139eaf6", "comment": "Malware payload (IcedID)", "value": "3c85f0e4cac65326ab0a7151f37c37f34f2c44ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043174, "uuid": "3fd9bd0a-e847-41bf-99c4-4829d6840fce", "comment": "Malware payload (IcedID)", "value": "44396c2d641fb5a84e27341a3c67e47954b0f0e56a688431b16d0f55cb8ee5b7020d38d42b5664503781e4b43aacac98", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043174, "uuid": "09db2ead-46c9-41a3-bf66-a1e10491b06e", "value": "T12585339E66D36016DC8AF97D42641C203CC8B06A198B97F4FFA5760CD1CE3732D865B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043174, "uuid": "48baa1a6-3eea-434a-8b46-33f39e2663ce", "value": "49152:vUgfht88Sz++JBBiZylOraZXBurJfoaTn1MT0Ju9at:vUm2zliZyMuZ0rJbTn1+aQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043174, "uuid": "c05ace31-15ec-4a80-ade5-4c2c315fa1c6", "value": 1740831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043174, "uuid": "0d4399bd-9c6c-4496-8f10-c6b2606412e6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043174, "uuid": "fc72a1ec-306b-44a9-886b-1ae494190ea7", "value": "document-095.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849f8a4d-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049024, "uuid": "35da5056-47a4-4493-ab54-34fe063ab663", "comment": "Malware payload (Mirai)", "value": "ae88b30ab1ef3a411d5fc959991c3e52", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049024, "uuid": "a9f09f47-5c5c-462c-8e5c-74cc395dbb89", "comment": "Malware payload (Mirai)", "value": "660e900f56d7aea3d979b21e160eb4b0892b56303fa9ab3f6f9a993aa74ce6f3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049024, "uuid": "f7ad2750-c249-47b2-a653-b427915c0ed7", "comment": "Malware payload (Mirai)", "value": "4689720915a9f529daaab67d4897079963b31e03", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049024, "uuid": "f71ff852-d790-4d7d-af2b-f791832aa3c4", "comment": "Malware payload (Mirai)", "value": "0a7d526d3a3a5e0d6f68461199122e196ce4d1b23011c3185b2db26d059154350a01a6771742203dafff3c8d24a62f1e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049024, "uuid": "ad33d048-6ac0-4223-a8e5-b5b0ddfdf795", "value": "T1A6334A07B582C0FCC15CC2741A2B7A36C933797D023AB5AA77D0FA266C46D311E7E995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049024, "uuid": "f5cdd349-3d06-49e1-bfb4-8406fe0e081a", "value": "1536:sXO5jhhKeBh1dhCRBYxXuJxymM70SvtY2:Zjz7Bh1aRBY+y5DtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049024, "uuid": "6b37e36f-cc77-4de6-8710-62a0dc2108d6", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049024, "uuid": "0b2fd442-94a5-4022-b8cc-1172f448a918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049024, "uuid": "d9fcdccb-668f-4847-8562-0f5634e66937", "value": "ae88b30ab1ef3a411d5fc959991c3e52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65e8a26-29f6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662037538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037538, "uuid": "603ae29a-c1ac-4f15-9826-1d797a534138", "comment": "Malware payload", "value": "031c74a07b77fc3fa35983255bb4efa6", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037538, "uuid": "9d02b10b-8ce9-41b0-82d6-9f2a38cc6e79", "comment": "Malware payload", "value": "689e786c715df4b4c05b774ec478930b0e257e55217476a04bb07fc22e04459c", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037538, "uuid": "e982083a-9db7-487f-b18c-acbe2cea416c", "comment": "Malware payload", "value": "fc0d9d89a408859b35fb4fb407ecb9f5959b4199", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037538, "uuid": "909a5dfd-df82-4b09-8729-c1bb6054e44b", "comment": "Malware payload", "value": "8c5b2b84a703d6d556ac37a707f617c9d074dd295e02e566372d0136fab6a801ae1b0d032e66cb3a0404ce4cf83d065a", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662037538, "uuid": "17429c77-a3b3-4ae8-adfb-3522bea49835", "value": "T196B4A40EABEB3326C52371799F5F9004A535840B661AEC1D7D4C93880F5863D9ABBFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662037538, "uuid": "8faaded3-eee1-4c91-bd26-052e3e6ef438", "value": "6144:BQlRJCula6l4khEfDnxR7Wiagmd4iLAmWR6SSF:2bhEfDnxMiagmd4iLAmWR6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662037538, "uuid": "e5c8b827-24fd-4712-9ea1-39baed7a669b", "value": 495233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662037538, "uuid": "4de509c7-cec7-4c88-943b-5a7942515fcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662037538, "uuid": "fd93d753-8f9e-42bf-b204-8ea1915bf7ce", "value": "Specific_goods_agreement (fyis).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b969c3-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045318, "uuid": "a9620168-2551-4942-9e2a-b143f73a3cd0", "comment": "Malware payload (Mirai)", "value": "1f80d3b423b10853743ff3eaca6bb6a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045318, "uuid": "a612cf6e-cc92-43b0-a64f-e7ef09a2ca74", "comment": "Malware payload (Mirai)", "value": "68cf956baeae44f54195346cb399652177a114f016721d2460bc9868b231d83f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045318, "uuid": "0fb33511-93dc-4290-89ed-00854ee4f3ec", "comment": "Malware payload (Mirai)", "value": "2fe70265b17cb4766f04ebdc27c5fdbb65345b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045318, "uuid": "12d7f041-48ab-4f3d-9983-f6e743d592c9", "comment": "Malware payload (Mirai)", "value": "fa1ca96b69f375a2fd46d203f5aa9d93c1a18196913d6417aa515fb9c0ac897b190b7d05dcfd9ec45a864df931129910", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045318, "uuid": "707d5450-f051-49b1-a2dc-91998ca8cb8c", "value": "T10BC2D030F634FA62CE20ADF6D56D4D8B69495BACA1FF393705050D242FC268A66B5442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045318, "uuid": "46d708c9-a37f-478a-84e1-36a580a13021", "value": "768:4MKyhegCCMqfffArCPFznK0UcKzi4mtN3an69q3UELu4:PKy4qfffA2PFm0UVi4mqvLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045318, "uuid": "80678435-e531-4385-8d5d-bea0546c01f7", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045318, "uuid": "ff7470b0-78ee-4711-af1d-0e49b6865664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045318, "uuid": "02218293-fc79-472d-ac1e-8dba3f871209", "value": "1f80d3b423b10853743ff3eaca6bb6a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a501e8-29a8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662003843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003843, "uuid": "5c8afa25-ff46-4080-afc4-0d9eca41e1f5", "comment": "Malware payload (Formbook)", "value": "bdeb00b0ab6eb59e0a5ab0e0a456221d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003843, "uuid": "ea0ede9f-7718-4c78-a8bc-f6e6e51aa4d8", "comment": "Malware payload (Formbook)", "value": "6939b365fed5470febfa5bfb06794a72edef3148a88e2e35ec754ae2c6860bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003843, "uuid": "3a062916-c81d-4bbd-86dd-4ed2cc6c3492", "comment": "Malware payload (Formbook)", "value": "d706eb969ce771e71c8b99a7b89e883749aa1ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003843, "uuid": "06c18eab-bfa0-4718-a552-673251bf0da9", "comment": "Malware payload (Formbook)", "value": "d743e54eb27fd22dd15acc5bf6f3e4f563bcc3f0fcfd3a81f66f4cbd0c5f1aae92e2f92ceee84b68aeb8e3a9fee865c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003843, "uuid": "21c7f733-e89f-4c53-a49e-7dfec651fd55", "value": "T161E4125076582433CAE907F681E7898B67F93E49B850C6CF6CD430EE467639D6B02B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003843, "uuid": "4a07ba44-5cd7-464a-8bea-0250cf885f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003843, "uuid": "1d71b781-43b4-4886-bbb4-ed1219157607", "value": "12288:F9CQFu3XDG27cJQN0u8o/TtMVmocDe4Am28XtkGTOshm:LC1G2wmuUTimo8qstkMOsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662003843, "uuid": "889e5197-482a-455d-8154-ee9d33eab037", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662003843, "uuid": "ce506ced-b664-4137-8a3e-7d7bad25014f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003843, "uuid": "286d4fb2-9c4c-4a4d-b1ca-262d1d1babd8", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959fe30b-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030155, "uuid": "79bd5268-06f2-4771-9ed3-30d521907014", "comment": "Malware payload", "value": "1ce3d938f66cf051caf4c321a560db7c", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030155, "uuid": "3e99e5bd-be59-4d68-bfe3-68bd5515dae7", "comment": "Malware payload", "value": "69cf309f71c3240525d00a14be5d0390c99313e24b0b6fef1d034f90c69cdd3d", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030155, "uuid": "2335d772-24c9-4362-90fd-4bea717ad810", "comment": "Malware payload", "value": "24c9e28aaeccea2c4fe7767dd740fb763f84ab56", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030155, "uuid": "726da645-222a-4055-9e6c-14831f9cb198", "comment": "Malware payload", "value": "b6695d90c769c8b69d75c0d9babbb92f4f8f12f75a85d30dcf37e63d8ce5ad2b53d4aa94caf7b83f0ee18024c961dd47", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030155, "uuid": "a811328c-2c7e-402f-b29b-2df3586dad8a", "value": "T19BA312B575872060E1C3F172AE9623BE2B8C1FB4DDD50F19205A9E8175067C2A72DEBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030155, "uuid": "75417f3e-7278-4ee5-a962-816f8b583e99", "value": "3072:2+517cJOXi1jrJgI5YafixIFL44zqPnNSwQ:2014JkKpgu/fe4zqPE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030155, "uuid": "f4b06719-092b-4a67-b480-e289d645ab10", "value": 106646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030155, "uuid": "a8ba319f-520f-4bb1-93e9-7720d4ea6a42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030155, "uuid": "cfe4ecaf-69d1-4171-9f4e-24178dc618ac", "value": "New Profit Distributions.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb7efda-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1661999431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999431, "uuid": "a5b099f7-2ecb-4066-9544-985132223363", "comment": "Malware payload (AveMariaRAT)", "value": "5977ffe26f6b731bd77f275b68fb40ba", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999431, "uuid": "cd12fa0f-3880-4bb7-8872-6eafd7437b20", "comment": "Malware payload (AveMariaRAT)", "value": "69d866fae588d2fff94ff79cad594750c746807a2fcba81133dd12bb1466501c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999431, "uuid": "17c2eb2f-64d2-4318-984b-adc2e4b9cf64", "comment": "Malware payload (AveMariaRAT)", "value": "a845b39ecb45ec20b7165f6ae9796df36cfc9769", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999431, "uuid": "5d65b630-0b76-4965-a665-fa593f5d3cfe", "comment": "Malware payload (AveMariaRAT)", "value": "a618fae2f4129b80969047b8bafe26c44f99e1fd578961d2d783e7459753ab90a782f0cdd1729bd1c8a22d4ed6d77608", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999431, "uuid": "b44c3bb4-0e28-4c9d-bd82-e2587449a40e", "value": "T14DB5338511D12F01E44F1B3280769109B87BDF817DA6E7CE5694BEC7BB34BC8BA9640B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999431, "uuid": "5a04ecd6-c4a5-4073-8c61-93b9ef9d166c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999431, "uuid": "69f8bad7-81c0-4302-b357-dfe2f2497006", "value": "49152:dA1UwcT6RdvHNUZZFrNUP6GYGyDXFM2WNobVtZMwyR6nuUrUG:d8VcTo+Z5zGYG8XFM2OoJtiYuUrUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999431, "uuid": "cd83ca54-9023-4c1c-804f-d79404805856", "value": 2321064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999431, "uuid": "e4b1c805-2d68-4d0c-ac4c-1cb9fbfc2bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999431, "uuid": "b38b450f-0537-4a21-a8bf-ebc87dae9d0b", "value": "SecuriteInfo.com.Variant.Lazy.238931.17066.4129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36adf90f-2a1e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662054477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054477, "uuid": "2e6127d1-15fc-4e89-8ced-819faa9a699a", "comment": "Malware payload (AgentTesla)", "value": "67ce9ea925b4cb9084e54e19d98839cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054477, "uuid": "7878a964-ba1d-44ff-ac2f-da0859e2e86f", "comment": "Malware payload (AgentTesla)", "value": "69ea5623612ebcc3663f8d4d33e9d4688b3e5e2f127f42bd752a8610660bc885", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054477, "uuid": "ca64b5d5-c98a-4902-9621-6bee488c6d6f", "comment": "Malware payload (AgentTesla)", "value": "a27345e1a583064cef54cb3ea0d24746b5469dc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054477, "uuid": "33227b89-741c-4e18-8110-14080b2283b3", "comment": "Malware payload (AgentTesla)", "value": "6b4914be75afb223d5ad756a82ff9e08710efece747b82b756dda92b6562e2262d7d570c32bcd85583ea5efc59170171", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054477, "uuid": "11f9c867-9df9-4421-9a7b-dcdd790a7899", "value": "T13015124FD145AB22F4690B3552F0FB1242BE7F1AA2B3D78C4ED8D3F425ED319844AA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054477, "uuid": "a8d4656a-ce7a-46dc-9758-fddecbecee9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054477, "uuid": "321bc8da-6049-4e0b-8939-c7fea8a0f907", "value": "24576:1Z5pXY+mzo3bvjSYsHOlSSYfGPjm5Wft:35tlmzMLSYsuASYfGKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054477, "uuid": "4152caa6-c98f-4290-8a42-16e6bb042c6b", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054477, "uuid": "a7b3b766-1211-401e-8804-a82e486b2250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054477, "uuid": "06594104-957d-4c8b-8484-18529f690b28", "value": "67ce9ea925b4cb9084e54e19d98839cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b3b347-2a35-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662064434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662064434, "uuid": "d0900ba6-be07-4cb8-8a66-a5ce6bd0254a", "comment": "Malware payload (AgentTesla)", "value": "a2af51bdfa6e3ca2ed554ecfe6df29d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662064434, "uuid": "f7a4a0c1-f69b-4481-8e73-6da420c05ca4", "comment": "Malware payload (AgentTesla)", "value": "6a1335819e2935c84987e164ebd8e9e476c6523f1deec14ec635e4869aa2d8e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662064434, "uuid": "d032c5a4-f72b-456a-adb8-8f400906e590", "comment": "Malware payload (AgentTesla)", "value": "2b193a13af864f3d721e7c40292b15a79e6d43b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662064434, "uuid": "7a6cef36-e86c-4460-b771-32e758d093cb", "comment": "Malware payload (AgentTesla)", "value": "94dc98229cc1d41d4500915de6bad675d9b36728190f1b7032ae3aa78b4a5d0c7074ac799b74942f3a5684fe2aaf0eec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662064434, "uuid": "40760bed-68e9-403d-872d-4c07c5bd60e4", "value": "T16B8407E0327DC3D3D1A18EB11FCA867075F176ACACD0560DA0F99B2E93D2395149C9EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662064434, "uuid": "1605f3f3-c77f-42d7-9edc-07c50dcc14ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662064434, "uuid": "56bb60b7-4030-4506-a1d5-26358063e33d", "value": "6144:oOri7J99px3s3HH9YNv+Kv6qcio+b/Ufyf0S7PalKioMc:/ci3n9YNnciotf8awJMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662064434, "uuid": "89ccdbb4-3588-440f-aa24-40027e6b2f7c", "value": 390576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662064434, "uuid": "7b7c7f5b-3d33-4476-87c3-cca93f974eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662064434, "uuid": "06aada56-3770-40a6-a557-9492d4d90eac", "value": "SecuriteInfo.com.Trojan.GenericKD.61652288.32058.19719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf8b006-29e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Arechclient2)", "timestamp": 1662029736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029736, "uuid": "8c4cd5f3-04b6-452c-a18c-d21eef33075b", "comment": "Malware payload (Arechclient2)", "value": "1d0cdf2e0124911cd9a7b5d7681c6b58", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029736, "uuid": "3d1dc26f-3eac-461a-88c6-313c1828f6d3", "comment": "Malware payload (Arechclient2)", "value": "6b102d3201a020b3661abae52a8f7fe5c64606d6867fec17a7ebdde69d038e7e", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029736, "uuid": "c578f5c2-1056-423c-a0aa-7f91028ba670", "comment": "Malware payload (Arechclient2)", "value": "ca1dcf658488e63844f8610113b40c540911071e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029736, "uuid": "4847427a-f380-4aa1-a963-7586c1fdbb38", "comment": "Malware payload (Arechclient2)", "value": "a553ab881b5b01049c09e33558969f3868b3b2ce586db9dec0a03a01f34d8d366ba259e6cbe51c343f0d0982e8835484", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029736, "uuid": "31dc1e68-b872-48da-ba9b-6957f7fd8c6c", "value": "T10AC5E1D72C79D32CC318743F8099527D4AA59BAB2AF6CE387F39459751B1B82C82E134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029736, "uuid": "4a7493f3-a6cb-4201-aaf5-b913fdaa6aa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029736, "uuid": "0d45fda7-eb94-4c50-b20a-49ce7b30cbed", "value": "49152:fcO8NqwGJLZHjRPAafbxwI3TJbhYgTf1t:fctqwEHdPffbyI9lYgTf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029736, "uuid": "184a63e4-f0fa-4b45-b157-4b57dd3edd8f", "value": 2708992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029736, "uuid": "b180568b-fee0-443e-a010-9e1c29a80916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029736, "uuid": "38f714e4-fff3-4632-b400-4c57c237b9be", "value": "1D0CDF2E0124911CD9A7B5D7681C6B58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845e3540-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031414, "uuid": "e251535e-7e33-48a1-afaf-92f82d600911", "comment": "Malware payload", "value": "2855775e4ab81585564843f854917ff1", "object_relation": "md5", "Tag": [ { "name": "eldorado", "colour": "#A5AE80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031414, "uuid": "a9b60686-20c1-4b14-9780-68c1f7ab3922", "comment": "Malware payload", "value": "6b81bdfaa70fcef45f7c078659daaa0ef153c4b46a29fb88e3ed1669b1c3c1a1", "object_relation": "sha256", "Tag": [ { "name": "eldorado", "colour": "#A5AE80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031414, "uuid": "0daa6b37-62b5-4cd1-a5e9-31cf3b4e1070", "comment": "Malware payload", "value": "df46d90a14a244bf6d94a0a14506f65a955414b6", "object_relation": "sha1", "Tag": [ { "name": "eldorado", "colour": "#A5AE80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031414, "uuid": "00cddc20-b9e1-43ee-9958-b76aa9e05f51", "comment": "Malware payload", "value": "c0e6bf1e7d5efa9138b2c3bd18348b6eebd1b24c8fe61734b6b5a37b2718d4455be387e86e4c2a027fcf637e462bbd49", "object_relation": "sha3-384", "Tag": [ { "name": "eldorado", "colour": "#A5AE80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031414, "uuid": "e73e8244-770e-4912-9210-2add65528a53", "value": "T1AE26331196099873003D79ED573C6A486F9F2CA32E6361FDED24A41B0A731F3D525EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031414, "uuid": "d45b3281-ccbc-4b22-9030-3acf2a55de0a", "value": "98304:6UrZo7za8bFNf3xMMMMfKT5+lTtYgYfKNdX4/QFQOcQoi4vZT3aVlW:fOzVxNZ7ET4UV6d+Qr9XAYlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031414, "uuid": "3721ae98-f9d4-4fa7-9a14-04426716dcfb", "value": 4539721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031414, "uuid": "ed35255f-f1f4-4a47-8774-9994f4a9dd96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031414, "uuid": "fa2dd080-7c24-4471-afd5-3532544014ef", "value": "Processo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0727b4b5-29db-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662025621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025621, "uuid": "a1aac31e-e951-4765-920d-bd9a52a15ae6", "comment": "Malware payload (Formbook)", "value": "d836f401150d3edf804fb32e913cc1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025621, "uuid": "c25419d8-2a07-4d01-9f56-afd1ec4d1a28", "comment": "Malware payload (Formbook)", "value": "6ca39f7a18248a826714e89d6cb52e7f952d36d3f3a7be1b96c6a5a39ec4adfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025621, "uuid": "8090268d-1a20-4303-8b34-381bf9e8c25e", "comment": "Malware payload (Formbook)", "value": "b6b96c22be56065a6015fd27eac39cfa33d50848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025621, "uuid": "63b87812-edfa-4c59-8d36-36e6a0f3df6c", "comment": "Malware payload (Formbook)", "value": "52ead3abcc200748d2445dd2df1436f0b4003cf6e8444b4636ae9beee924b60e57fb65d509c068f7f08beb9afc97ac91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025621, "uuid": "ee73802c-a027-44b8-bad5-b8da7701f5f3", "value": "T195E47DAC759872FEC867D972D9A81DA4A69234B7174F420B845305BCCE9C987EF180B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025621, "uuid": "ab9d48d3-ef3e-4dde-9adb-7a5b788a6cfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025621, "uuid": "df50d2bd-228b-4e08-adf1-3dad4e6ecb59", "value": "12288:kqp3tdo8hIoADb+1AYjnc7AwYjSlylSx1LS+I6+a48P/t22FTrEV9jy+:kK/87Dbujc7AwY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025621, "uuid": "c5027aa2-7edb-4a61-8f6f-b1cc7ef07416", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025621, "uuid": "37dce665-a3ff-447f-8509-64ce1ebd0740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025621, "uuid": "6149346d-de46-4df7-ba01-7e0de1b8a2c8", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21361.14670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079f8746-29e2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662028628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028628, "uuid": "a3d2241b-b96c-4fcd-9498-71ae6c0f0a5c", "comment": "Malware payload (RemcosRAT)", "value": "1d415a895a309f14b319b2ec5a7638c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028628, "uuid": "7b660d4f-cc76-4517-937f-cc5a999e5c4e", "comment": "Malware payload (RemcosRAT)", "value": "6cc217441f8780bc18c66fcee6faeb8ec8b174056c5c8f316ebf64245ef5705c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028628, "uuid": "3e8ca41d-1603-4372-81ac-ba31ab0298a7", "comment": "Malware payload (RemcosRAT)", "value": "06a1b86806347aba4d5133aa58fc2885e7890fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028628, "uuid": "d20da5c0-5095-485f-840c-e7d98d1fc1dd", "comment": "Malware payload (RemcosRAT)", "value": "ecba5eee3b38b43a66a7850185b4af2ba2e8fe1c5b23a31aa723a55d2a47e0fbf7aa4839993f4bb6ff8cede0af8382a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028628, "uuid": "c92cd22e-1f99-4f66-926a-85a3c18739d1", "value": "T1B7E23B14AB9CC62FE1EF0F7D78A24B60127196522617DBC65ECC25FEE8A73004A15BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028628, "uuid": "de5613db-1c29-4278-bd71-a8602b76dd49", "value": "384:bkqVphj/NST0DaS1I9SkO5CNNmm9amcpMQiW4zmkZXOfq1HK2nkLChXP8YPzWM:bBjFST01eckOJiXbOfq1Pkm7PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028628, "uuid": "35a595e3-38e5-4ae1-9138-10ee7ce8cc17", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028628, "uuid": "60108256-0c35-481a-b95e-fceb62aaa17f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028628, "uuid": "5e4424cf-b1fe-47c7-86f5-b6f63e2bd30f", "value": "1d415a895a309f14b319b2ec5a7638c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6456ab1-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662022130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022130, "uuid": "837d05a0-a18f-4ad8-9b03-1e2487b32020", "comment": "Malware payload (ModiLoader)", "value": "7bcff50de0bbef9335c7f9ba464feba0", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022130, "uuid": "2baa8076-e77c-4003-a654-b16cacbf1d0e", "comment": "Malware payload (ModiLoader)", "value": "6ce7fbf453d1021df56a3faa1e9d07fe5c7be73633a1448ed624dfdbcd7c1f5a", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022130, "uuid": "b4cf99a2-73f8-4a4f-bc7b-8c5e08cd079c", "comment": "Malware payload (ModiLoader)", "value": "6c78116193a1bedb39f7b0d7a5df8bdd7a21efa8", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022130, "uuid": "ea0d5d47-542b-44ee-a0f0-c569b3a5c94c", "comment": "Malware payload (ModiLoader)", "value": "a3e6c56ff983b6d06b8834b6f021dba424e5b8e7641ad9c4daa158faf25095b00e09eb0f9acc8cd36e837f998850511c", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022130, "uuid": "08d2a399-6e3a-4755-8309-47e377e2a517", "value": "T129A423F4B0A144B00E671CE83B55BDA11A728FF8B5898EB772D2FD8D017515A82C97EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022130, "uuid": "b645bff6-7be8-4fc3-a92c-c5ecb559fe16", "value": "12288:LXyu5ccOKx5K7n6MCwhAyahFBfyojUlM9O5O:Li+cYx5tMCwhtY/fjYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022130, "uuid": "a334c2aa-a5e2-48a3-9e7d-4f3f257b5b00", "value": 479907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022130, "uuid": "a0d875e2-0573-4b40-9813-6a6fdc2dd1fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022130, "uuid": "dc011e69-17d9-4761-9533-d7f05fa8a8e2", "value": "EU0726620827_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56baa336-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662027902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027902, "uuid": "4cf1ec90-8f95-40d6-bef2-733fddd9de25", "comment": "Malware payload (RemcosRAT)", "value": "ee993c47744abbc83604745a3223d0be", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027902, "uuid": "7c8efedc-dff3-461e-8eb1-aac84fab0144", "comment": "Malware payload (RemcosRAT)", "value": "6d39cd3f97f697382735f9c0447d3475de1f423e081152f192980d5a7eaf8dde", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027902, "uuid": "5b809d4c-3ed7-4ad5-8e69-f2ac74a556fa", "comment": "Malware payload (RemcosRAT)", "value": "8b57342b8c50184b8bac539cece3850c195e9135", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027902, "uuid": "78facc65-bfdb-4380-bf5f-28e3761a203f", "comment": "Malware payload (RemcosRAT)", "value": "490247e2829802d39f6acf32d24ba10767ff41dcc22ec79632f120c782a5386af9ed465d34f7181abc51a7a2053befd4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027902, "uuid": "ee927ce9-fafd-4dfa-b3ef-580403d51495", "value": "T1A8857D9D7650B2AFC817CE768A685C24FA60B56A471BE343A05327EC9D0D69FCF110F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027902, "uuid": "b03437d6-6c0b-47dd-9c57-97e1884fb685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027902, "uuid": "315d23d7-fd7b-4e71-865a-1b4a6c3f52f5", "value": "24576:frMp0k5MnSX3UgV+FmEmjrZ5f9GgGSlQt5/AlnzxV6te3AmULftvrZo:frEB55fk/S2kPALrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027902, "uuid": "e81fd250-9d34-48bc-8509-59a33f0cdf94", "value": 1795584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027902, "uuid": "09758823-3932-4b6f-b2d6-2fedf258e85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027902, "uuid": "d4fa10a9-eca6-4d86-ac6a-cbcd4a87effc", "value": "ESTADO DE CUENTA DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff3bbbb-2a0e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662047835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047835, "uuid": "add99193-9276-4cc9-979f-6b84bcaa7add", "comment": "Malware payload (AgentTesla)", "value": "c0d366356b377da7209a8fec6a9ac1ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047835, "uuid": "ef30be9d-263a-4c11-82f1-77f449323835", "comment": "Malware payload (AgentTesla)", "value": "6db518f3a14d548d66d62e4274366b17f9a2f2db80721d042cec08cf0fe8d29e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047835, "uuid": "ce4faf56-9a83-49e0-ba79-c0c33b0d0bf7", "comment": "Malware payload (AgentTesla)", "value": "3477c2b96ce95e9a5671136f3052ae2161ef2adf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047835, "uuid": "081b9954-5a3b-4e20-a993-727acf627feb", "comment": "Malware payload (AgentTesla)", "value": "44d6d736deb6f2d9d480ca49c1048f3f21b14eea2b2c4faf7b28f6ca4da7103cebf3a4ec79610e5b4b6328e51869475a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047835, "uuid": "359178c3-280d-416f-a28f-7cc0fe993b39", "value": "T175D4BFC73B642922C17CF7B20269561093B2D1CB659CDF4A68CFB39827637C25D896E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047835, "uuid": "10fe8cc4-8b65-47df-987d-a7a60c213336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047835, "uuid": "2201424b-e2f7-434d-9fd2-f21a0b436e7b", "value": "12288:tmKN2RbKAlpWE8xussndAokp+P4wJKbh:EAuoE8YdAokkYbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662047835, "uuid": "dff5a135-7313-4193-bfad-577d258235b6", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662047835, "uuid": "a23040e9-8799-430b-9d89-c728e63bf9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047835, "uuid": "0f5fd698-1ef0-4f7e-ac6a-31932a3e04fe", "value": "F@H2CAF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81374013-29c2-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662015088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015088, "uuid": "8b02ff93-b91c-4741-a1cc-93d308c4f229", "comment": "Malware payload", "value": "7c8397018199935f3d4d7cdd94b0e52f", "object_relation": "md5", "Tag": [ { "name": "45-95-55-225", "colour": "#56E95B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015088, "uuid": "cfd1905c-3f3e-46e8-8267-30b833dba58f", "comment": "Malware payload", "value": "6dbccc88dc8b560f63e6f56edb85335e864b4e97f1960842542cd21c865b765b", "object_relation": "sha256", "Tag": [ { "name": "45-95-55-225", "colour": "#56E95B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015088, "uuid": "cd20e894-aeb9-4d60-b4e3-d46f8922c5ef", "comment": "Malware payload", "value": "27c42f580e67af187bf469a2751c7e429e9aa0a3", "object_relation": "sha1", "Tag": [ { "name": "45-95-55-225", "colour": "#56E95B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015088, "uuid": "f53e2261-c8ba-4254-9959-a6912d4d9627", "comment": "Malware payload", "value": "34ffac7c0f88c4bf36c4e13ea51077460139cdcd5101dc023c383b7f40a1b0bb869d67706b32012d5e6175f43afe07ae", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-55-225", "colour": "#56E95B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015088, "uuid": "40d03a19-93d1-435f-a903-1af6a50bc22f", "value": "T1AE1142DB50324243C519C5CF725CC83BF869F1FA584D7D1DF5AB8A3286159047D9EB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015088, "uuid": "75314999-3db5-4fb6-8fb9-9cfd8f62e0e5", "value": "24:hgjDxgMgIUgZ0RgEag2xXgvFgnYMg8sgPRE/RZgg:hoDxJXUS0RvaFXcFWqkcjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662015088, "uuid": "7428d630-4288-4a8f-91af-aa50f8c1ebf2", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662015088, "uuid": "ee29faf8-0a59-49d5-8527-1e5e06951da8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015088, "uuid": "81292c00-46a5-4dcd-b3c9-99352cd6ddf8", "value": "6dbccc88dc8b560f63e6f56edb85335e864b4e97f1960842542cd21c865b765b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bf4be4-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662028603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028603, "uuid": "06dd4b3b-977c-452e-b200-5c75cf44441e", "comment": "Malware payload (Loki)", "value": "528c71c3b59c7f1414e1ef48b2f28913", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028603, "uuid": "66913323-1d38-4577-a497-0ee5917a6746", "comment": "Malware payload (Loki)", "value": "6df12bc585c9e48b310080f2f6b7be82b6c8fd8fa9c4c571d21851506fb67be2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028603, "uuid": "50f71074-0fd6-4c12-b55b-120db1877b95", "comment": "Malware payload (Loki)", "value": "33b707e0211feb725f05b2a75ecefecd55ebe53b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028603, "uuid": "186c63b6-9a78-4c73-8c68-00e14c553b42", "comment": "Malware payload (Loki)", "value": "744d02dadf831835561d5835547397b29fe9fb5750c8524d1d181bc13edcd32f9d32c13f6db89d64f0bda07e21306fa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028603, "uuid": "481d7192-ec60-4b0a-9545-d4ccf7499538", "value": "T173D4F11DA2D48B26E57C1B7562B4A20243377B199C73D3AE4D80F1F95EEA3528A07F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028603, "uuid": "c7420d39-4e01-4ee5-a9d8-b65b74cb4f17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028603, "uuid": "40740e60-f7a7-432e-a01d-07f6673abe61", "value": "12288:1Sqg5SqF75eA2f/zNHqzzRBzeFDaDPUiJZwNVgSCTo4:lqZ5NYRHqzPaFWDciJZwNVgSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028603, "uuid": "ffc6d6fb-f105-41bf-b32f-58734a7e83c2", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028603, "uuid": "e289fd1f-1a79-4ac6-92e1-331262fd44b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028603, "uuid": "3ed9406a-f8de-43e4-ac93-29603106a540", "value": "528c71c3b59c7f1414e1ef48b2f28913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49396713-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662031315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031315, "uuid": "9ee79854-4a88-4a9a-967b-64e4448b6a4b", "comment": "Malware payload (Mirai)", "value": "8556156fc84f235322187644d27bc420", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031315, "uuid": "598a0a71-e5f5-402d-8326-45c3260a62c1", "comment": "Malware payload (Mirai)", "value": "6e6d41cb9e72ab8583d6b52ecc84b66d7a4e2a17b67cf9925886123f85be7af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031315, "uuid": "ae3ddede-d9bc-4031-b2c8-b926b2927fe8", "comment": "Malware payload (Mirai)", "value": "f33089810a1f6c891b7936c12502039bf351fa2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031315, "uuid": "c29a3600-9bff-4c9f-a88b-8097172f515d", "comment": "Malware payload (Mirai)", "value": "62a93e3e6e096b7f70ef6803bf6a20828dafaa7f35861c9aee5e341610990962276b2f497fe1405db2797991c26a094e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031315, "uuid": "42dd03f4-21a9-4238-9ade-a4a30fdba91c", "value": "T1F073B709BF651FBBEC5BCC3709A92B0129CC651A31A9BB367934C818F54B35B19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031315, "uuid": "93794dd7-24fa-4523-a393-b83c0916bf57", "value": "768:PHJhp4AlIY4nJ3nPPjr4MJKAeK5bieueGie4tDiKGZnojXiaQuyuJhcwHHHHHHj:PHJhWAl54VpF4z/iXtDi3ZnohyGnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031315, "uuid": "9f35bc9a-b466-409a-a854-874dfdead727", "value": 73400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031315, "uuid": "069adb60-fabb-4d85-a0cb-6867e8e58441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031315, "uuid": "6c2f7c02-71ec-4775-88c0-a36de164f5f4", "value": "8556156fc84f235322187644d27bc420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d370d9-2991-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661994081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994081, "uuid": "220bd3e9-3607-4a2b-9c05-9e88f406fc0b", "comment": "Malware payload (Smoke Loader)", "value": "1e5d1db3276b608185cfdd3023a391c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994081, "uuid": "dfb58e07-94fd-452f-8adf-77a461228e62", "comment": "Malware payload (Smoke Loader)", "value": "6e73952f008db91861351b32712cc40ce98df5436e84169ebc3ac7e60b5ab7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994081, "uuid": "407a98ee-8fc8-4d57-acd4-9e3ea390d470", "comment": "Malware payload (Smoke Loader)", "value": "a9e37a7ef0e1a6ff1ad04298ecbef1f0dcac6f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994081, "uuid": "a70bb7d7-1c7a-473e-8027-3856c772b679", "comment": "Malware payload (Smoke Loader)", "value": "c536f2e2747f596270e181f8732079fc0d2bc01ace06edf1e2f7191d7b72ac05d340302b68b08035cd57886b94311c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994081, "uuid": "cf763640-ce87-4abc-b6ca-8d5f9b5362c3", "value": "T10154E012B683C472C05601705874FF906ABF79313A74CD973BB92A6E6FB02E2953631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994081, "uuid": "ca59a2c6-3cd4-4a7f-bfb4-7b61c978e0ee", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994081, "uuid": "ec4a0256-0fa5-4d02-bfc1-55992c85931d", "value": "3072:oXkoZCOmk5Lmo0xPHF2XPMnNpICrP0aQJ2v0w7egW69MFUGqot:8RLm5HfNpIeEJgH73J9MFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661994081, "uuid": "3358b165-da05-4395-bdbf-6a5edf99b293", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661994081, "uuid": "73ae0a21-d8da-47ba-a0ca-45be3e575c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994081, "uuid": "ece631d0-5820-4eb0-9896-b1bdcc771d34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f176ff4-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032157, "uuid": "2ed88941-e0b6-44d6-9d05-64afa74265ee", "comment": "Malware payload (Mirai)", "value": "a06ec6d088fc0a69f1f82d808c574491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032157, "uuid": "67ccb214-10ca-4593-9ac9-a673d44b3615", "comment": "Malware payload (Mirai)", "value": "6e80754be6c2cb08016000e30baf870c5e56690c0d022508cf5c5edd05b7fe38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032157, "uuid": "fc2345af-16a4-4759-b201-3ff4dbda41b5", "comment": "Malware payload (Mirai)", "value": "d894a0a9efc025b5d660f28692d5bf25149eadfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032157, "uuid": "a4ad0e84-ae4f-44a7-a0f6-41a8b21dc84c", "comment": "Malware payload (Mirai)", "value": "b3c8c4beb18b046a973ba6b3923bf3ef4821cbd7bb6842a9d297dbfa06e4bdc81927c23f2c8f9bbf24bf7131538e7a36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032157, "uuid": "86a2f3e2-81ab-4020-a4c7-a7a057975252", "value": "T10C433A25B93A1E27C4D5A47A21FB8B55B5F116DE26E8C90E3D720E4EFF206406503EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032157, "uuid": "3a97d32d-498d-41ac-885a-edd08db4a3a3", "value": "768:qEo2zcD72H/NIq9skYCrQOFLrXoSZpE1jM/5O+Lj6h9V:qEfzE72H/NISskYCrRFLToSmI/Zq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032157, "uuid": "9f28bee4-5fd8-460d-8da1-4b3742b9a055", "value": 59064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032157, "uuid": "f5ba3a05-5944-4286-81a6-1a2661294cc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032157, "uuid": "d6837ac9-a82f-4667-9e78-d6ae15fa5337", "value": "a06ec6d088fc0a69f1f82d808c574491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70018b26-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662048990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048990, "uuid": "7ae469ad-35c9-4b6a-940f-72c7474c3403", "comment": "Malware payload (Mirai)", "value": "f9843c46a304d7b6cb78528c7036f929", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048990, "uuid": "53388c82-592a-4af8-9f9c-f7c7d30e0dab", "comment": "Malware payload (Mirai)", "value": "6efd18a0b4c6b3a32bff7c7c5d2c0ecac962b5555003d55dd4669ba116d41dcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048990, "uuid": "df62dd23-f689-4f1c-bab8-16e18ef03445", "comment": "Malware payload (Mirai)", "value": "6a0b346d66ec0aa9cb9b5fcb1584c4e02d91d601", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662048990, "uuid": "7d466aae-fab8-4dad-9371-2374e1ac4c15", "comment": "Malware payload (Mirai)", "value": "649240ce59cb9a026ffb76fef9117bf745f7c8387245cca18e203c5c45558c7e521a5067ef5e5a2c93cc734c078e83b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662048990, "uuid": "06e7a24f-dfb6-4a0a-bc3f-a907331f8335", "value": "T1F0C34B46EB818B03C4D51776BAEF42453323A754D3DB33069928AFB43F8679E4E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662048990, "uuid": "c0646d70-02c8-4ebd-9aa8-e26415f16dc6", "value": "3072:T4OnW4g1UVg3Ays3Isk5Cml4/zC4vFKuM/99t2Frq:T4O2UUZs3Isk5Cm4/TvF/M/92rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662048990, "uuid": "d5bf22d6-6aed-46a8-b1d9-9c4e988482b0", "value": 128110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662048990, "uuid": "a94b2645-0a8a-4437-833e-ab774e04f67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662048990, "uuid": "828bebfb-2e51-4cf3-85bf-7dc437423cc6", "value": "f9843c46a304d7b6cb78528c7036f929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5d47b2-29a7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662003292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003292, "uuid": "2104d310-bb94-4a60-9b73-3b6f34038d49", "comment": "Malware payload (AveMariaRAT)", "value": "1b4060289c038aea99dbd67a896d6261", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003292, "uuid": "5ffda688-b181-487e-8dab-c8c80813cce3", "comment": "Malware payload (AveMariaRAT)", "value": "6f7ea0e3de89bc5268acd92f437c24021f69414cf56127870deae472ce92a839", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003292, "uuid": "bcadd4c6-e3d2-4046-901a-cb1a330122df", "comment": "Malware payload (AveMariaRAT)", "value": "98ac5c6c99bae2a04812296f693aab1990d3a515", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003292, "uuid": "59dfa0c2-06bc-4f6a-a3fa-c81b7dc9d8f8", "comment": "Malware payload (AveMariaRAT)", "value": "a2b42a3635e468979337adeb2e69be377f85c7e40592b2fbf4b02c2bc5abfb17b933709c17da240a87f9ba9076a8017d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003292, "uuid": "7f8e339c-95be-4d42-83eb-7ee3a28114b8", "value": "T11BD49DAA3BD0AD55C47D7BB4BA7402A4A3F291C34916D78789CCC0D8B7766C36CC16A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003292, "uuid": "f9834562-09c7-4f26-bcee-6be95421c03f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003292, "uuid": "e1bdcfac-79dd-4dd9-8e8d-4b7eccd63ad3", "value": "12288:ioW01G6YnaBttclE9za6ajKgMgksk/XpWBen91TL:/W01G6YnaBttclEJ5augMek/5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662003292, "uuid": "37a6cb1e-7ee8-4d21-83a3-25c705007ff6", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662003292, "uuid": "15dea304-2496-479e-bfb0-05be3bdc134b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003292, "uuid": "6f8b184c-1f6f-425b-a36b-2bae7a2973d9", "value": "isarity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac65d39-2a02-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662042592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042592, "uuid": "ce7c2481-5673-48bb-8afd-1711fce141b0", "comment": "Malware payload (Gozi)", "value": "e9f7a2e525042405c3d3437e4b8729e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042592, "uuid": "06c74b11-ea67-481c-b5ab-1d64b708b54c", "comment": "Malware payload (Gozi)", "value": "70028ff40b0cf66afd45ba68b433061f11fbf604786776370a8bafe7c5e92c8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042592, "uuid": "f1391857-df9d-4e23-8e1a-13e41479967b", "comment": "Malware payload (Gozi)", "value": "9e9b32609d47db0d440e12cd624d38d635ea8724", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042592, "uuid": "82413f57-926c-48d9-b00c-97496a3f3d00", "comment": "Malware payload (Gozi)", "value": "3eb6bd60b73d8ae061e09a19b6f93f8d77dd9febcb3db5e3e021293e04be5132ece9eed082f532f435843b17b3718e1d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042592, "uuid": "78d8603c-44e0-4c3d-adab-feb6c522be63", "value": "T1D3137D42B6F94CF1C3A35D707620FBB557FD863122385095AB27A8CA1D64963E63E30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042592, "uuid": "5f73acb1-d37c-4b0a-8f87-e958da0a258b", "value": "768:hlYhzJ2VQEFfLCUeQCuu6Mf39Y+RMRZOz43DMB6lvVp98:hlYhzJ2VQEFf/2VYuAZOzkDMByH98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042592, "uuid": "bb70d2a3-65a4-4f07-9cd0-9a32977deb53", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042592, "uuid": "68823474-b520-47d3-a399-fbf1afa49faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042592, "uuid": "725d7601-205d-44eb-bfa3-95a2474bc4c6", "value": "3380000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef497e19-29cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662020856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020856, "uuid": "b0c58922-e2f7-48da-a361-684d6c284d80", "comment": "Malware payload (Smoke Loader)", "value": "0f7c55ffcf117eb4bed32dbe087aa6c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020856, "uuid": "e87f841e-89c7-4da3-91a3-f56bde229d24", "comment": "Malware payload (Smoke Loader)", "value": "7187f7ac49e22bfb1be3b864b0538e13c0369fe2f2d21143527bae15cf51b586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020856, "uuid": "9560edc0-e868-4e55-b4cd-8ac98e0f051e", "comment": "Malware payload (Smoke Loader)", "value": "7c14ce5ba1636f026a0599139a8d78846fe5506e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020856, "uuid": "17329d10-8708-4d68-84d9-54c3a173253e", "comment": "Malware payload (Smoke Loader)", "value": "1b25ab27d4fe223a297c682f41b001b66df0ee1fe20ae26f65984e53a1b7b2f69281b91f7aa496ff3f4932484e73bada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020856, "uuid": "ceeb4c93-84a1-4338-9de9-fd98f6f4a1fa", "value": "T1C454D0027692C0B3C7460471546CDB905ABB59301A3055873BAC2BAEEF743E19ABE73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020856, "uuid": "260e46c7-c30d-4c00-8093-6fcd6750d7f0", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020856, "uuid": "4d5c73c5-debe-4a33-b6a8-8f5b946f403d", "value": "3072:1bXZx2i5O94Lpi2Rr2owiUZbrreodxzpOzjQD+Eb8sxTaP:JBL02aioXpO/QKtskP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020856, "uuid": "3758a268-24b1-4d33-b07f-112e5fe632c1", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020856, "uuid": "064f1645-00dc-42f3-a437-5af234017135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020856, "uuid": "d790e841-6d0d-48b3-8afe-f74c8f65bfc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661e20b7-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662043389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043389, "uuid": "b9043d5f-873f-498f-9a19-481f8a2ebc99", "comment": "Malware payload (SnakeKeylogger)", "value": "b73e69063aeedd1d1e6bc448a0746ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043389, "uuid": "8968f67d-e0ca-4fb2-a320-231ba1545438", "comment": "Malware payload (SnakeKeylogger)", "value": "7193e10884ce2c683097150a90d172b4af4b0c467981eaefab172d27d51ba83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043389, "uuid": "c71f6b17-c2ce-497b-a480-d6a685cedaef", "comment": "Malware payload (SnakeKeylogger)", "value": "9a30cfc17b5a0ba2aa789bddfe29a7ba37c7c3ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043389, "uuid": "2d29542d-808e-48d6-8c5c-ac92df32a39c", "comment": "Malware payload (SnakeKeylogger)", "value": "655100c95477d1c875fcecc6fcbd247c63d1044ff2ceaa3d60f73104b7950c46d048f85928f6544300b56069fde4355e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043389, "uuid": "05397f3f-327e-4b2b-bf2d-586899856fd3", "value": "T16D05121B8188AF27F45D1B7546B1F75282BF6F0A90B2D7CC8DC8E2F415DA32A8447A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043389, "uuid": "56652be8-870f-4aeb-86f4-64fd05d77792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043389, "uuid": "f3cb030a-d2a6-4287-a92f-2a1d8b90d432", "value": "24576:4Z54XY+mzo3bvhWLsjFRlThD1+x41dbD:65mlmzMZVjFRl7df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043389, "uuid": "7098f3cb-7e9d-4624-b637-9aaad1c80ed0", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043389, "uuid": "386c5704-337e-4806-9205-b58cd45598d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043389, "uuid": "c59ddbdd-93df-46f1-8dba-623d88d56883", "value": "RFQ-224310-URGENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e096c88-29d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662023646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023646, "uuid": "c9c84617-5632-4105-958e-957023b547b7", "comment": "Malware payload (Formbook)", "value": "edf70a1f11fa59287f8933e7874d4e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023646, "uuid": "568e7a72-5795-4e85-b302-cfa5df5a2914", "comment": "Malware payload (Formbook)", "value": "71b8d65f48ae74c35083b832b4ae5acb5564f744e5895a666f332392bce335cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023646, "uuid": "ae3a03d7-3e02-448c-9bb3-1381c87fc2ae", "comment": "Malware payload (Formbook)", "value": "3bd5579a32e3dae10ed9bf57579faff557f45470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023646, "uuid": "d2d5c3c0-cb4c-4aea-966b-9ba542f697b9", "comment": "Malware payload (Formbook)", "value": "00887325e40ede8864f8df60c71e4e0ee166112e58ceb3cd69e89bc44792302a258549cdbf2cc39b518e962ab89e6557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023646, "uuid": "c145d33d-60c4-4705-a037-07cb9fcdfd15", "value": "T198F4F17C33F2789EC867D17595A8AE90E6D07A36DB1B8207F4932159E91C6C3AF040E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023646, "uuid": "758174bb-5362-4c9f-9945-9fb621cb7422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023646, "uuid": "8a6c3d61-45c8-446b-8110-559c94ea03bf", "value": "12288:jGh6n4qr2yK8gxKxjxY+/qyVvZnaudLi8PArTexy3Ai8ONT2RZllEHslgDaDajSL:x4qrNgxwKyVvZn/dLi8otfNTyZbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023646, "uuid": "938790cf-dad5-4838-a1ff-38d57a0ac1c1", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023646, "uuid": "afe09067-27b4-4917-b83b-4422bcd9f702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023646, "uuid": "81229a1e-94bb-49a1-9abb-e6d8e52ceec6", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c361a971-29c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662015629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015629, "uuid": "95c56b3f-6c9b-4547-9642-9b4b5c11d258", "comment": "Malware payload (RedLineStealer)", "value": "c7013aef43a09a5eb3388f5a24dc3b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015629, "uuid": "7c10d844-c6f4-4240-b0f3-7994c3f506f5", "comment": "Malware payload (RedLineStealer)", "value": "71fa97186baedff5fd6ec8a79d4c69d23971d32bd8f3daeaa3024fc0114fd837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015629, "uuid": "6c40999e-5ea0-4f55-8142-1f91e6815b70", "comment": "Malware payload (RedLineStealer)", "value": "c9e9a819fae184e3ba183f35ccbc9115986fcc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015629, "uuid": "d7a75344-ee34-41a3-b7da-2291cc85dd8f", "comment": "Malware payload (RedLineStealer)", "value": "b4f29086c69dcbfdd8a6ac6be4ae070dfc7f272aaaeb4a2ee4f153932f6e14bc6398715a9f42c0f32ceb00ab8aefc02c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015629, "uuid": "c0b26557-bd26-4ffa-89c2-a9bbb95d1198", "value": "T17E94CF00BB50D435E5B712F4867A83B8B93D7EA19B2450CF62D42AEE57346E4EC3274B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015629, "uuid": "8938d556-717f-4221-b6d9-35ac01b9d18f", "value": "4db796e91aae86e704dcb04aa42dc347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015629, "uuid": "00065c79-5deb-43a8-88ef-78ebf8a04930", "value": "12288:wKCWaseqJj8FozfLL9OI2XyRe3Cw6WBmCNbdqln7:hCfqFao7LJOqCCFExjCn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662015629, "uuid": "bdb8b8c5-235f-4006-b660-380449794b69", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662015629, "uuid": "9be79b8a-4378-4718-8c35-0e5ee01d9ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015629, "uuid": "8520c7e1-ddd8-4559-b1d6-e788770ed64f", "value": "c7013aef43a09a5eb3388f5a24dc3b88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c981bf-29db-11ed-93bb-42010a9c0043", "comment": "Malware payload (StormKitty)", "timestamp": 1662025622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025622, "uuid": "51c5e124-cdfe-48a2-8617-af3d2efe2e31", "comment": "Malware payload (StormKitty)", "value": "8668c25b4e8464e417ada25633301695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025622, "uuid": "6d12dea0-c4ba-45bb-a015-7e48c099ee68", "comment": "Malware payload (StormKitty)", "value": "723908e3440a1ab93c3084d88aacd9b1820449e8f47a7eb80b66e7766c82103b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025622, "uuid": "ba7507ff-2ef8-4606-9fdd-9dc1eace569d", "comment": "Malware payload (StormKitty)", "value": "f618db1a47678d47fe5685edc3478dd4e7d74b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025622, "uuid": "985a7d37-80ab-4eab-bb24-3f6271484ac8", "comment": "Malware payload (StormKitty)", "value": "7a5f218c97ffa9ef51e1cf4f34d804d5ed3edf24e420f2daadcfe7f77e424f79c093a382c1982081751767515813136c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025622, "uuid": "0b152e86-33c0-4b0d-a9df-b1cf15ff7b92", "value": "T1FBF30282A3800593E6FBDA3EF2BD52452B35E3016EE2473AA46DD0679F43394315CA6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025622, "uuid": "9b7a1688-874f-4a51-a38a-0cda7be3d45c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025622, "uuid": "13bebe87-82d3-41d1-a17e-6e886e1435fa", "value": "3072:4YCZu0GWBjbtc3kBKCMMluT5OJgG6xUWecuqzi7Vzl5+1kb5lPkhDXH4MhDH5ALl:VS7tRXTe5zG6xUWecuqO7Vzl5mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025622, "uuid": "65ac198f-b4d0-416f-bb7c-64789d015e4b", "value": 172272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025622, "uuid": "926ec207-3b43-4f59-ae98-8bed3ec21fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025622, "uuid": "b7d08054-9d5f-41ca-b28f-7ab091cc9657", "value": "SecuriteInfo.com.Trojan.DownloaderNET.345.6235.25440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65313923-29ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662033080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033080, "uuid": "5a482f74-6bfc-403a-ab08-d3a82d694a53", "comment": "Malware payload (AveMariaRAT)", "value": "e60012bf8bc5a5bf74f80d59a942ba51", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033080, "uuid": "0e2e3bd5-7e3a-44d0-a623-5e2de2f7b00c", "comment": "Malware payload (AveMariaRAT)", "value": "72439a86a6cdf9c5a438a126903523591ae2bb488b1bd7a89dfe7c2c6e05ef7a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033080, "uuid": "d2fab4a1-dc6d-4105-9edf-7d2f6ae8bd54", "comment": "Malware payload (AveMariaRAT)", "value": "e353e15d295be8714e1260fd1d625a39776b7ae3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033080, "uuid": "ed0c25c0-3b60-437f-98c3-a6bcc3aaf0ac", "comment": "Malware payload (AveMariaRAT)", "value": "74a48fd0f7f7379b4b171c45cfeaf5e24b3a5221ca4342f65bcb9f621bbdca6a200ec8187950995672cd4d0412a8d462", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033080, "uuid": "c92c295e-4689-4812-96c0-91078ce81ce8", "value": "T170E401803AAC67A6E4B90BF94416CF4847746CD3E92DEB4A2ED1F2CE1532B60C45476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033080, "uuid": "33aec38a-124e-420c-8e9e-337e15461639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033080, "uuid": "e2e00fd5-9de5-4cea-9e1c-d474473a6957", "value": "12288:/cmRBuEHslgDaIZJvqcHsNjFVOueFOc9DU32ZXbK+i2ZmeDWqNOAPcWC0AMB46n:/juCjZJFMFxlcFZZBQu9G0Ait", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662033080, "uuid": "00b8e38a-d311-4e73-8d71-51b47f08a330", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662033080, "uuid": "e1144289-cd13-417d-ac4b-e2e04f82c5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033080, "uuid": "5007a995-4659-461a-910d-75c1e30fd6c1", "value": "Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ea98b3-2a3b-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1662066931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662066931, "uuid": "5a9c1f60-9c7b-4bb6-b6cf-9778af0c44de", "comment": "Malware payload (njrat)", "value": "00134d170f4ba51a549e1b1d0886c0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662066931, "uuid": "e3109f8b-2d81-48c2-a88a-63bed296e231", "comment": "Malware payload (njrat)", "value": "72a107eca1b503eba9d0e966f18567a2abad84614d8fec19b9704613c019f2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662066931, "uuid": "e9f47dff-95d2-4685-a8ac-153c0f970c3e", "comment": "Malware payload (njrat)", "value": "58b70e231da1c32d8cce5bd304662003dc630fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662066931, "uuid": "839b9fda-48ee-4c07-ab03-1efae89c5b91", "comment": "Malware payload (njrat)", "value": "cdb4b744ff54e22aaedae17883a015d2fc23a6f11973308e1f63176f5581c68b7a243e73e27ab6b901524b3e77673722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662066931, "uuid": "9e087511-8175-49b1-8f9d-9f6926646fce", "value": "T1EBC2D04563A0C423CC168B756FA293C0B3E0C1D1B9F68D36AC6C1EBABDE5AC50D63291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662066931, "uuid": "c30c5c72-85be-4bc6-a0bc-d9d49ebabce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662066931, "uuid": "621315d9-4c41-466f-9305-9cd22bc86f03", "value": "768:svpLJdeWaUjZwpZbNUqqv8jwJEip+16A0:QnGUjZqpZj+Eip/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662066931, "uuid": "8f637b06-112a-4718-9733-c033ca88367f", "value": 25981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662066931, "uuid": "e6c0116c-88db-4038-8341-bfd591bf4513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662066931, "uuid": "4ee31691-1fc0-4f13-9b4a-1eaf849923f4", "value": "00134d170f4ba51a549e1b1d0886c0ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a2e5a9-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014643, "uuid": "4d411710-c2e8-4f6d-8e18-6e5e767a659a", "comment": "Malware payload (Gafgyt)", "value": "871b3f78a9822ddc53c0d2fd12ba841d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014643, "uuid": "1b2463dd-e0d9-4ff4-8ae3-dd591bab7fb1", "comment": "Malware payload (Gafgyt)", "value": "73bf850857f66cb9b382430d97970020aa30bba321ea9bbd133bf63557bd94d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014643, "uuid": "b5ce7681-0eae-410a-8b5e-bb9bc62fd20d", "comment": "Malware payload (Gafgyt)", "value": "c2eea7b9d777d51dfce26875d16eea5ab8be8aaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014643, "uuid": "f29ef6de-5c2f-45b8-a0c2-c6347d0ee85b", "comment": "Malware payload (Gafgyt)", "value": "f2f7bb9e8dada81245e16c4842fd711617c439234f97aa12ac9fe93393dcb17b4abf71fd6493779011ca8c45d6877ebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014643, "uuid": "20fd59c4-ecb6-43b7-9ec4-c231967581ef", "value": "T1FA93F892B900DFB6F40ED77A08D34724B670FBA24E531672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014643, "uuid": "2f2b10ba-17d1-4824-8a09-625a65d6dae7", "value": "1536:4wZuvdpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gu52fPy6Vk/TmQ9VqXjewf2Le:B0p09W6KTG/IB6Yy36XAPTVkmQ9VqXy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014643, "uuid": "41cac187-ce62-4435-bf24-45a578e7472d", "value": 91080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014643, "uuid": "7d301a93-9da1-46b4-a7f5-f1b61b074553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014643, "uuid": "f0ba8649-aace-410a-8439-607c945095c5", "value": "871b3f78a9822ddc53c0d2fd12ba841d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea30204-29dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662026788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026788, "uuid": "9fe80802-53fb-41c6-aaae-bf77de66f8a6", "comment": "Malware payload (AgentTesla)", "value": "4e93d83cd7a8650fa7c9fc2161872a7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026788, "uuid": "8da2220d-da94-43e1-8941-fd740b2dc33f", "comment": "Malware payload (AgentTesla)", "value": "73c264494766fdc3eaf30eed3b18fc37886ff1c8390a75365bcd0b53f44172d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026788, "uuid": "15e0a1b6-f71a-4073-8c2e-0ac721bd01ac", "comment": "Malware payload (AgentTesla)", "value": "d8a6504a788d608c6d331c9ed2439eb7ce4eb26c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026788, "uuid": "d30dcd17-2680-48e8-a675-708a70c39393", "comment": "Malware payload (AgentTesla)", "value": "94494990d71630e9c73edb851007f25e0441e41c57cc15f932c77b7e07e5c3556a36d044373202ba2d63c900e5ddad8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026788, "uuid": "4e51731a-cdae-4fe0-9459-fcdf4b9a9120", "value": "T120A4235357A0AE29BACD97F4141F89C898BBC1693B904F0E1B2AA47DD245C92BD7C870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026788, "uuid": "2be3306f-3532-432e-beac-44e87219298c", "value": "12288:rl34xCytuAIClSQEE9xK/k8Y0kvpRmw4E:rJ9ytxICzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662026788, "uuid": "68cdfe1f-7434-450a-9088-7058fb7ca44d", "value": 470353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662026788, "uuid": "98cd1108-d9b8-43f9-8896-9cbe1a2b9a1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026788, "uuid": "1295e040-5490-4cee-8ab6-fb23463af1a3", "value": "Samples & specifications.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f382e321-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022152, "uuid": "40e5a684-4dde-4707-8997-9b8633b8c903", "comment": "Malware payload (AgentTesla)", "value": "42441cee2fadaef1129fa2c457ed4e76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022152, "uuid": "519cc68c-c6bc-4c92-8f73-105150fe54db", "comment": "Malware payload (AgentTesla)", "value": "7463140cc9be6bc11110eebc1767da6fcbda10a1e0aa599fac7316003d138772", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022152, "uuid": "c80681f0-7a98-4a69-ac1f-96c7506301c2", "comment": "Malware payload (AgentTesla)", "value": "9d5d668edf049443634438b91cd9136711658c04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022152, "uuid": "f0828621-201c-4d20-a4c6-d2df238291ee", "comment": "Malware payload (AgentTesla)", "value": "ed00815f0e2bd273f95977dce3454d714a005581d46576d1e6bb478b8d4b7aa315d5ad18559480e114df6ed12e390b94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022152, "uuid": "a7ba4172-1584-4225-a5fc-99ad0303d206", "value": "T1F905E00EFA92C911F1A41B33C1E0A6044375AF19E167C74F29C973A55EA33A78E87B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022152, "uuid": "be8e5e80-d272-4592-90ae-e62f4ef512ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022152, "uuid": "96bd5929-b98d-4d9b-b837-09bc80d8128b", "value": "12288:UdlQGSet3EF75e9GwvaH1LF2nWHZyVRHRywvZM+h2MvA:UiZ5HwM1EnuuxzM+h2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022152, "uuid": "2fe56cb5-3146-40dc-8ffc-eb6a9f22512d", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022152, "uuid": "7726ffde-8305-4f52-ab63-ec8598b6cc15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022152, "uuid": "84737ee1-4956-40d5-84f3-9864450e1780", "value": "ORS ve Tic. A.\u015e TEKL\u0130F_\u00dcNL\u00dc OTOM PY-2802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5379230-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022155, "uuid": "8b5c6870-9f19-4f89-9066-9455dc10752d", "comment": "Malware payload (AgentTesla)", "value": "62ecb0cd3947c9b80773b3a55c3b5ed3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022155, "uuid": "041bed52-615a-4234-9d74-77bee730c0fb", "comment": "Malware payload (AgentTesla)", "value": "74f877cd5358f3337613faf6a11f896c7a1ad1ddb0c8677509db1fcef84149ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022155, "uuid": "8f8e34ad-2372-493d-beb8-6737b6f86b4a", "comment": "Malware payload (AgentTesla)", "value": "bbe2181e94874360d6808d108a4d855588150c16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022155, "uuid": "e194f266-8b0c-45a9-a13c-6d13608ee395", "comment": "Malware payload (AgentTesla)", "value": "1e0cebe8b5053368ad4c8c5bc1184436c07b2cce0de06dd14c6705f0ce92b1c7186ec5c91fe23d994e2f5a09a1f448b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022155, "uuid": "781984ad-1cad-48e0-84b4-4d64fff3738a", "value": "T19A05AD963794AD63C07D77B122689616A330C0D3ACC08E87E5DE437EB7732CA7C4959A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022155, "uuid": "74448a98-aaec-4ed6-a2e0-be84178c0022", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022155, "uuid": "51889e54-eacc-40d0-b4b2-d1fd51e51a3d", "value": "12288:i8j2RbKAlpWE8DTLeb9hvv001mWfkHz5AGV:lXuoE8DnPSkVAGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022155, "uuid": "336034c7-cf59-44fe-8475-486a15eba5ac", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022155, "uuid": "403ccfc3-a07f-49de-8ff0-ebbc14eca0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022155, "uuid": "88fe649f-14f4-45ab-8a59-42db3195fe85", "value": "Rem_09837653tee-30987635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06454aaa-29d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662023472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023472, "uuid": "a60f6bcf-0581-486b-84ab-f4a8d42d47a8", "comment": "Malware payload (GuLoader)", "value": "2986566fd4e0811a419a3cc8c0c7b933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023472, "uuid": "434f9861-d6a1-4344-9533-bcf8b19c0233", "comment": "Malware payload (GuLoader)", "value": "7503f626a486ec4b18fff9cdf19c28af0d4b84276daf797a8eeec0be3819ccc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023472, "uuid": "cf4eb32e-03ac-44e1-8f3f-321436ba0d4b", "comment": "Malware payload (GuLoader)", "value": "f2ae0c53d6534d6788fe24d30e6e78012beb30ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023472, "uuid": "5b3afd55-2861-40f4-932c-8961cf5201d4", "comment": "Malware payload (GuLoader)", "value": "13ab8da90f4a77c4cf4aff4585a958bc81d9dace5ba033e31732ef4a0d7b3537c7505c98aa02175997f49ebe260287f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023472, "uuid": "616bfd04-0d2c-4356-8859-2b941187273c", "value": "T120C3D00571A1D19BD4210E71AE26C1F56BB2FC12E964816737E0BF0E3A31152EF1E77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023472, "uuid": "918fbf40-e5d7-4f3b-92a4-2e18feae4a5c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023472, "uuid": "fca18ad9-0dba-4105-a043-157cc2773200", "value": "3072:WuxVUg3yGDRb8lc7uRcGvOMChuzLaif+3APfsPSJIbHgO10uJM:JgORahHVrzOAgHgArC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023472, "uuid": "51475273-a67f-4b41-9c13-cd0b2490cf63", "value": 126524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023472, "uuid": "152655ee-6511-4974-be74-e1e83645d2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023472, "uuid": "073ec0b6-d047-46fe-b1e2-8dd167f04361", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.10313.16738.22829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b8e5ac-2a16-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662051063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051063, "uuid": "10347d9e-8d35-4cce-938f-791e55946a0f", "comment": "Malware payload (RedLineStealer)", "value": "8f6ab8fe62ea1a4f4b7a60fbb18406e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051063, "uuid": "e31defe8-8073-4207-a75c-db24f93c4c3d", "comment": "Malware payload (RedLineStealer)", "value": "75c9e2a6c3d9196c4ea851f90401d6b9acae07489a41d462a462e42f26780215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051063, "uuid": "c13fcef6-aa62-48cf-9cf1-9b8095cf54f7", "comment": "Malware payload (RedLineStealer)", "value": "e13915dcb65a62a341cd8de9c7742c88103141ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051063, "uuid": "58d3a14e-5d4b-4201-8a97-0078ecad17c8", "comment": "Malware payload (RedLineStealer)", "value": "2a95c7e693c0b695227f4031b75cd90374a230d485b942b3596abf931720efd117ffe79af3c83242b7dd03c4331fca98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051063, "uuid": "1d9f9872-478b-4285-bf60-93f020beb2c8", "value": "T1A1A49E01B273C0B2D6778D7198A9971E117A65140B2349EBBFE029B42FB43D21AF1F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051063, "uuid": "6da73677-d804-4218-9c66-da23d224834c", "value": "e3b8a27053e73ab9de508e2b8d74566b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051063, "uuid": "74f42b98-ce52-4266-a724-095645681c94", "value": "6144:zs+OjQgG8sSQKILdoMLAa2BG1i0y6YV9n1NtHgMBY16EUl5Ww9gu4Aw74KjAOspg:DvgTj2dos2T6YV9nP9bAlOqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662051063, "uuid": "663fd18f-d4a7-4c64-9adb-b8f59ce71558", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662051063, "uuid": "70934867-00df-41fa-8472-1431d8b9c495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051063, "uuid": "a388a324-41ad-4df3-bf47-525df80b951f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b87bbe8-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1661999429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999429, "uuid": "8a234adc-03d1-4cf0-b332-a3b1ceb157a7", "comment": "Malware payload (Formbook)", "value": "d310668e05d5cd2b883c7635b8478ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999429, "uuid": "105878c5-af04-493f-bbe5-26f964a5876f", "comment": "Malware payload (Formbook)", "value": "770aee06bb2c48271eaaa6af3d44ac3c590f1a372007d1c92591ae65c053e682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999429, "uuid": "bfbb4cc8-6b6a-4b09-9b82-e8fb82da83c2", "comment": "Malware payload (Formbook)", "value": "ffe307ef53f4fc5f0d32309dd4193273dae58bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999429, "uuid": "9024588a-267c-46e8-8b96-132c69f60ccc", "comment": "Malware payload (Formbook)", "value": "836e3639b82cf2def98aeffb0ed1057fa56d329bbde351be561b4b9848832350469439a946d193024bf539251d3f7d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999429, "uuid": "614b38f6-9b9b-435e-a3c8-36015ec0250c", "value": "T169B4CF0631C053F1E438863CA519459C03F27D3FD711EAA77CCA728A8B7B2D696A7663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999429, "uuid": "121db22c-6250-4d23-a3dd-621a60aea182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999429, "uuid": "3e00063f-9f65-4695-bfa6-d16cb9af0980", "value": "12288:DX942IWQ20shxEXFktUQDNGkkkkkkkkkkBWC/ZX6:L9lBhheVktUQDJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999429, "uuid": "a398ea6d-9b9d-4978-ac96-2cb4855e27f2", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999429, "uuid": "67fc2413-c873-4b9f-a061-1a1316081df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999429, "uuid": "41865c9b-e674-46b3-add6-d27f7f903456", "value": "SecuriteInfo.com.Trojan.GenericKD.61638470.5680.17006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acbbef4-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024365, "uuid": "4ab494f1-9166-4466-95a0-00dae99ca311", "comment": "Malware payload (SnakeKeylogger)", "value": "da6ab365d76dca4d8bde3484df29a1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024365, "uuid": "fde6492f-4990-45c2-a44b-5385d2ec6394", "comment": "Malware payload (SnakeKeylogger)", "value": "771f1007662a8d38a9ee7e039877879b11708d81175d19043ffbcf89f309f14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024365, "uuid": "f5c359cc-b74b-4c2a-b4b4-b7361ddcf34b", "comment": "Malware payload (SnakeKeylogger)", "value": "66abb2123da89fb2920be0730b5b774a2465af43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024365, "uuid": "05bae1e1-ae87-4906-88c8-dbbf3b6f3f1b", "comment": "Malware payload (SnakeKeylogger)", "value": "84ecaae25f0fa5f4cd11d44303304af71c8b81281efbda46b67512edc1c838537f9658d014a4d3163e91bf273649ec08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024365, "uuid": "0211519f-96d5-4752-bea4-8c18c85bc2b7", "value": "T1A01502499684C3F5F4271BB011B1F22991BEBE1192B1C3DCAFDFB2E845B8B165217A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024365, "uuid": "6827984f-181a-46a9-bc1c-52638a298ea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024365, "uuid": "cd4b90e8-4b9d-4ab9-9b5a-b415b142255d", "value": "12288:MF75e6gPwqoXY+mzoRtbvRT74AB0Ra9CE8t3gSgP/vDCZEiFW07dQZZ5sKAB:MZ5lXY+mzo3bvbb9F8pi/cWgdQSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024365, "uuid": "c224a02d-c2db-4694-ada0-f3c135e89c62", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024365, "uuid": "52ce25fc-7812-46d0-a10e-308b30b3f4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024365, "uuid": "6b35b362-f120-4c8d-a823-4e01a1ebf97b", "value": "da6ab365d76dca4d8bde3484df29a1a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b709a9-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662028278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028278, "uuid": "0f35b580-89df-4778-b337-fd4ee67197a8", "comment": "Malware payload", "value": "b3d8f944a0a2d124204dac0c85afb736", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028278, "uuid": "a6459ca9-d4dd-45b5-9c4f-95f7e11ce536", "comment": "Malware payload", "value": "78fc88c635d8ee07668e9f2c6854975713d31d8d7ba551808140eedcd9ec714c", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028278, "uuid": "5ed46f25-3557-45ca-915e-63a69a78cdc8", "comment": "Malware payload", "value": "062d227ab7cff32149b0a4ef14fc5ecfdca57e7c", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028278, "uuid": "1547ff25-e0d1-4946-99d9-cbe7f8ce3850", "comment": "Malware payload", "value": "181a9e0453dae580f95548c10df49e713fe7e809c1bae1eb996c121c4256d39487334da2d634a327c1605c71a3fe4df5", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028278, "uuid": "67705b24-2d17-401b-9632-c9d313dc33f1", "value": "T181A61181C5B365EC4B56D41FC0BA1B6D139B7C9E6F3AEA001A31788128F27C39E93791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028278, "uuid": "de2daee3-431c-4e70-93ad-9946aee80d92", "value": "196608:5Si7LecJAE20jlyxmwx+OFx7x9z5e3e8ozBev+tiTG2dY3rSITRg:5SiOciEB+5xdPzcuB7j3rjTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028278, "uuid": "6d61651f-1e50-4e3b-b833-494ce4361d12", "value": 10131774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028278, "uuid": "cf2ba7c4-4567-4f99-9c03-83b6a015d6ad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028278, "uuid": "35e78af8-275e-4c9d-b515-cfdb37d75010", "value": "ibra31.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0442fd-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetSupport)", "timestamp": 1662043884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043884, "uuid": "ff59adeb-f673-4860-bd34-36258d03d908", "comment": "Malware payload (NetSupport)", "value": "dffea1fa106669794084eb3e6ca2a7f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043884, "uuid": "70f4b5da-44bd-417b-93a2-1d1cda162f4d", "comment": "Malware payload (NetSupport)", "value": "7a380c4d7ef486e59aec1c49324fe46a71aa33782115f4494e9a8b348a020dfd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043884, "uuid": "4b59f65b-56ad-44bb-a05e-d139d3660e11", "comment": "Malware payload (NetSupport)", "value": "5a3273d8baf2b4d3cfb387fdb1d5ff52eedd4aef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043884, "uuid": "2e90974b-2943-48d1-a86f-feb7132c1f39", "comment": "Malware payload (NetSupport)", "value": "f5ca477f4013a184642f41e015dc588914ec9277640fd2686c71490ea0e2d9024034bb29ba2a94617fa21c94d46842d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043884, "uuid": "05b3f092-39a7-41ce-ac34-d2381936aa84", "value": "T1CE5402D05392BC8261CF0E636BEDBAF6D628AD27B081334BE5F03B54659391B85D4E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043884, "uuid": "011cf782-d6d4-426e-9e1b-e268bd9689ce", "value": "3072:qrjVJySRCL1ddImO3NwSa0wQwRCijyQL7oebGpTLW+B57wtu:qASkdIn9lpQL7oebGRLQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043884, "uuid": "20e3a1bc-bdca-45a1-bfe5-221b257d795d", "value": 293505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043884, "uuid": "a546d900-84cf-4ad3-9305-53ac5fafce5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043884, "uuid": "76d302e2-8cac-4108-ac19-c8ec7a3379d1", "value": "dffea1fa106669794084eb3e6ca2a7f9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c656cdae-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662018640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018640, "uuid": "5c48e11b-ae10-41f9-9541-3b024d9d6010", "comment": "Malware payload (Loki)", "value": "647704b02a93385ec187ebe9e8cb4ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018640, "uuid": "142570a4-4219-47e7-bf49-0572cce4df6c", "comment": "Malware payload (Loki)", "value": "7abb128ccfb563b520547eb1c6fe5f62a27700049386a3263fed3e7c02dc5f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018640, "uuid": "a9174c4f-c562-48d6-9424-92d2ebeb83e9", "comment": "Malware payload (Loki)", "value": "ff9fea0fe0d5b4bbd255b0896877a384749126ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018640, "uuid": "4340e61d-bfd1-465a-a578-c1ca2edb63b8", "comment": "Malware payload (Loki)", "value": "ed1d5f97819080963f2c13ca39608d910c069dfe4712ca977eddf9a990ab51ca9052655d987cf314a5c7eb9bd5c6f81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018640, "uuid": "c2e6ef54-2989-4933-88fa-6afd9757ad0b", "value": "T16A15028A95C4C7B6F4261BB01271F22882BEBD15D171C2D86FDFB2EC49F4B429217E16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018640, "uuid": "e672dae3-512b-453a-8ee9-14d0af2feb4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018640, "uuid": "5e84a4f7-776d-466b-8d9c-53b7bc57cd95", "value": "24576:wZ55XY+mzo3bv75CeNPZ9k6r4FkOF08cM:C59lmzMV/xZ9k6rOFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018640, "uuid": "36046c2a-32fa-4e8e-8952-0ae0ec105ca6", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018640, "uuid": "0d126e42-7508-49cf-9345-21f048537af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018640, "uuid": "3387ae30-b0b0-4e27-bfc4-7c5e3df92ea9", "value": "DHL Receipt_3300777400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736d5719-2a3e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662068323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068323, "uuid": "2ef37794-26db-42c6-af16-535a8bc21886", "comment": "Malware payload (Mirai)", "value": "f5d0216ccdf1ddaecbb9796e801c1443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068323, "uuid": "ea560f19-4889-42d4-a38f-4ce2a4e3e377", "comment": "Malware payload (Mirai)", "value": "7bc97f1eb168254bdac590d643f0d3c058eb209c0ae575a58daa830d5e49d0cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068323, "uuid": "52495b16-fac7-4497-86f1-bd0afbe8ee1a", "comment": "Malware payload (Mirai)", "value": "9bda66cf760435c1f5c4d4a503817b29771ebc8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068323, "uuid": "9bf5df76-42dd-4b51-81cd-0ae8ab7ddeb4", "comment": "Malware payload (Mirai)", "value": "37110ae05ba4bd688611c88f54e8b8d75329eeb3c40940a8cce9db36603d7e1cc50c6dc9f135b13d1e3765a0a3d1dd0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068323, "uuid": "a904883e-4de0-4c94-a74a-64fc1aab8662", "value": "T19D132AC8F453DDF4EC5506B4313BEB369FB6F13A6129E9A7C39996336C81901E20629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068323, "uuid": "af7b3656-ad4c-4e11-93be-dae97b9c1ac0", "value": "768:w2T5Sb8x07IvnJ9Xy0h2chGtGrDDMnLBnyAZm9IOgPuDlycake+E0nhVVuvn:Hx070nJVy0fhG8rD4Nyo0gAlvaRh0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662068323, "uuid": "b1699ae2-975e-4e7b-bd10-47167f747543", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662068323, "uuid": "2805b386-4ced-4e2a-bf22-0db3a5a54b37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068323, "uuid": "6dfc635e-48e5-43fe-8336-134e2bf658b9", "value": "steamamd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e96a6e-29d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1662023470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023470, "uuid": "735f55ad-2efe-4eba-b54a-1cb0b292b82d", "comment": "Malware payload (NanoCore)", "value": "1523a810a72d2f273e7bcb1df894cbf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023470, "uuid": "b723d033-02e9-4330-838f-0db25917610c", "comment": "Malware payload (NanoCore)", "value": "7c9b142686a3b367150279bd91cc4498293402d685d8474aeb41d144fb3ebf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023470, "uuid": "922a9194-2b38-4fd6-ad58-9514ff658fb9", "comment": "Malware payload (NanoCore)", "value": "fefdf15caaf43d5ce5d9801df28c8c6b6be0855e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023470, "uuid": "d870a196-feab-40da-bb4e-99fdbd2ec4db", "comment": "Malware payload (NanoCore)", "value": "9615365b62c7f8d28f3bb8867a2784a886a7d4e6a0e7d16d8847f768a97b9950bf2abd333f449b15c10813463a42f61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023470, "uuid": "136932ec-7c34-4bc4-9fde-dc68618d56bb", "value": "T15C35E1877B641A22D17CF3F20298921057B2D1CB7589CF8A69CFA7A827737C25D8D163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023470, "uuid": "5c98ead7-e4fe-4d93-8347-74a431920795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023470, "uuid": "f360303d-266e-4058-bf4f-296555294fb0", "value": "24576:jlFneuoE8fO8UGW4swyEQtN0SM2wJZXCBFcSmSTqO:jlFne1vsxzSFbQWSLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023470, "uuid": "26cd109b-67f9-4687-9bd5-1a10b99910b4", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023470, "uuid": "14fdd3ea-0f1f-42ee-8340-1f02694bfe53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023470, "uuid": "9e62cea4-365d-4b44-ac87-7f00ec72ac8b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25417.1619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770eb7b5-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049001, "uuid": "dd928626-7f89-492a-8e38-6129c2148814", "comment": "Malware payload (Mirai)", "value": "cfeeaf771f579489f348a3c187f9455e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049001, "uuid": "f7f39129-329f-444c-a1db-f4bfb3b6b1b0", "comment": "Malware payload (Mirai)", "value": "7ed0b74070003e13a6120a456f41cb391668576b2b7128c092095385edaf317e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049001, "uuid": "ff8a65d8-1277-42cb-8ccf-0f644922a18f", "comment": "Malware payload (Mirai)", "value": "b457a9e9e05055689262e3df9629c1730d7e780b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049001, "uuid": "0950f463-3a42-4bfa-93c7-02d22c037cf9", "comment": "Malware payload (Mirai)", "value": "9f16f859f05afaa253bc99263939214df25c2a441e1da441a7988485dc09a074ae9d1852743a89a62cbd9c30305c1266", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049001, "uuid": "4c73719a-1123-402d-9891-3e80d6435a47", "value": "T106332AC1B78B88F5D417493090A7F23FDB71E4794171D6EEEF89AE35DA67A024203289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049001, "uuid": "c17c6035-70eb-4bed-a429-77c2c19340ca", "value": "1536:vdGYIFxiRPzu7MQS2j0z2uUk7pISydRE:vdGrFxwPzu4D206uUuISyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049001, "uuid": "87e17950-6c9f-438a-a298-909a7a2dad01", "value": 54128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049001, "uuid": "efb9c309-d593-4a99-80f7-708d7e2fe6b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049001, "uuid": "fc754d35-7ba3-452c-be2d-14d57eec1e85", "value": "cfeeaf771f579489f348a3c187f9455e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d32736c-29be-11ed-93bb-42010a9c0043", "comment": "Malware payload (Adwind)", "timestamp": 1662013229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013229, "uuid": "6b246d03-c260-4870-a8f1-fd8eb2a336d3", "comment": "Malware payload (Adwind)", "value": "37d9df5f17a89b105bd7cd3bd49ff58e", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013229, "uuid": "75a5a119-c3ae-4133-b5c1-2d2b3b6aa476", "comment": "Malware payload (Adwind)", "value": "7f211a744e99e0c1a14aad3f50e262ac12e559bf4117190428859bdc0031ee9a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013229, "uuid": "5b422e4f-05bf-4e40-8318-1aa4be280624", "comment": "Malware payload (Adwind)", "value": "948c8a96c95279d79f570ff6cf6643051afc0211", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013229, "uuid": "aa169a3e-1c59-4193-9a86-194991a58130", "comment": "Malware payload (Adwind)", "value": "604aabfa54fe72d8dc10a37aa34a02a95ab0b0a0cdb8022ba8f911267848634a91d2137827fd1610b51ffe1f5d9243db", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013229, "uuid": "25df238e-fb92-475b-83d7-d1967d2a433c", "value": "T19115F1058E84AFAACA5C8515D07D1A3F93E05B48941620CDAFD36E5F6F8FDCEA10B358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013229, "uuid": "99c140a0-497b-4e31-8262-05915394ce09", "value": "12288:SZPP4Qv/ZYanFCYLE98+ytHDLHnVjmNqCgJYX+hYYqJ0P7O2ZDQH5aBANvRpgxQW:s4QXZyRcLHnNKcWmnqkOTxNvXvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013229, "uuid": "7f1b5d8e-1925-4123-8a67-3802c239038d", "value": 893040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013229, "uuid": "cd50e03c-4487-452a-8beb-0034f4e232bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013229, "uuid": "175ad4c8-1934-480f-a378-767c1f8a89c2", "value": "Confirmation transfer MT103 Ref-9906567.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3448c6b8-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662031280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031280, "uuid": "d64e7bd1-03bc-4d37-8a30-97b5ddd38624", "comment": "Malware payload (Mirai)", "value": "3287c283c4f63edcd33ca7366e70fd3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031280, "uuid": "84a8b2a7-61f9-4727-8d15-3ff4f74015eb", "comment": "Malware payload (Mirai)", "value": "7f62e9f9945cd7004afe43ea4af7967e5c262aa21f022e61fe3e06f5d37a8c4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031280, "uuid": "de5a3a42-4497-4fa8-a4a8-7037d0b70354", "comment": "Malware payload (Mirai)", "value": "b7079d327acb84a1315cc73427833e3341a44977", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031280, "uuid": "b931e6e1-b35f-408f-bccd-bf707587265f", "comment": "Malware payload (Mirai)", "value": "7036cd1a4fc0a75f284c6827ee98dab92aebbeb0cac36c2664a63bc6684b5ef787c8ec4546f39467bff060007dddd241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031280, "uuid": "c6261d70-d8e8-4d15-a806-9b708407a281", "value": "T1B7833A02726C0B47D2A35AB42D3F17E083FFE98120E8BA85655FAF568675E721085FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031280, "uuid": "c85fb999-8f75-48eb-a69d-3a7eebee6f3e", "value": "768:POlDNhTOQDdpatoherdsNS6h5dQLyQ628gbh1b37GljKzvxZAwUz8Fm9dIYevp/Y:e/TOweoordYS+a/hoAQdfKpPEIY7VEz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031280, "uuid": "c8844b6f-b44e-4ed5-89ee-0119842738cd", "value": 88536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031280, "uuid": "256a87cb-8ebd-43a0-89fe-4c3879b27143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031280, "uuid": "7282ac09-c3c2-46aa-8ce2-52e935b24722", "value": "3287c283c4f63edcd33ca7366e70fd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa53bdd-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014460, "uuid": "e0b5adb7-b730-41a7-bb8d-8342c2be7531", "comment": "Malware payload (Gafgyt)", "value": "fd062a40190a8dac510f6cc176a4a4a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014460, "uuid": "478286b6-a5d4-478c-8686-88c30e3561fe", "comment": "Malware payload (Gafgyt)", "value": "7f6c4c16c88363cec6b24e869c95fe20cb5d7f7a34a8faa716216a163dcdda98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014460, "uuid": "34dee3fa-5902-470a-b8c2-e1bd3d6bd297", "comment": "Malware payload (Gafgyt)", "value": "d9e978d79fa02c03af6447286d3a00e1b2cee58a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014460, "uuid": "b5d47a0b-bcfa-4b77-8c7a-4d7a5287502a", "comment": "Malware payload (Gafgyt)", "value": "ba1b9698e74bfd68a6a37001de9ac6233b75c457f983c8514e7a679fbc3ff538f0c4cd012cd7c81a2cd25cf53675a14d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014460, "uuid": "3ae29778-face-44e8-904b-89d5fea485ba", "value": "T176634B03A781CAB3D09316B606DB9B210132F97B1A1B9F55F32D7CF49B111C8B267B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014460, "uuid": "b345b596-eb20-4910-a9c2-e5c188db8383", "value": "1536:qSwvRT/UuUwfq0dbvFRexxA6Cxu0MgmTOfmBRGmLI2VOCjXUfJRk:PwNUuUwC0db9ReXnC0FOfmBRGmU2VOCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014460, "uuid": "bcada834-de57-41f4-b863-649f04f71f3e", "value": 73121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014460, "uuid": "469bc1e8-eea1-475a-919b-c352dbacca59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014460, "uuid": "a52bf4aa-4939-40e9-a8e7-1f57afbd0411", "value": "fd062a40190a8dac510f6cc176a4a4a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187cbf07-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662026938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026938, "uuid": "eaca1e04-5697-487a-ac3b-e372472bcd9b", "comment": "Malware payload (Smoke Loader)", "value": "592d02ceb811dba54c9df3fe42f94c45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026938, "uuid": "f19da027-8e90-4732-b335-71dce2ae0a98", "comment": "Malware payload (Smoke Loader)", "value": "7f9023d9d5dcb53f05701c65b1c7ff47472410ad59ff64a5dbb4b6777acb7b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026938, "uuid": "504f05f9-7e03-4c6b-8891-744c22e67cab", "comment": "Malware payload (Smoke Loader)", "value": "98164fc1117639dd78794adb06a803a33ea127ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026938, "uuid": "6e1dc6ce-a578-4e02-8eaa-22d433daa242", "comment": "Malware payload (Smoke Loader)", "value": "73d38f7ba2f59496ef55c06fb978599cb6ace30bfe398a3a62cff73c6ebd6f97ac32e6bf1d4284cae2e0b63832ed02f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026938, "uuid": "3386e760-130f-4bd1-863e-6344dd8825be", "value": "T13154E011F9A1C433C45322BC44E4CB96797F693102A5158B37A92BAF6F302E1977739E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026938, "uuid": "33c4cc12-a662-4e00-9797-bbf54405ca6e", "value": "87441594d3de44f1a0456f0d6f52e874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026938, "uuid": "e9fb40e1-67fa-4b45-8f61-ed767441984b", "value": "6144:5OuLBLBK/80dHpNYJPYkxIoRagv2BcoQ:7NLQ/8WOSkxez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662026938, "uuid": "0559deb3-8c51-4717-86d3-d217ddb9c22e", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662026938, "uuid": "2b18f2bb-f9ac-486a-84e4-f74a5fc5fadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026938, "uuid": "f94a23b1-c6af-41f5-beb0-16be5d978836", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a48937-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031088, "uuid": "7f96961f-794a-4022-956e-e885bc101ff6", "comment": "Malware payload", "value": "b2be1d8c65e606636b424ed7a1f545f8", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031088, "uuid": "1a706403-3b6f-408f-9236-10424ec61cea", "comment": "Malware payload", "value": "7ffd03eebf5ab15984926935d53006376aeba895678ea49c5c58c2a2454b4add", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031088, "uuid": "5603a7f0-d7b6-4396-ad38-77a228e1f7ae", "comment": "Malware payload", "value": "0d32a012436b44e49de713af1be64c1569d14513", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031088, "uuid": "87a760b8-5992-4a49-9bd1-b31b2f6431f1", "comment": "Malware payload", "value": "d09dc166ee65b574d611fad625e31ab577fcd4728659e651c64434c86dbb0658be91f16f14dbe75fa00c30440b9de09c", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031088, "uuid": "274d298d-2709-4bce-9b40-b3334b268a27", "value": "T1E333E1376539F8EE832D180AEA083D5F2F3D7D13E364EB64160299B0171AAC551768AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031088, "uuid": "9791953f-27e2-4416-be53-6316f74636a2", "value": "1536:YHuY8ERMhzjRSE+J2UhFNaZofCBiZzN7xsldocSkoF:YHuYzR8jbs2QQLcBxydqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031088, "uuid": "2a3a6b7f-1c4d-449a-b65c-73bfe8bc3ce6", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031088, "uuid": "c736df46-e67e-47b8-a4cd-d91117e6a313", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031088, "uuid": "eb2ed98f-f57a-4119-a456-95ea8dbb0b2a", "value": "Lx2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce672d05-298b-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1661991595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991595, "uuid": "54b846e7-7eb4-45d1-843e-a8691dcd507f", "comment": "Malware payload (RemcosRAT)", "value": "69c2d78d263a8340074b5d1c4375dd07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991595, "uuid": "b2d789d1-fa1f-496b-9f5c-5ab63ffa3da2", "comment": "Malware payload (RemcosRAT)", "value": "81ac4a76d124f1620701c887de816c1d0a70d32a780525e7fcaabd7b829bc17a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991595, "uuid": "e8822733-4c83-403e-802f-b4aaf5796d10", "comment": "Malware payload (RemcosRAT)", "value": "91f23a8aba9acf564e048877c2a6442a7c01a0c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991595, "uuid": "05523ad6-9e04-4859-94dd-5eedda79adea", "comment": "Malware payload (RemcosRAT)", "value": "0f442f87b81bd82605dc4e66f1b2cf96fbd2f4f45cf24f8453612ff4ae2a25ddd909d648bbecb21864b5bae7dac8d53b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991595, "uuid": "dae7c6cd-ec23-4e08-8c73-5ca3d50e0368", "value": "T10653C0103BD4A93EF65E0A32ABE5C547667893412E574A263F7758872CA334E0EFC91C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991595, "uuid": "6183f39a-04b4-4d3b-9571-d3fb9e6c234c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991595, "uuid": "0144cf99-9960-4152-9494-a3643d3bd469", "value": "1536:O9XMNK9uDUaQl+kzdC9GiZQWSwi/fUpS/fX/MNL:OiQ9uis1Jy///f/M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661991595, "uuid": "08d396cf-4215-4999-a262-7f345b73168e", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661991595, "uuid": "9e6dd29a-5047-4d7b-b440-39d780304261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991595, "uuid": "c8e13958-8a0c-4d92-b042-3905db52c011", "value": "Quote 290417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa36d15-29b1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662007918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007918, "uuid": "e4fcb86b-1b98-46b7-b810-51866c0d2cf7", "comment": "Malware payload (Formbook)", "value": "afc1e11933e8105c3c54435f8de57c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007918, "uuid": "683f45b1-3ab4-4c94-97b7-a96b5384e1ac", "comment": "Malware payload (Formbook)", "value": "8205532fed73e4318afcfd72b7d27349bd811fab096577f08e7f5d7a15f95ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007918, "uuid": "000b179c-875e-45ee-9ed9-def9993d9b29", "comment": "Malware payload (Formbook)", "value": "a3a655627c644df5f984ec8c08c3a336970e1f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662007918, "uuid": "e3f4cb88-f41e-426c-b41c-603b49cbf8dc", "comment": "Malware payload (Formbook)", "value": "30e9cbf57f1f2446a667f3f6c760b7f49214dcbe60184ff6c9db7fba3b7b191fde967f168981b426fac6fb17760b03d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007918, "uuid": "1003b1be-7440-4f12-bfac-d2627a42b1bb", "value": "T197721816C66E51F2D26E873F84D3F944C7F1E2530842CA6EF898138A2D43793CAD6765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007918, "uuid": "8f7c0ce5-74d7-4f5e-895e-91237a35c303", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007918, "uuid": "66f02351-0928-48e3-a4a4-7d0f072b33e4", "value": "192:3wh7boe+8uDXPJppwsHjt0sxLYRdS3B1zpd7SC0XmPH0xKEK1BGm8wYkvF:3wJz+8uDxpSsD1xL4dyXGC0X+HjEQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662007918, "uuid": "ff32c201-b394-416b-91da-e56612cc0f39", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662007918, "uuid": "cd1a7a7b-e163-4fd4-8fe0-b891c2f8cb86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662007918, "uuid": "b454c0fb-d876-476b-94f5-5b0ea381a196", "value": "Roomtbg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea04a3c1-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045329, "uuid": "d854e3dc-f0e3-469a-9b59-32d53d42f888", "comment": "Malware payload (Mirai)", "value": "1eca6f0d133ee8573647e7d68b1bf0cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045329, "uuid": "cf422771-9eb2-44f1-ac64-b6acbae24176", "comment": "Malware payload (Mirai)", "value": "82c9d6760fa89c60b42d8bd6fd46184fef74aa7c6545cebdf5d487f71bd09128", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045329, "uuid": "2bfd6d0d-9c8b-4e08-8288-e4f885d642a0", "comment": "Malware payload (Mirai)", "value": "9c4ca9167b3b00de1c8a88b2eb63fbf2964fddd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045329, "uuid": "7cf7f283-4ecb-4e77-a78c-f39d9a2260ed", "comment": "Malware payload (Mirai)", "value": "e59042144dbc4177581d34158905956cbf8b28c3c5c295230e805baf8a5d448b4f931ef74d7a04255a56ed68e33db13b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045329, "uuid": "c7dd00db-592c-4da7-8972-58c1b66d6daf", "value": "T15782CF3020DA70B4DBB00831EA6DCE865F260AF8D1FC719716549EBDDA1640A55B91A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045329, "uuid": "3a0fe7c6-e7c7-46bd-a999-a34e8e631666", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtU/rBo7kEguwmhhymdGUop5h5ly:2dV0P6+kom0tVAoNvm+toK76mhs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045329, "uuid": "7529e667-7b41-4aa9-a81d-5ec7af2182a2", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045329, "uuid": "9567f8c3-cda9-4b6d-80b7-3ff823c62939", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045329, "uuid": "90fe1fdd-9d18-4473-8c72-554003a16e5b", "value": "1eca6f0d133ee8573647e7d68b1bf0cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3c7e98-29cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662020613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020613, "uuid": "8d061873-3648-4336-8692-e267f3c59cfe", "comment": "Malware payload (AgentTesla)", "value": "e979ae6c1506dcb13e7057ba7a5f3fcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020613, "uuid": "46345adc-113a-4c86-8124-7d62bfa9c471", "comment": "Malware payload (AgentTesla)", "value": "8303c2f53c5a205fdaafa48ec3874240cda6ac2c0b68adad8fe681d87ad70ee5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020613, "uuid": "b3e3eac5-b07b-4e4d-95b3-2206626b2e7f", "comment": "Malware payload (AgentTesla)", "value": "9906e0777fcfde00c06455e2940d87954f7e378d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020613, "uuid": "5f1e6549-4ae3-4a0e-8f0c-44a46460cd93", "comment": "Malware payload (AgentTesla)", "value": "73b28b30cf6e4e863252749f658db74d9b48c27b0094aea0533ac1004bdc2a6745a3a9454d62da009c18917167dedf2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020613, "uuid": "25f132b2-2658-4377-9c72-b079acb64651", "value": "T1D8059E515218B3A5F53A767414F372B242AEFC356E58F21F2C9232C6C934A8B8F6DE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020613, "uuid": "06252136-533f-42a4-ba98-a65804cbbf70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020613, "uuid": "8a3b3204-244e-480d-a54e-38f06b041981", "value": "12288:KOz1wrxCPhFAWd1lcAWd1lGS0uFD+tiw8pe155BN+Lyp+2YxZKM:xwqhNFqFS6D6iwKe155BNsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020613, "uuid": "265c02e3-aa9d-49ea-872b-39add7ab28f9", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020613, "uuid": "9616b228-6e14-4676-978f-5f93275d9f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020613, "uuid": "3e05642c-9124-4519-96f8-5b80e4927bc8", "value": "New order44533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc63b8b-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662027806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027806, "uuid": "26efec5f-5e50-40b4-995d-c50197b9deb4", "comment": "Malware payload (Formbook)", "value": "8c5338331c6ee06cb6a4443226b8ef79", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027806, "uuid": "cb80242e-c428-4ba6-bcb7-575187462760", "comment": "Malware payload (Formbook)", "value": "83706cb8ae1132981fc4b5fbbd44e8433e5456d21fd0baf1c819998074b5fd25", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027806, "uuid": "be96ea66-4ef4-4372-80f7-220982de66d6", "comment": "Malware payload (Formbook)", "value": "7d4099c5e5dbb5849a0edc9e00a0ccbcb5489e59", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027806, "uuid": "4cebb15e-13ca-40cb-af38-381e438325f8", "comment": "Malware payload (Formbook)", "value": "422370f5e710fe166e12635fec29df0592aefa52af4791ec019a39e2e4a8a8777115a9ea9e4819f675a0b71e9939012a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027806, "uuid": "5e7a13f0-f138-4fb9-8e7d-2571db22b827", "value": "T1EC15125EC1946F27F8BD0B7513F2F31282BA1F2951B2E78C4EC9A2F911D93668156B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027806, "uuid": "84b88a42-85d7-4aca-9660-13c4c8f56aad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027806, "uuid": "42885670-195e-41d9-94cb-ea2588447320", "value": "24576:CZ53XY+mzo3bv01oaIfQNk7y1XZKCTK6iid:E5nlmzMc1IfRytZKHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027806, "uuid": "f1dddfb9-5b98-4937-85df-0070ef6283a2", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027806, "uuid": "35992fc7-1012-406f-8b8c-e19335924f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027806, "uuid": "78d4e9f3-00c3-4d21-ad29-ae83634af962", "value": "DHL.DETAILS.TRACKING.PDF.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9eb772-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014520, "uuid": "2ff18afb-9994-49d3-8b4a-5ffe9a402d3a", "comment": "Malware payload (Gafgyt)", "value": "8f00567416fb031fb35946c9beccb116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014520, "uuid": "94778d5c-21cd-4769-b158-8d8150dc3fb0", "comment": "Malware payload (Gafgyt)", "value": "83f4f71d30ad78b2366f274a832397ff0a3568502274ed822f281696e867d165", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014520, "uuid": "3441d9f3-d8fe-4c47-93e4-53d5dc9cea5e", "comment": "Malware payload (Gafgyt)", "value": "f6c00ea807392172d1e2f46686cc802cb9c7cf83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014520, "uuid": "525bbba9-8de1-4f80-a7b2-4c0bb1931c8f", "comment": "Malware payload (Gafgyt)", "value": "88537e820b35063a547769e2e79f330d378e46fe1877f2dc88af15cbf40d4117df311383ec4dae9d0b8686d3c90ec5ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014520, "uuid": "91ec35a5-b387-49da-8fa2-134b06f121ca", "value": "T133B33901D5508B27C2D2277AFB9F425D37332BA8939B33155A24BFB42BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014520, "uuid": "6614e643-c042-4056-9078-4b12766237e3", "value": "3072:wdAkae+l8tZ2hWJJo+XDELqzQbmTQOWsXAOn:wykae+l8Bo+XDibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014520, "uuid": "1e9a91fc-0638-4432-8e0c-0c5a7f8758e0", "value": 111521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014520, "uuid": "9bf69247-1cc3-47ba-b942-586af1f94dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014520, "uuid": "dffcf4ee-3dc6-42ba-912e-b8b2c575a1ac", "value": "8f00567416fb031fb35946c9beccb116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7395699-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014749, "uuid": "08d127ab-0a5b-43b6-9857-b19af099d3cd", "comment": "Malware payload (Mirai)", "value": "a181bbaad3ed27805dc4472d275350a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014749, "uuid": "b6dc3f15-54c0-4686-9162-a9b4fc4eb4dd", "comment": "Malware payload (Mirai)", "value": "840a2c3d80855370495cd76979fefda499b765dd7f2b8794cbc4b45dc858105f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014749, "uuid": "ec5b5015-abf4-462e-835f-8f7d619fcefa", "comment": "Malware payload (Mirai)", "value": "692fdad03215014761ba625fc11c4f30fe958786", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014749, "uuid": "20c5265c-16df-484a-9676-af97430cb653", "comment": "Malware payload (Mirai)", "value": "f3950400345ad0960b8ad13cd57432f4276cdbdbb58cb4f5b590a44a393c6711fee55ed7ea5bbc52521c015b85d6c327", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014749, "uuid": "82f1342d-20b9-4076-a0ba-426440a98f07", "value": "T195733991BC805A03CBC102B6FA5F128D372567DCD2DEB307AE216F213AD691B0D7BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014749, "uuid": "f02c3d45-87c0-4ad5-a1d3-f26d3024ce63", "value": "1536:L+/+UxYQDuGZvfBBlvmz50WRkAAkih3hubv/m:L+R5BZU0WRkAeQ/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014749, "uuid": "d4560b10-1a71-46b2-b619-0c8f2680c325", "value": 75068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014749, "uuid": "3b3f53dd-b31d-491c-9270-73951da21f75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014749, "uuid": "ed43355c-6744-4d4e-8cf5-72644e569d8b", "value": "supercat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e4def7-29c7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662017082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017082, "uuid": "a4b9e430-78e4-4d3a-b1cd-60ce09de63bf", "comment": "Malware payload (AgentTesla)", "value": "5701aedb79a2448de8f17f1925652929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017082, "uuid": "ebc0c993-ae72-4ebc-bad4-72a63c28c7e2", "comment": "Malware payload (AgentTesla)", "value": "8418fb17c5b34573b28419c1a10ba6d1ac9508130c735aac1ff00e05d1c711f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017082, "uuid": "b0a2957d-332d-4161-8a6f-3993d5363d27", "comment": "Malware payload (AgentTesla)", "value": "1429cdf871d350eafa0629077b1c9a2447767948", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017082, "uuid": "c6c94279-0302-4c58-a880-d914bda156ac", "comment": "Malware payload (AgentTesla)", "value": "b14bf168e0075d793dc3d4a94ecf7b84dbd899ef1c301b9b3b27476c0ab1231820f6c2435a684380e9ec70a190e60779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017082, "uuid": "fec3d4a7-9e72-447c-ad2c-795fb24df936", "value": "T1C3A27391A3BC46F4FC5D0E7698239B060722BD2689396D2FE55B33C7C8733078561AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017082, "uuid": "a942061c-11bb-434b-95d6-c1e82b52f810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017082, "uuid": "e18ca5a8-449f-4622-b2a3-8f2500143e1f", "value": "384:pSdzDJmL3cAh6VvZ245V9scOatsbRVpp93:pMJyZ6Leppt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662017082, "uuid": "84d680f7-2b65-4ce5-a526-f85e1d2f7358", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662017082, "uuid": "20fa3fe3-29af-4d71-928e-4890814488ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017082, "uuid": "1e2fb756-ce9a-44c9-931d-b30741a0ad69", "value": "cool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e313d746-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022124, "uuid": "0e2ef4db-d239-4ba7-a069-08fb1c9317f0", "comment": "Malware payload (AgentTesla)", "value": "5a43f2b516dd2279f4555e27bb481348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022124, "uuid": "32ec16d6-fcd8-43cd-95c5-582c38454a24", "comment": "Malware payload (AgentTesla)", "value": "841af06f6d54f1174d7c3093d7465dbd884af61f1daf0c99e4a7ca9c7882f665", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022124, "uuid": "bdf765ea-cea5-4395-ab01-c7e51d980065", "comment": "Malware payload (AgentTesla)", "value": "23312894beb05253da0c05fd6813ff2ac6c48ddd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022124, "uuid": "743dbe47-7072-42b7-96ee-03d1b44a215a", "comment": "Malware payload (AgentTesla)", "value": "ca9d15fa2c72057e1be60ba3088be2fdd2a65504a53be88b72feae89435884998ba6003050cba865bc0af52ca0158cb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022124, "uuid": "18f58436-6892-4e3a-8f41-d384adb60c73", "value": "T15D05BFC3B7E06D12D17DB7B632D9A621A372CADB4940D2076AD8E19837B7AC05DDC183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022124, "uuid": "0cb53b2a-6bc9-4337-87d1-41c4697c0ce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022124, "uuid": "ef134d46-2771-41de-b084-fc9d0d862683", "value": "12288:pEPqT2RbKAlpWE8xTLeb9hHP001mWfEQd:pwIuoE8xnzSbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022124, "uuid": "30b341ca-27f4-48df-923c-bc18db42d8c2", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022124, "uuid": "be05d474-ad11-43e5-9978-212539a14e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022124, "uuid": "2f799a4c-c5c7-499f-99af-03b06646c820", "value": "DNKJ~1234567-09876543345678-098765456789-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5e3ab4-29b3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662008453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008453, "uuid": "e27f008d-8d7b-4608-97e0-53b34640807c", "comment": "Malware payload (Smoke Loader)", "value": "cf0fa218d05eb748a62964f9b0269767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008453, "uuid": "58b02bb3-e994-4a88-8321-850207daeec7", "comment": "Malware payload (Smoke Loader)", "value": "84ea01f75e2bea4e9df373887e39dd6d6ca8adcf5b77cce084c7cfebff082d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008453, "uuid": "22071da7-baa5-4bf4-b676-9cb7f4f4bbf2", "comment": "Malware payload (Smoke Loader)", "value": "a779f187d37f25caccdf54411a0f6bce77e01a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008453, "uuid": "6c8d761f-7088-489f-9b54-ea2e90667278", "comment": "Malware payload (Smoke Loader)", "value": "31f5fb5aec5c1f6478c8ceb8c4764cb4e958a3180538e736cd695e57078b094fadd85e9e807e2a3ba72b128f7200461f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008453, "uuid": "780bd0cb-ac9f-4525-af0b-d099f96cdb28", "value": "T19554E1267993C472C41610739835CFE05ABF9F3C167409973BA816FE6FB02E256B634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008453, "uuid": "b342998f-581f-4a06-b541-925f4d7cbaf2", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008453, "uuid": "05eeb2bb-7dd8-4c0c-8212-807c1a45adcf", "value": "3072:7WXk5XG8PbIL3n+7r2or/dw+jjIzknYBri3:STL3+JIzkU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662008453, "uuid": "35306e9d-d6ca-4770-904e-589e7ce77ad9", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662008453, "uuid": "a2412f74-d4ca-45ec-a97d-a5060c9d8e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008453, "uuid": "a3044192-2475-49fe-8b45-310accbdf46a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d99df7-29cb-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662018750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018750, "uuid": "fa18913a-d595-4511-85e9-2e4a53dd13d9", "comment": "Malware payload (AveMariaRAT)", "value": "09615ab1e7d3da53aba689272afb1f4d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018750, "uuid": "da1fcee8-3e68-4362-ae06-b77122dd3f8e", "comment": "Malware payload (AveMariaRAT)", "value": "857c7dc4b88d6fa4751d23d732784204fdf452114f4135437579e3cfe4ba452d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018750, "uuid": "8732f660-52ec-4255-b97b-ed2d00aaffd1", "comment": "Malware payload (AveMariaRAT)", "value": "2787f83bc88c34409b57ff3954e7ecf7b8601df7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018750, "uuid": "7fc9d18d-d29d-4980-b39c-e7158d22be59", "comment": "Malware payload (AveMariaRAT)", "value": "ad25b23d4cd97769e7a82ef64c15ca8228741f9b202c1aeebec7d2eff99036a155de62188f79ff9422f8be54fdb0f34b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018750, "uuid": "aba0f138-8802-467d-83da-03c50ec30f50", "value": "T1EE347D94B5E8251422E379C7AF6BF2B4073EE5E8A4368E6C44CC0A2DDBDC004589A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018750, "uuid": "46640725-3718-479d-a878-182d40f5f5d6", "value": "24:QnORimuEuM9h7PogNEbrnLgUoEJEOXo+pa+w343eDysrDihH:yEiRMJV3U5WOXH0yvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018750, "uuid": "f98084db-855f-40d5-b078-4c197d9e3c67", "value": 240496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018750, "uuid": "0bfc1fd3-064e-45fd-8ab7-979ddb3ef417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018750, "uuid": "0fa60350-ecbe-4f00-83da-0568b9c90465", "value": "ORDER00388737838.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61816bd4-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014605, "uuid": "8b2733fc-42c9-4f6e-9bbc-8e9f07396738", "comment": "Malware payload (Gafgyt)", "value": "94abaa3234c9742b9ad897737639df9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014605, "uuid": "1e1dda70-542e-4022-9f96-510d87717df6", "comment": "Malware payload (Gafgyt)", "value": "86d9556895aedf66a2d9cde0e190252f0842ce90eb5ec37ff3e7efff7bdd5260", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014605, "uuid": "da611c65-23f6-4119-9e4a-a0035ea7568c", "comment": "Malware payload (Gafgyt)", "value": "3aff78732c230766aa9e15efd3402a106d139c8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014605, "uuid": "4d8cfdc8-0d79-4132-bc23-e040921981dc", "comment": "Malware payload (Gafgyt)", "value": "34bca0a694f560dd4fc4b73bf4838bd0e0d2fb6dec7ac3044ec72e1673eb554db883a17732326312304288b1b07a83bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014605, "uuid": "50a148d8-4826-4760-87a8-d97100047db0", "value": "T1B4931941F9418B27C2D237BAE78F435D77366A64A7D733016A356EB42BC27D82E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014605, "uuid": "4916aca4-1912-49e9-816e-3a7f50010ad5", "value": "1536:jBkF9VQPAGZXz+MfgcqVq1ifTPTxHOJKqPHsCE7XumREqQ4b/X7XSee:GQFXzFT16TjqPHpmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014605, "uuid": "2431aff4-8ccf-4f1e-9c90-55aad2e1dcb5", "value": 92441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014605, "uuid": "b928f278-9709-45a7-9774-f36bd7b9c524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014605, "uuid": "aaf5dbe9-4b0a-4ba7-882c-535dd6634239", "value": "94abaa3234c9742b9ad897737639df9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba17aa24-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014754, "uuid": "b8db9cfa-a1ec-42d9-bc90-6337139fbb44", "comment": "Malware payload (Mirai)", "value": "21ac5139e157e15a81786aa3108644bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014754, "uuid": "dac21492-a204-42a6-889d-15504aab2c53", "comment": "Malware payload (Mirai)", "value": "880271ed45f647a6a3129b9e875b495da85896830edd0eb14bf9926a22f1b833", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014754, "uuid": "04992b8d-2a9c-4c80-853b-4e907a827b3c", "comment": "Malware payload (Mirai)", "value": "813d58d8cff887521fdcaed788d561566cf6863f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014754, "uuid": "b5f5f56f-0597-4593-8adb-2f169b91c9a6", "comment": "Malware payload (Mirai)", "value": "09e3c943ae6a4ca6240f7ce21d92a04e9e97c2f627a65119cbad181d9a902533137806d72a191eee53b9e231bc16f63a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014754, "uuid": "11584e7a-559d-4365-9cfb-f839b450f4f6", "value": "T1F5831856BC814F12C5C602B9FA5E118E331367BCE2DEB3139E206B24778696B0E37955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014754, "uuid": "6c413551-63a0-4d35-bdb4-7c70e1dc6d73", "value": "1536:V6nY2h9263aYmLJOdKXQDDPFeDE9xlkrQMdGL8J3KHpf5Qnug1WbsZC70hivo9Ds:ihM63uJqnDPFeDE9xlkrQMdGL8J3KHp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014754, "uuid": "6de57464-0c97-4940-a463-42f54c5ab353", "value": 84152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014754, "uuid": "838cabc8-539f-4f7c-ae5e-b266d3e2b3f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014754, "uuid": "36c49c33-5c00-4c6d-a94c-bcf7607fbad2", "value": "supercat.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cd79d5-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014480, "uuid": "4d0920c1-47c6-48ac-a825-47ccb54d675a", "comment": "Malware payload (Gafgyt)", "value": "8c8f5c8109e1fdbbc06522a15393397b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014480, "uuid": "4d9a4f6a-083f-4632-bba9-d94d1ef22cc0", "comment": "Malware payload (Gafgyt)", "value": "880d3286cfa237f535a191b57004892319a167784f4d9e02a89dd2314348dd16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014480, "uuid": "90f5b8a4-d25b-4afa-a13d-1942cd1ca710", "comment": "Malware payload (Gafgyt)", "value": "79f7de56289cc29cf1df2861548ec5c70b44d942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014480, "uuid": "79f8d2b4-de48-44d0-80b0-d9eb34178e45", "comment": "Malware payload (Gafgyt)", "value": "24af997351ebc8d0536ac4ab4f1bd2294617da8240683be97997db6eb4e884f84b2410a4b89897744ce7bd494b310c89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014480, "uuid": "a44f42a5-7992-4780-979f-1dcb843ae20c", "value": "T11BB3852A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014480, "uuid": "bdeb54cf-261a-4ef0-91bb-c2c48d27fd63", "value": "1536:27ju1Thpq+XvYC2rKy3eYxPGEEeRYYIk8vEC7ZXA4PUmkiSFxfC7xbXe:RvYBPGEu/kFs64PUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014480, "uuid": "3e4f1d88-23a2-49ff-a33e-4edede449540", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014480, "uuid": "e28430c6-f9b5-4903-ab85-d9b97b9dce7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014480, "uuid": "e7df3939-4a49-469b-817a-3b1b13c3567b", "value": "8c8f5c8109e1fdbbc06522a15393397b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbb4fe8-2a49-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662072934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072934, "uuid": "4742b0b6-cc50-41b9-826c-5900110c8663", "comment": "Malware payload (RedLineStealer)", "value": "0bdd3f00771d5bceb61e3e534aba8d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072934, "uuid": "c1f771b2-c373-46a3-91bf-391c7e19efc1", "comment": "Malware payload (RedLineStealer)", "value": "884b082bef393235877a95f4ff0a8da6a4be471fc2e6eb9d69a5066b404bcfd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072934, "uuid": "f47e0047-c57a-4570-bcad-111f99e7ae4d", "comment": "Malware payload (RedLineStealer)", "value": "31e71716774802306ecf6ae260e74f3a9f41cef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662072934, "uuid": "2d17396c-e9de-4a26-b61e-ce95c19f3f38", "comment": "Malware payload (RedLineStealer)", "value": "bd155ed5e67aaece894d82d6442389b03d7d0748ae2ce5baaddccc4ec19b6a0936f11eff08b752a51a4c30e2387edc3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072934, "uuid": "1d5ca2d5-49a2-41f5-9439-f2d4aebd52a8", "value": "T1BAC50903AACB0E75DDD23BB4619B533BA734ED30CA2A9B7FF608C53559532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072934, "uuid": "65dfeb10-e530-4ec2-bdfd-de39c9d967a7", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072934, "uuid": "2ccf30cc-75d2-478c-b89c-2fa87f81bed7", "value": "24576:hWyXgBYcYjFrbY8MX0lTFCUswynOvAPUmO5kRnyBQML8fGLwpSN+pwuQNaKSOl33:VXxOweOvBBQML8fG04GOl33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662072934, "uuid": "6116a967-72be-4bfc-b1a1-b1dec063ee8a", "value": 2542274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662072934, "uuid": "84e993e3-192d-483a-86e0-106d082cce5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662072934, "uuid": "6af3c3e5-7acf-4881-9249-457862ef6ab2", "value": "0bdd3f00771d5bceb61e3e534aba8d1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e97485-29da-11ed-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1662025537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025537, "uuid": "b835eba0-41a6-400d-97ea-4af4bf97493c", "comment": "Malware payload (OskiStealer)", "value": "ecb3be33e7b9240e66f41548c625a126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025537, "uuid": "7209cd95-5740-447c-b0a7-5f99140b98b5", "comment": "Malware payload (OskiStealer)", "value": "885e52307f6adb37083352ef06cd26243612018731c6ec8914664506d11ea70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025537, "uuid": "c3c185e7-18c8-41d2-9952-aa6ce5bd696b", "comment": "Malware payload (OskiStealer)", "value": "5b458380b287151ab79230902134f17cbecf099d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025537, "uuid": "f642a8a4-22e8-4dfb-80ff-646b4ee947fb", "comment": "Malware payload (OskiStealer)", "value": "bdc5a255c1c42d5b9cbe3fc783e7cf4f0b42aa9c858de801e454aee3686b962c38a7c36839abd24575e65957f757ddd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025537, "uuid": "1a8c1433-c91e-44ab-9a30-d4976c8e98b9", "value": "T165146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025537, "uuid": "5a54578a-418a-45da-99b8-f65a239eaab5", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025537, "uuid": "0225c8e1-1321-4798-8f57-5f8e986c4c05", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIQ1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pN51Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025537, "uuid": "fb18e70c-e484-4e9d-921e-16f6ae6ac340", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025537, "uuid": "dd79fa7e-5cf5-454d-b4b0-41798553ee31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025537, "uuid": "1a46f9b0-7706-4a04-9e0d-3f350e91dda3", "value": "885E52307F6ADB37083352EF06CD26243612018731C6E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6364845-29ce-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662020304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020304, "uuid": "cec14152-8bb9-49c9-bbb5-9a4dff8225e0", "comment": "Malware payload (Smoke Loader)", "value": "bfdaa0c8b3f45d4a55d33d36402f63bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020304, "uuid": "aa2ea2ee-63f9-495c-bfb5-e2b0cfed9669", "comment": "Malware payload (Smoke Loader)", "value": "88b518753b964090695996d260e2a46c68b8ef6d92eb75d98af2cb6193987bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020304, "uuid": "ff25df4b-2281-4dd9-aed0-71d748015b60", "comment": "Malware payload (Smoke Loader)", "value": "09040d41bc55b7f5eaa7cb2933175cddad6be992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020304, "uuid": "708478c0-ac27-41c0-a294-00ba146b7202", "comment": "Malware payload (Smoke Loader)", "value": "6a0efc7c9b5088b21e66284d92320fb905a2c31a32124e265fd14cc4357d966006d87e7804da58ed6a5aa27afffd944c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020304, "uuid": "25122c4a-d22c-4fdd-bda2-7891df4366a8", "value": "T13C54E032F952D4B2C05125705425DBE56BBF99301279888B3B6C36BE9F703F29A7630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020304, "uuid": "869fdcfe-3b46-4df5-af68-5457e283496a", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020304, "uuid": "729d32e4-2670-494b-8bb2-441841ca5e2f", "value": "3072:TCXk6CVnXguLIN17r2of348uLgv1FGd8pDVTb/C:2CLk1To8v1Fq8pDVP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020304, "uuid": "3f25795f-0ad5-48f6-a3f7-d0b7034ee763", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020304, "uuid": "84820f99-22de-4cb5-8e85-2b6e5c3ef542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020304, "uuid": "299bd58c-d994-4a48-b901-046a102ceb44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029cfa1a-29c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1662016594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016594, "uuid": "954dd97d-848f-4a63-9ae2-d54f5fb39514", "comment": "Malware payload (AsyncRAT)", "value": "901f7617494b9485c9c5128256b54524", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016594, "uuid": "fceeef1a-76c8-465b-8149-500cea86c1f5", "comment": "Malware payload (AsyncRAT)", "value": "88f649b2ed2e8dd17e39d937a830e05b9c87d95361008a46065db6c2f26688ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016594, "uuid": "04d872a2-ff8b-4bf1-afbb-52c010e52f0c", "comment": "Malware payload (AsyncRAT)", "value": "632fd10461f0bc9b920fb53f0a7587adead46d3f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016594, "uuid": "3943080f-ce2c-4d62-968f-7d802de6b345", "comment": "Malware payload (AsyncRAT)", "value": "cab7a5b5d1e32e321c988a5d63ad4301fb0a781a650e0c3b3f8f4fc3b69eeb57fb061fdd4f2a1ac9114930a24bbd1580", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016594, "uuid": "67586eb1-0c50-4657-a7fb-d28667f63dea", "value": "T1DCD0C0921B58EB0EF83901DB9202FC039155132B4A42F25000AFD278E8872E7A2030FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016594, "uuid": "5d489f74-97c0-45fd-bb7f-7ff31d458041", "value": "3:W9KEIuLBKjOkADYu8HElMKKhmHEVtWIidw/WgkARyYwUaRqLYR0VUHo4GoEPmd7v:WogLBsmYuWElLZHAidw/O9Xcm0+gU7vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662016594, "uuid": "274baa8e-c74d-4a4f-b398-7f841175f0ee", "value": 195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662016594, "uuid": "511a864f-ee7a-48fe-889a-821410692b06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016594, "uuid": "b540badf-b093-4247-aab3-181674252de8", "value": "RFVB01KJYHASOPMWER_08-31_pdf.HTML", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a205adb-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030994, "uuid": "3a88d3c3-f787-430e-98e6-dd8f85403b7c", "comment": "Malware payload", "value": "a7ec1ce7c4a3c76be0c4c341c122db60", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030994, "uuid": "f6c04143-7544-4a9a-a59c-04d5591962c7", "comment": "Malware payload", "value": "892f7905d9da10a473fced7c1f0b952c1b31bb15d881d1335026f52800c6831d", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030994, "uuid": "8da92aad-67ea-40dc-a28d-529bc7379395", "comment": "Malware payload", "value": "16ad6bc253ab13605de4cb7cdb1b51b0af47eff0", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030994, "uuid": "2cbe33bf-75e5-4258-85bf-276d073fe5d5", "comment": "Malware payload", "value": "1c1337b69f51c6f5116f23b643796034ef5d57399afecfedafdd1cfc6bff77727beaa2b34dd20d3637092eae7ecb4259", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030994, "uuid": "7634d3c7-8286-45aa-8b23-232e545de3b9", "value": "T1DED2F8331E43BCE82F7A1D46E646B4911D8E3D5B83644E98FBC80DA611E5612DF2E83D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030994, "uuid": "e4e68f37-1828-4803-8905-57846c3afe4a", "value": "384:hI264ePPOrLPYnYeUJc/l6M7WzJ7WR6ZmmLa4BmcIxg0icrf+Mbpi0dnVy0/+5FJ:7aOvgnRUil6FJ7WYmWc5bAWELklZIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030994, "uuid": "44d92972-96e4-41fc-9ac0-0a9b6b2076b3", "value": 29356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030994, "uuid": "441fad01-35f5-4da7-9e61-5da8f9cfe444", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030994, "uuid": "84237842-243a-4ae0-83a4-9951c768d19e", "value": "Dll.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785d9c31-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030965, "uuid": "8e5ca439-7e61-40e6-99fd-0b5051f34e3f", "comment": "Malware payload", "value": "86d604df11ba9ccaae5c3bf834e07d9b", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030965, "uuid": "950f524f-92f8-4017-ba06-b92be1251120", "comment": "Malware payload", "value": "896938177b856721e772ab6a3b40c5a1c68d396686f00bc791356622bc992635", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030965, "uuid": "802a3679-0741-4f5e-a670-6ee62ee5f0c9", "comment": "Malware payload", "value": "59d8e38f80bd80ded885b1a4df2cfc2d2b26961e", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030965, "uuid": "065c376d-038b-4330-b1cd-17e9d980b4a6", "comment": "Malware payload", "value": "1656e55a15e94d58bf0ec9ec0aa87928ddec7a9221d79bcae5ffdbd330d98ecfed7ebde6fc94334b714af4a9382ed118", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030965, "uuid": "6eabbade-772b-4d62-bdde-99a8b2028409", "value": "T1CCB3812024EA211DF7B39E5DEEE5F5A6C88AA7212509F83DC47C53034A51B42EED147F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030965, "uuid": "68e92239-e9a0-43c7-9dbb-e0a759e7a804", "value": "768:AH8XxnEZvHaU3xwWBXij5ueuInIVkX/LUNuosF4JNe69QxlTE+Q3V4wiQd:bxnEZvHaKxDJ0sIIao9Ne6Q7TE3V7i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030965, "uuid": "2957cdc5-499a-4384-a771-776e051553df", "value": 113182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030965, "uuid": "be484cd9-0573-4289-9222-679736ae500b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030965, "uuid": "a3415c08-6a68-4fbb-8946-a9ee6f3f23a4", "value": "Pf3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5d91a3-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662046408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046408, "uuid": "ae8d282f-bfbb-4576-af33-ebe7542c8d02", "comment": "Malware payload (RedLineStealer)", "value": "3cee2ab1eed5162e2dc415acfd0bca94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046408, "uuid": "0aebf4b1-18b9-4f9a-af00-9e8663e62823", "comment": "Malware payload (RedLineStealer)", "value": "89b564434cf70afd674eb0ce61c03991619e51ba44d69a0c6435de4464cad3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046408, "uuid": "354d7419-63d7-4568-a9ea-b5240461848d", "comment": "Malware payload (RedLineStealer)", "value": "f97ae2a4d7434206c2fa8aca099440f6c86a8a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046408, "uuid": "96b558b7-f48b-46c0-ada8-7270d6993ae9", "comment": "Malware payload (RedLineStealer)", "value": "4f434a9dbf73db19dbd61b3e2398e9d33853e252c8a0d95259a4a543e72d2af2d19119f95714a6b33f97c27f6d0e972e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046408, "uuid": "8900d65e-5034-4300-a4c0-b20af604fd7d", "value": "T1FD934A2533DD4A38EABD4B75A8B301584BB0A64F2502D78F8FC5B0D95E62BC05B136E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046408, "uuid": "a6620d9d-976b-48d6-bf2a-8c0fd6487f59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046408, "uuid": "03ae0541-6540-4ed3-8346-e9f4294657e6", "value": "1536:eIJwVE9WKhhc79DRSNx9kTVsYdCMw/br+F/drerc/IKygTlGCu:TJxc79sN3k0/G/xerc/IKy+lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046408, "uuid": "98149094-c507-4e35-bb3e-fee59b67850b", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046408, "uuid": "77e078b1-e24e-486f-b4fa-68ce2c84eafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046408, "uuid": "76aa2fa1-67ee-4d5b-a086-ae57f945ec36", "value": "MyMXEmYnFoPFBPt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3979bbba-2a1e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662054482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054482, "uuid": "eefeba3b-db53-44f7-bafd-29584165650f", "comment": "Malware payload (AgentTesla)", "value": "a89b2742d1514c565651ee7e270595c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054482, "uuid": "6332548f-0be9-404e-9bbf-6994b573a4d7", "comment": "Malware payload (AgentTesla)", "value": "8abbe0611e89d7272200f8672531a583c42bfd48562e49cebf98efcdf4c2b2da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054482, "uuid": "d2f84558-7431-431c-b975-dfdc6e0f9567", "comment": "Malware payload (AgentTesla)", "value": "bd10a0b2b6e3fbe005643567f26121d82d23c09e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054482, "uuid": "d1e16fbc-5ba7-41f7-b395-83f5f7048c62", "comment": "Malware payload (AgentTesla)", "value": "7c3303018cc2bead6f1dcc09acf94477349dec9b313607b2b79e7cce5e9d7c84777ded92f4f7a9f4c1123828ffa063b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054482, "uuid": "1d245e63-5410-4245-b061-da584bb2ef82", "value": "T1F215125EE180AB23F46E0F7411F1F316537BAF0A5676D68C5DC9E3F429DA32A8242943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054482, "uuid": "61b6ec52-3fae-4088-9192-a3ce3334e70a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054482, "uuid": "3ad4df9b-0ba2-42f9-bee8-065b7d060256", "value": "24576:jZ5iSobZtuDigvz1si27aZqbeSxUdXY+mzo3bv:d5i7Ztu2K1si2OobeS2BlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054482, "uuid": "f317eba2-567d-41eb-8388-c4ad73720d9e", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054482, "uuid": "83e26f81-53b3-4d9b-8d8a-328259e78dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054482, "uuid": "79d15e36-03ea-4998-a4c8-ffff63f356de", "value": "a89b2742d1514c565651ee7e270595c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2178ce33-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662006767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006767, "uuid": "1f766a7e-f570-4b10-8c6e-2043c27bcd85", "comment": "Malware payload (AgentTesla)", "value": "cc38a69e891933c486a0b826c4e20c29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006767, "uuid": "2c8bef96-4fcc-441a-8adc-65a990767cab", "comment": "Malware payload (AgentTesla)", "value": "8b3861ba5851e8e8d60248384b8d62e1ba084210a035cdee76d6cb39fe93863f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006767, "uuid": "484a69ab-7634-430c-9fda-a77e730adee2", "comment": "Malware payload (AgentTesla)", "value": "73c694a0be2baa05d4df21321919addd9c6a355c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006767, "uuid": "8ca79742-188a-4abb-96a3-20c4fe5dee09", "comment": "Malware payload (AgentTesla)", "value": "d410ea916380e8060d1e4c7310a2967b76237a0368987798bcbb25f1ce1d9f959529f0cad7c9e9e8e3e5200af75307cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006767, "uuid": "c2eba53e-3b59-4b8d-945b-fad4959420ad", "value": "T10825128D9584C376F4170BB021A1F11996BEBE129171C2D8AFCFF2FC85B8B169217A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006767, "uuid": "6525658b-fdab-4839-acc8-60e362571889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006767, "uuid": "6c49114a-eac0-4123-b050-6ac8d4429224", "value": "24576:cZ57INwSp7phIjX4iiENLZ7XY+mzo3bv:G5U1jIjIiPZLlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006767, "uuid": "c058c09a-5ca3-485f-9c8e-62c12efceaa4", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006767, "uuid": "f5bdcc06-a791-42d9-86a8-d867e7a31b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006767, "uuid": "3baa18ea-8910-4f7e-8e60-1a7a8988077b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.15757.9951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83d1758-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662028495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028495, "uuid": "88ec1a30-9d7f-48ba-82f3-1c2f3e327934", "comment": "Malware payload (Formbook)", "value": "a76065af59d2b509dd7ecc684fa898ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028495, "uuid": "12b63c84-1901-4e1b-bd09-15bf9e2b5d9a", "comment": "Malware payload (Formbook)", "value": "8ba4e909de453a9a2417a992da877b8d809c89a675618e574062d7cef6f18b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028495, "uuid": "e1a22723-8aea-4d94-8f71-e2879f42866b", "comment": "Malware payload (Formbook)", "value": "b18c063347b1739973fa6fcaabad757877955eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028495, "uuid": "c2c79e4b-abd2-4e4e-a89b-d9b8af5f2b68", "comment": "Malware payload (Formbook)", "value": "37d83d18af217fdbfa9a5fd9e8f903329a297d96f2b72ef76313a4a954d5c980512947861a0fd03f650174f529e232b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028495, "uuid": "bda2f672-14e9-4bab-a8bf-a3eac449bbdd", "value": "T14B654B9C7650B2AFC817CE768AA45C24FA60B56B431BE347A05326EC9D0D69FCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028495, "uuid": "082043e9-3c04-4def-97c9-4378ac33a796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028495, "uuid": "ea3f48d8-7306-4c7b-8b01-b346dff31bb6", "value": "24576:Uw453p7+PvZEOJkZ5a7jFzQREqJUTAEAoXMuc5:SB2H05adILJnEAo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028495, "uuid": "927ed62f-716f-4e81-94f5-1ab306171812", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028495, "uuid": "98ec4976-cfd2-4903-a21b-d399e60ebb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028495, "uuid": "bbd93ad3-72d4-49bc-a895-e54a004bb5b6", "value": "a76065af59d2b509dd7ecc684fa898ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7627c5-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014547, "uuid": "1a43232b-63bd-4a0e-a43b-67d16ddaf2d1", "comment": "Malware payload (Gafgyt)", "value": "b77f5c27369dc3ab68e54b24fb6d155d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014547, "uuid": "4ec8d2ec-419b-4872-b8d9-7d21a265a7b2", "comment": "Malware payload (Gafgyt)", "value": "8bb2031579f29af81d54c5ad6cb3c38f1ad4b6571afe1ddd84ae7edaa79d4c29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014547, "uuid": "dc62299d-b3f6-4d47-98f7-f2260633d994", "comment": "Malware payload (Gafgyt)", "value": "e52735f529921860ca20d700159a28c216aa2e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014547, "uuid": "86bbe734-2193-4b3d-9647-c8adf0300be6", "comment": "Malware payload (Gafgyt)", "value": "42145261f6e71f5541a3f88830119af91d3845d9fbf9d8b4b2ffd36c485c3f1354453f1803321f2c28ad0c9450e0a036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014547, "uuid": "c4bfbd0d-d780-4140-891c-8bb176941288", "value": "T1C5734D41E652CAB3C8930BB6029B5B264631FC3A1E2B9F59F31D7CF49B124C87217755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014547, "uuid": "3f7953f9-5dd1-4022-ae90-fef9ab8e3bc3", "value": "1536:0+xNVpGQWuKv8xKBnq5PeOj5zMLBS5qmLI2VOCjXUfJRk:nNT830xKBnq9eG2S5qmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014547, "uuid": "2b7746fd-5378-47aa-a956-143d4be10647", "value": 74017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014547, "uuid": "9703b507-c5c6-4ed1-8467-50f02c670777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014547, "uuid": "0de9c5fc-2d3c-4b9b-9d07-b06bd52b65da", "value": "b77f5c27369dc3ab68e54b24fb6d155d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dded15-29c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1662016537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016537, "uuid": "85ea0767-bd9f-4845-9631-72f39c7753d8", "comment": "Malware payload (AsyncRAT)", "value": "56a7f73a3d48f78fa82f1fc49b323581", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016537, "uuid": "c84779b6-868b-4b21-9e45-9c48ebb263ec", "comment": "Malware payload (AsyncRAT)", "value": "8bc2c6a0e87088293e0437ddaac1c50ba09608bbeea2e901567a4ce34bf1bc3f", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016537, "uuid": "d7d2283c-38f6-466f-be92-4c8df5ae84e2", "comment": "Malware payload (AsyncRAT)", "value": "1aff2d6a5145488879ce640a3c2a7115b1729695", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016537, "uuid": "babe0bef-1074-4de4-84d8-f31b0bf5282e", "comment": "Malware payload (AsyncRAT)", "value": "a0c975eac5407e029fb8deffffee523c9c0865fe9d9485e409bba195b6665429df5ee57c961539105ef03c6f667760f7", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016537, "uuid": "3bb9ca65-44c2-487c-8621-b49f3300fb21", "value": "T1F2E0260A8A040426F626B33DA03C06938E0C5281DE6080DEA7A41B380D43EE7FD421F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016537, "uuid": "da55123e-541e-44e5-bb73-37096e1259b1", "value": "6:5jU6wziAmUgdd+AtcdNH8FFdCRzfEW1eNAOU6wciAmQl+lUt/:5jUbziXj+YcdNHAFdSzf/2ApbciKac/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662016537, "uuid": "5b7b0035-5f63-4fb0-ac79-0cf752aa57cc", "value": 340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662016537, "uuid": "3d641ed2-57ca-46ad-a87a-b097203facc9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016537, "uuid": "f20ae6b2-8a5c-48e3-aec0-83b5bcb2b3eb", "value": "RFVB01KJYHASOPMWER_08-31_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d1e92f-29ae-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662006560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006560, "uuid": "bc403c8b-5ac4-45e7-9385-0ee8b05c0222", "comment": "Malware payload (RemcosRAT)", "value": "40755213dd6ef5e54949f2d0f4740003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006560, "uuid": "8d767099-56bb-4497-917d-5af1d598a205", "comment": "Malware payload (RemcosRAT)", "value": "8c52f530e88c35d2b1c0a9aaf30cc6d99eee4fb150e47de86f49730b294fe527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006560, "uuid": "6790cdcc-fef0-4342-9471-1e20287f8cec", "comment": "Malware payload (RemcosRAT)", "value": "26cbf5ec881b846a9befeb20bd7aada016a697be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006560, "uuid": "02910e33-923b-463f-921a-b3c43bc6cb11", "comment": "Malware payload (RemcosRAT)", "value": "331e135da7562d7845535f0717e60bfeaf7757bb7effbdea25fb24ff379d05a0bd0167f0054aa43d15af7d0e30d84e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006560, "uuid": "b6c348d3-93ee-443c-a600-c63f6d09d2a0", "value": "T1E42501C2EB804694EC2D2BB514765C655377BE2ABCB0F50D5D8870FA2AB33974232D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006560, "uuid": "fc8ab5ca-ee7e-45e1-89b3-0be0c6281c14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006560, "uuid": "abf01898-9137-4e91-9f03-275df92acdfa", "value": "24576:3/z9G2KCN5da9CcR/wxxZlwV0eRifauWW:UNCDQ0lg0nWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006560, "uuid": "6e5ff0fc-85f1-498b-af49-096254706800", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006560, "uuid": "d82726e2-bb4f-41e5-9ac1-ce6fe46deed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006560, "uuid": "4dee59de-931f-4705-bca5-836ebfbf0ab8", "value": "DES HED1212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104b19ef-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1661999437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999437, "uuid": "411ccfa6-e018-440b-af52-8cd9d770f7fa", "comment": "Malware payload (Formbook)", "value": "24768fd24b01906119ac0626d90061ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999437, "uuid": "30796aea-c354-4523-81f5-5eeef87a6eec", "comment": "Malware payload (Formbook)", "value": "8c8ee669405fa28246466c1b2bcc4cc1a57cf4d5128f5bfe7a3f25070a7c5936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999437, "uuid": "01fbf00f-1370-48cf-9059-39370250babc", "comment": "Malware payload (Formbook)", "value": "02f12d471a28aad572299617ad6cebf76c325a9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999437, "uuid": "9890d873-4eba-481f-8153-03b449f436bc", "comment": "Malware payload (Formbook)", "value": "48dd309a752d5fff7f35833ca9efdd4d3a193e2032015103c3e28bb77a77c52ab4f91ea834ec9c84cfa73b443a506bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999437, "uuid": "c263dd05-7b71-4462-a844-801c16dc52f2", "value": "T185B4C00631C093F1E438863CA619459C03F27D3BD711EA977CCA72898B7B2D696A7663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999437, "uuid": "c08f40ac-1c91-481a-b98a-b9d7dc9c274e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999437, "uuid": "4b26b3ca-bc6c-4459-8795-70e934f4e3db", "value": "12288:A2942IWQ20shxEXlTiWtUQDNGkkkkkkkkkkBWC/ZX6:79lBhhe1BtUQDJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999437, "uuid": "16fc9625-06f9-4d08-8e32-9839d3072a51", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999437, "uuid": "fb9f7071-eb67-4ef8-bf84-d8a1f6e2c261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999437, "uuid": "c390006c-7a25-407b-9ceb-e680e9be567a", "value": "SecuriteInfo.com.Trojan.GenericKD.61635607.21979.13379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f9006a-29eb-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662032897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032897, "uuid": "843f4a64-4876-4d19-a18a-aa52c6bb330a", "comment": "Malware payload (RedLineStealer)", "value": "907d6f4ce40f1a6c0bf216fe9c01c5c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032897, "uuid": "a553b3ed-9799-44b3-b0c0-03e8515637ae", "comment": "Malware payload (RedLineStealer)", "value": "8d182199b2617c7ae7c0eeeaea31fe1b6431be4f0691d5059285885bb12b97e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032897, "uuid": "89ad549d-1434-4bd0-acb7-b1f46e123429", "comment": "Malware payload (RedLineStealer)", "value": "3d596fef606d01b1da5fac9262932faa649c604b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032897, "uuid": "f39e9e33-09b1-4625-9715-fddfdbec8df1", "comment": "Malware payload (RedLineStealer)", "value": "077facc110dedc8ff43f2dbf437abfeec93a189df38a803719f13748817fa7db8b74d7d98681f7ec2e405cae77cf853e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032897, "uuid": "a9ae035b-90a6-4f9d-ad0f-b40960d17a4a", "value": "T1763612362265044DC5DA9C36853FBEA031F613275B82ACFA65ED5DC31A729F1F223A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032897, "uuid": "aa2b6a67-805a-427a-bcd1-e85b10303dbe", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032897, "uuid": "2b2fca36-ea4c-475d-8faf-3b410e80558a", "value": "98304:2SoyH7NopjaulNnz0jeDLld9BINwWCOLDjmtowdg2CRxQQV:2EkaEI4b9BINwHOLvpfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032897, "uuid": "7f9932c3-055a-4815-8d81-3a76d557c1fa", "value": 5218608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032897, "uuid": "d3d71654-b148-4671-9b79-05cbd36384bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032897, "uuid": "28736f2c-e7c8-4c38-91ba-8ffc97e9f982", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2557557f-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662006774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006774, "uuid": "960ffeb7-c420-4bd8-9aba-e25c7bfccc8e", "comment": "Malware payload (AgentTesla)", "value": "41eda1a7bb9cbb22fcb73181d591e7a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006774, "uuid": "2e154cff-373f-4b6b-b8d0-dab31f57de41", "comment": "Malware payload (AgentTesla)", "value": "8d2a3a13d533b4814c2717a0cae7c17582130b1fa4451f3d64c1df35e6d69ed9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006774, "uuid": "dc25dbdf-f39f-4785-9a1b-dafb7a3d338d", "comment": "Malware payload (AgentTesla)", "value": "33826f691bd508104dd0b5bf15a66299e967e3f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006774, "uuid": "6de73a32-fe52-4796-bdde-16f545a55243", "comment": "Malware payload (AgentTesla)", "value": "0ad05731946cc16f4ba4cd731fef455522333212f94111e6f5d00493b128f929e946d484690ad1b3f4f5aa48f1533786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006774, "uuid": "b7a3fc0f-5394-4085-bce2-6e5d1d06e8fa", "value": "T1D535F18D7540B3EFD8178D3189A07C24E635B937931BC283A54B66BC895CB97CF162A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006774, "uuid": "9747bb82-dc32-4ecd-a4b9-596a6cf5bd4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006774, "uuid": "e840450f-0460-421c-a01d-b97426a1d725", "value": "24576:p1Z5MXY+mzo3bvxsu/dMS7QoAdbyZpKiNfyL15cxDM2:15KlmzMpsu+SnAwfAc9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006774, "uuid": "fed1c95b-41fa-48f8-b46c-cf8d766efd6b", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006774, "uuid": "a85efe4c-2ba8-4d95-bf31-2688641f474e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006774, "uuid": "d3eea6be-c47c-45a7-a22e-877fd187c1dc", "value": "SecuriteInfo.com.W32.AIDetectNet.01.19540.30741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3ebf2e-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662028364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028364, "uuid": "1b017650-e208-41f3-98b9-cdeb2378e4f8", "comment": "Malware payload (Loki)", "value": "8669ba0dae4024004e147b761757e50f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028364, "uuid": "e8d7d9c9-a776-4846-b384-5e6ade6dce7f", "comment": "Malware payload (Loki)", "value": "8dd48efe8e0436ade87dc00c9e525fce417024ac04e9ac060ecb384ec67f0951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028364, "uuid": "826e2842-ed2f-481f-b9f3-ff6326e16ed4", "comment": "Malware payload (Loki)", "value": "6d9afe0b776adef42f78d967aefc19f143363a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028364, "uuid": "0b761fa6-840f-4274-8a42-d688fa1bae33", "comment": "Malware payload (Loki)", "value": "ea949bbaaed82cf4fd73c88c715386e51ad1556c3e4869cd809a007ccde731106137fd10534c56319bd1ec7073686c2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028364, "uuid": "12f65bee-cb2f-4877-a5ac-7306568b2fdc", "value": "T142150249A584C3B6F4261B7111B1F128C6BEBE15D171C2C8AFDFF2EC49A8B129317B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028364, "uuid": "b17346ad-4cc3-4238-991d-b52023ee1381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028364, "uuid": "c111da73-37aa-4d78-96bb-88592e781e4f", "value": "12288:6F75er+meC76ZjXUu9xW890/dzNTINBwsiEAGPN0gPwqoXY+mzoRtbvRT7:6Z5G76ZwaWO0VRTIN/ixW0XY+mzo3bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028364, "uuid": "47178115-9dcf-45f2-a5b0-6e35084e1036", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028364, "uuid": "b8bcc7c2-6724-474f-bc10-98a4574e4dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028364, "uuid": "d0cf0ec6-ed8a-4a78-9c1f-d0106f1ae4c5", "value": "8669ba0dae4024004e147b761757e50f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369b6593-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014533, "uuid": "7859f9dd-3243-4192-91e4-c1bb97187cac", "comment": "Malware payload (Gafgyt)", "value": "77c06ddd6c3125b792aa0a5586fbb253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014533, "uuid": "3214ef6b-cc87-48fd-9d99-820ccf26e31a", "comment": "Malware payload (Gafgyt)", "value": "8e5152729ccffaff2588446c2ffa0d1d69aaa675ae8204a42720317bf5ba67ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014533, "uuid": "c4515176-ac3f-4dc9-8b34-16a6dd47993e", "comment": "Malware payload (Gafgyt)", "value": "4ff7b8e4fc624ee83f88d0cee73d83c18fe0735f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014533, "uuid": "65f96dae-3e13-4c25-8778-9dc9993001fa", "comment": "Malware payload (Gafgyt)", "value": "489eab9539c79ad9db104f3649b44d2991fdfae0f1c6e4da4d2cfca8e5fb9208469d4f493a2bee706a61aa13e443c7e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014533, "uuid": "f49b076d-56c2-4935-a1e6-d29055daecda", "value": "T1CFB3B517AB618FB7C85FCE3306AA850120CDA55612E97B2FB2B4D92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014533, "uuid": "85fa4df8-23c3-4989-aa73-91e8b44c64e0", "value": "1536:ZLeTukthhSMOCMQS+ZjN4pjuIxreg2OptWklwUmkiSFxfC7xbXe:ZRHC3S+dUrektnwUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014533, "uuid": "f6611134-9490-478c-b922-de366a756596", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014533, "uuid": "9567faeb-355d-4ca8-a989-3a29001fff1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014533, "uuid": "03a415ad-a46f-4ee4-bf6e-22a22e553aae", "value": "77c06ddd6c3125b792aa0a5586fbb253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00374372-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024321, "uuid": "50453aa2-44a4-4102-8ed6-bc0ee36e1fda", "comment": "Malware payload (SnakeKeylogger)", "value": "a75c871e21cfc14ae6300cd6d297c5b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024321, "uuid": "89a6b252-543c-4dc1-b80e-fb5b7ba5670f", "comment": "Malware payload (SnakeKeylogger)", "value": "8e549e81a0da6c6421111f2e72d11e7edc27f36f584c4f9489984644a3f7d8eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024321, "uuid": "660bb87b-1af3-4448-8a58-0e01b2c13527", "comment": "Malware payload (SnakeKeylogger)", "value": "e3e0bae53025315096e14a06a780728f35b22264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024321, "uuid": "d668bfa0-2221-486e-b0ca-c9140d773b96", "comment": "Malware payload (SnakeKeylogger)", "value": "e07a700b3f337f498b802244777307083e0ca1d6a3e4f801618bd70c89d078250226316d119f1ef75a8f2a2b84059878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024321, "uuid": "c5a39148-6294-4e2c-acf2-94fe369eeba4", "value": "T11FC3071D3BF88904E6FF8A7305B15225CBB5B851096ACD1D1AC2F8592A7C790CE1BF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024321, "uuid": "d589c390-ad42-46cc-8615-d43e81cd365e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024321, "uuid": "fb6e9711-9521-41e2-9190-7c34f97d4b9d", "value": "1536:0mtcOks6s+sSyJrDKfTvH0wukb/UXBTuibpiOWBPhF0Kcl:0mtcXls3dJrDKfTv3b8x/wBPhFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024321, "uuid": "7c852bf2-b886-43b4-aeea-2c0eea9af087", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024321, "uuid": "75595e37-9804-4358-88db-2a70b779dff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024321, "uuid": "d27f796d-349c-4976-bf8a-12d133b20542", "value": "a75c871e21cfc14ae6300cd6d297c5b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ab76c0-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662028140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028140, "uuid": "6f234ed5-fac4-4e77-b350-a7f9440302ec", "comment": "Malware payload (Formbook)", "value": "24c8acd1ace893a3b0a419a59d0e593e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028140, "uuid": "8843b41b-7e97-4186-886c-d59d2a2d46a0", "comment": "Malware payload (Formbook)", "value": "8ef3bb22554940d25521394b853a698e83b9113404e5efab0ca07215a919653c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028140, "uuid": "d47ad036-a33e-47ec-80ee-722207a0bbef", "comment": "Malware payload (Formbook)", "value": "7ebab45f45a00585366ab5ce14bbfa37b3f63292", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028140, "uuid": "93094e2f-9ba3-4a65-b02c-afaa842d9012", "comment": "Malware payload (Formbook)", "value": "e47c0d69de53610063f385c972089edb492ebb27bca7db42c3b2b4b0f0ecd561185d49cf12fe95f78e30328d62f91030", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028140, "uuid": "e00c697b-14f1-418b-901a-bf27699f5aa8", "value": "T12061430E305BB47895279D71DC5F002EA8736347A2BA52607B0FD6E6CD390ACA75783D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028140, "uuid": "a9d1f4a9-2022-4e9e-8f9a-0a2686ba8c71", "value": "48:m3fEpdREytAqnuNHOvv1w4Tjv0qrnqnJm8rS170IDAGBKG5C/Blzy2Hqjhqr:7ruytkHOvb/9rnqnJm8rS17xD1BL2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028140, "uuid": "4dbe8b57-d728-4c6b-8837-0c0dbd5db85b", "value": 3470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028140, "uuid": "f32dfe93-34c4-464b-b611-6ca768fe4089", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028140, "uuid": "1a389a95-b4a1-4102-b9fe-ff5451fb24d8", "value": "TURKEY NEW SAMPLE ORDER_SCI9393.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69884fc-29c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1662014426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014426, "uuid": "5f8b30fd-0c74-47b4-b7db-4068359c1ffa", "comment": "Malware payload (AsyncRAT)", "value": "9ed5eb09f40156eaa1fb07ff5d812857", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014426, "uuid": "0706b109-836e-4f64-94af-1c5eaea5d7c3", "comment": "Malware payload (AsyncRAT)", "value": "8f7649bc068b21404fe08229026859aaa468634963eca11cc64b661fa64a6880", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014426, "uuid": "69177be2-d492-4774-b2c2-7f1a695e3856", "comment": "Malware payload (AsyncRAT)", "value": "54a25bb01d39a0a1b5d04be8656c269e608526ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014426, "uuid": "a9923639-80a2-4b43-8b52-49fd5c506a03", "comment": "Malware payload (AsyncRAT)", "value": "352889730dff785f73532f5650ea13f02f38066d274fa6ec4dddaf1c35aa45e7c5141c746e855d63b0b5f5639e11c618", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014426, "uuid": "3e8998e4-f15c-4391-89eb-2dc67dd63de2", "value": "T1132402C66BB2DE27F98C71F1D029F4A29D1CBEB50DA3F6439CF8759A04769214B440E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014426, "uuid": "1c4031ed-cb9f-4768-a871-d78e3b4ee1c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014426, "uuid": "f036882b-1560-493d-8260-5d6b1c0278ce", "value": "1536:PuExVThaa28yiAUOLDXscEJpbH/agw90dsuk8pbyFlN4:PuE3Thaa2GAhDXslbbHU90yuTZON4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014426, "uuid": "e41b0fb3-443a-41c5-8dfd-9cc1284fd1d8", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014426, "uuid": "3f366c3e-ceed-4197-b9d2-3ff0b38b636e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014426, "uuid": "5b4b15ce-2949-4c5d-9b2a-616f94d38d1a", "value": "8F7649BC068B21404FE08229026859AAA468634963ECA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33a773b-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662040056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040056, "uuid": "d93c5c4b-a805-4f32-a92e-9f7cfd201b58", "comment": "Malware payload (Smoke Loader)", "value": "17df5161227567059bad514e852a7ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040056, "uuid": "32262894-4394-47e6-a0da-76c01fd225c0", "comment": "Malware payload (Smoke Loader)", "value": "8fff867453be7d4cfdaef9758b692cb982e43d632e239f9b520c997969b974a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040056, "uuid": "412aa69b-df66-4886-b349-c4cf8326853f", "comment": "Malware payload (Smoke Loader)", "value": "5ae7b5f9c4bc01f631841653bd06cdd9aa5f385f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662040056, "uuid": "b6029e62-d100-4c43-8282-e4f4921058ba", "comment": "Malware payload (Smoke Loader)", "value": "f71946fff1c7e69e8068105788ecfea06760d4550c5f0de3219bbabbbf5361b4f5b94e92c678eb4a194b164e02e7dcd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040056, "uuid": "c661f942-44ef-457a-a189-d70f713ccdfb", "value": "T1B254E01C369DC073C45615B188F4CBA2EABEF9321621558B3BA52E6F2F703D19A3530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040056, "uuid": "39755dfe-327e-4f81-82e4-93ddadfeb406", "value": "b0a16631cf6b80d1aaf105b20b72b5bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040056, "uuid": "479c06ca-5db1-490d-9b7c-162f4a73ac34", "value": "3072:SJAsjarfiYL75x52X1RmzW4bJ+UZL05fHA80RAmiPRs:MA/L7jCfWJ+j5fztRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662040056, "uuid": "b35c9afb-79de-41dc-a5e8-4396b79a66e4", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662040056, "uuid": "396ff44d-3b5d-40c1-9d91-cc22f6e0c848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662040056, "uuid": "2a5c83fd-97f2-4920-81bf-16e1de5dde7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69af808e-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030940, "uuid": "c9533300-fa29-4eb4-8b68-db00f4d7a74c", "comment": "Malware payload", "value": "aeb90728a4fa8d0d1857caa2a387b31c", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030940, "uuid": "81f606c4-5974-491a-a5f2-8d38495519e0", "comment": "Malware payload", "value": "909d242b6dfcf46b2971d3173463c7ae87b5bbefbe9902c950a7f3cff61ed294", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030940, "uuid": "da028954-0600-45f2-9ae1-3817d57c6609", "comment": "Malware payload", "value": "82651bbb937169a92f02389eeee8e50c79b37bdb", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030940, "uuid": "a02ebaeb-e179-44da-b8e4-870dbaa1ff24", "comment": "Malware payload", "value": "58d29853a267dcc2b72d68e80d8c36110649dd542bf81bb21203434c8bf5ed5060c9aa192d34a5223fbada5833d33f71", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030940, "uuid": "477b6666-1339-47fa-a907-3200e6ec6363", "value": "T1E02432FD9A1A1A5F401A0F28E50D43146CECDD6BD3EA91F1DF0F4DB6AA1981908F1E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030940, "uuid": "dd06c9b6-61ae-4dbb-92c7-a6d5638f6158", "value": "6144:YGHRIFdf7S9B/ynsqe+nlNVVfRkmiwBnSLgH:9Q7FsV+njDf2DwBnEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030940, "uuid": "9708537c-236d-4ecf-ad04-151735892e99", "value": 212312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030940, "uuid": "3a42ff4a-d613-478d-8c01-b292900a87e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030940, "uuid": "e5689bec-6819-472b-bfc1-c7cfcfcab0c3", "value": "PR.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b3b9d3-2997-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661996753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996753, "uuid": "416346d6-d2b0-4f3b-a8c0-172515d93bb0", "comment": "Malware payload (Smoke Loader)", "value": "48915502980590530382035fd1ca194f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996753, "uuid": "45465dea-e9b0-4b97-90a7-4ff3cf9cdb61", "comment": "Malware payload (Smoke Loader)", "value": "90bb401ac70e2a8037d0b3994cb80c0c69150c31e4db40dc19bf6703dc8ceee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996753, "uuid": "7fc5ead2-676b-4703-8938-99f7fddba3f8", "comment": "Malware payload (Smoke Loader)", "value": "86780b4a4c6b4b4ac745067cd15cdb2b805e7039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996753, "uuid": "b1243b8b-5327-444c-8b71-792446c7a665", "comment": "Malware payload (Smoke Loader)", "value": "bd42137f2adb2a458e28ee6b08d5f5d168fb7d1c65ec402bec82404e9062ea98aa215025a6a682826f5ee8f9463a89fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996753, "uuid": "a873dda2-fe48-456d-bc6f-47beba6b88c3", "value": "T19454E126F682C0B3C51611705474DFC56ABF9431E6E418573B6C2A2F9FA02E2BA7734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996753, "uuid": "a7a1ba4c-fd05-4fea-afc3-6f44aed3fecd", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996753, "uuid": "f252ab2a-1d3e-4c08-9744-fed3723dfa15", "value": "3072:sXkMtYCkE0LMwW/PcV2XhudujnbnmFXXn5VNbxIkWj:oULMtcOSumFXXn5DbWkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661996753, "uuid": "56ac56bc-6d01-4a39-b95f-2e7f16f618fb", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661996753, "uuid": "128c146c-fe2e-47ab-ab12-fc4b68d01d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996753, "uuid": "77ab1018-254c-4c9e-ab1d-da6142b32b52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904133d7-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1662018549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018549, "uuid": "3749a4e9-3a8e-4316-b6e3-f39042db8a2e", "comment": "Malware payload (MassLogger)", "value": "4e85dbb7ee02db82e5bc4e7e80e6a651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018549, "uuid": "09930891-f8ec-4e51-b48e-bb3cbda3984b", "comment": "Malware payload (MassLogger)", "value": "90be1936790b5dbe16e74ea0bdacedf3d7311c7427a3151769335bee789b9916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018549, "uuid": "3530bd66-8ed4-42c4-a0c8-12e771f5c92d", "comment": "Malware payload (MassLogger)", "value": "a591f39a808a804aa642239599fd995f3a283419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018549, "uuid": "7ebfe816-e064-4138-83a0-2c8620a19ebf", "comment": "Malware payload (MassLogger)", "value": "86e9e0e04d59a6846229d6244e0eb7a4e0893b7b799e07e57f258cbb94f2a2c259fe14b03993c282c65c0d4801d25f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018549, "uuid": "85bc211f-ee87-489d-ba5d-a135bb9685e6", "value": "T1BAB2C6D1C2548175F9B24E3509B3AE3642BF5EB6A9B5A62E355DB0767F332830032B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018549, "uuid": "0d579132-3c12-4141-9387-d45982f0d15d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018549, "uuid": "29eb7047-311e-4780-8f9b-1f94900a5a48", "value": "384:cn5wkUFE7LRM4eunOiU526JSINc+p8YlLHT5PoKVRUl:cn5wpE7LR4uOd2A1c+p8e8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018549, "uuid": "4a88c56f-7a86-4d09-94f1-d628ca79ac47", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018549, "uuid": "a5855b6f-8f63-4ab3-8771-2fda719355da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018549, "uuid": "dfa6e885-c8f8-4744-b4ee-640a8e892bbf", "value": "SWIFT_IMG_20220901_00078666587900.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b5ae81-29fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662039463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039463, "uuid": "bc7acb08-c51c-4710-b1e4-195783d7bde5", "comment": "Malware payload (Formbook)", "value": "af00f5b88ef7f7bae0b0d6a4c3161b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039463, "uuid": "c8804ded-d80e-4159-aca8-744a2c072783", "comment": "Malware payload (Formbook)", "value": "90d4d8f68b8e94514add55bedfb36e7bbe3bcc1781d6e00b0bc3bfaabe1d9301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039463, "uuid": "589142cc-a596-4cdf-9e6b-d5fe3d8e3872", "comment": "Malware payload (Formbook)", "value": "e818a6c9f22656fe51a7115fb74ec5cf120e32a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039463, "uuid": "ee9a8e41-ae48-45c5-a7f2-1aedeadd660d", "comment": "Malware payload (Formbook)", "value": "f7122202396766960bf5e38c6bf1da83a4396fa1c02e35390eeb26ed469ceaff9c0ffadb95298f371aade1c58051895a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039463, "uuid": "e3e8cf11-8df8-4489-bdb0-98a24c3f317c", "value": "T13A157B98315075DEC857C8368998EF64AA102CE7C70FD203A057F6AC9A3DA96DE141FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039463, "uuid": "ab837849-087c-44ca-b959-09ebfe399336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039463, "uuid": "c37c9a38-c76c-4f7e-9bf7-db1c5c5b8da9", "value": "12288:rt7BEEHslgDaa6nbBwBbMtCcUPqnpUTT2kM5v24SMbPLeEFu0V/DSIe/Lmy0XWTe:r4CYbB+wwcnpU321ZSM3Zw0VOroi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039463, "uuid": "4f1a9f51-5143-4543-9f00-32d29b2264f1", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039463, "uuid": "ffdbbe61-28a5-4fa9-b818-aa653ae834b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039463, "uuid": "d1af4b9b-77b0-4a1e-9628-74e7f5ad8c2a", "value": "artwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e702a7f-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031029, "uuid": "a978fd82-854f-45ac-a973-630daa9bc5e0", "comment": "Malware payload", "value": "b65e5715d679d1f3c148f9200da4ed00", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031029, "uuid": "8c666754-59df-4ce9-978a-b96cc0c343e9", "comment": "Malware payload", "value": "90dee596f0e876a6e4337f9e82080e7fd029096011dc7b40b41706cae9e06853", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031029, "uuid": "17547a7b-8e1f-4313-9baf-5988a9796180", "comment": "Malware payload", "value": "12f3a4ecd3b75b73e3329f2b2d37ad29fa95abf6", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031029, "uuid": "552940e8-88c2-4839-aa5c-5e2717a3ea7d", "comment": "Malware payload", "value": "fe2316e3f67ed5a703a4a34be94c399aab74548148d8856e92f9211b3288c67e6e9de20835f8f85d2f9f5d0d470e6f35", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031029, "uuid": "d9693c03-4fb2-411e-a2b5-3b25ca8abf6f", "value": "T1B242073B6443FEE46FBD2E4098043D911D9CBA278384966DFFC505A56CEA014EF17CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031029, "uuid": "2adb0506-9482-4347-9d83-ac91e791b9b0", "value": "192:IppGQhGCHAUnExADZaumd3s2sFMyj5ZrWxUmCnSZu+f:9UsADsjsFjjXKJCSZu+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031029, "uuid": "0c66bfe8-b16b-449b-bb74-2bb253c559be", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031029, "uuid": "b8d0743b-23d7-48e6-89b0-819a752fcb7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031029, "uuid": "607ac3da-9db8-4eec-a892-b9ce11d3860d", "value": "flechas10DLL.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e675a9-2994-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1661995425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995425, "uuid": "2d7c6368-171c-475b-b60f-17b90ab8c429", "comment": "Malware payload (RecordBreaker)", "value": "e216ba0c1e89509112ed4a68272a0340", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995425, "uuid": "6da0a495-100f-4c1b-ad4f-608214d37ae7", "comment": "Malware payload (RecordBreaker)", "value": "91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995425, "uuid": "13f77689-5aa3-4a8d-9ceb-596e9d637826", "comment": "Malware payload (RecordBreaker)", "value": "93103b00195d411c9b4b926c68945b0b665b27b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995425, "uuid": "e83f922c-6684-4860-b68f-cc95d8e9ddd2", "comment": "Malware payload (RecordBreaker)", "value": "3129804f49877cd247fcee022438a3bf8f987e616d80cbecab6dc952033c05560388778f68df4b22d762e7f5b9c6edc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995425, "uuid": "34b8321c-7333-4ab6-b3f0-2eb020b48297", "value": "T15254E01576C3C8B1D0A311705835C7A19ABFE8311B78119F37A82B2D1FB1EE09EB6796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995425, "uuid": "c5a9abfc-6547-4996-ab2c-73923f81c3b2", "value": "62e5e433525a836ab07f79f0ab9b6078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995425, "uuid": "a7b44ec9-da1f-4836-b844-646848b9941f", "value": "3072:3jX5+PCPW8UmkjHeZQSjLeRn77sA+9RHoY4w0:LaCPomypKi1U9RHoYx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995425, "uuid": "93aa27e4-bbf3-4602-9145-c7a8e27e453d", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995425, "uuid": "834bb803-f406-4908-a154-eaeeb08ccead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995425, "uuid": "a47dec98-b1d4-40c8-9df7-4d060433bc57", "value": "e216ba0c1e89509112ed4a68272a0340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df89604-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014626, "uuid": "8261de52-8e57-4393-bc71-b08f3ddebcdf", "comment": "Malware payload (Gafgyt)", "value": "c010570c632e23af78ae88efa9674124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014626, "uuid": "da7b8c96-390d-4029-9277-b8045252a9d1", "comment": "Malware payload (Gafgyt)", "value": "91d063758f2562333ba8fcebdd994e9c89c72101c8e87d0cacec9f24483917ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014626, "uuid": "7c541409-34f7-40a9-9ca2-cb8fe43811ad", "comment": "Malware payload (Gafgyt)", "value": "aab7e08d3172ba8e14c4e08f213300424eeb047f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014626, "uuid": "7ced8141-8f4f-4c79-bd5d-4676dbfc1e1c", "comment": "Malware payload (Gafgyt)", "value": "97d558a715d093fcc52fe238fae4ebf30a05cca3022aece0ed9bcbb706567a805559d70396e99a9af0580d48c35a6284", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014626, "uuid": "65fca4ad-713d-4b94-baa4-e4af9a742f79", "value": "T1A8931941F9418B27C2D237BAE78F435D37366A64A7D733116A356EB42BC27D82E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014626, "uuid": "27f0a166-498a-452f-894a-a215cdb20503", "value": "1536:jBkF9VQPAGZXz+MfgcqVq1ifTPTxHOJXqPHsCE7XumREqQ4b/X7XSee:GQFXzFT16T6qPHpmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014626, "uuid": "decbef66-64a9-4799-8878-f43602051092", "value": 92441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014626, "uuid": "065aa876-4d18-450f-a7db-734e5aef773f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014626, "uuid": "68be66e7-250f-4122-bdb1-d3ff492bdf71", "value": "c010570c632e23af78ae88efa9674124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4090ccbf-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662036884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036884, "uuid": "3cbc3c87-2e24-429b-93f3-86809f719121", "comment": "Malware payload (ModiLoader)", "value": "14e359f63331ff5a15afa279017c124f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036884, "uuid": "2a666864-62d1-4e52-929f-22a2c404eac2", "comment": "Malware payload (ModiLoader)", "value": "92130611fcb417ac3b785996a508f33b769d6dd092f8972ea7bdafeaccd70b9a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036884, "uuid": "38f55274-aa3a-45fb-a807-be19c8a2b748", "comment": "Malware payload (ModiLoader)", "value": "ab7056508b1fcdccd6728d66b1f3ec1e2efdae61", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036884, "uuid": "9652afb4-f00a-4a43-879f-216b99cbdfae", "comment": "Malware payload (ModiLoader)", "value": "5456ad8cef03d2d76194907acb61bea123319dd3e674d059c145f1dcdb36be95148a4a5a7e1ae117713e9b017b73afe3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036884, "uuid": "a3f8195d-466b-43bc-9521-31d55e6bfce6", "value": "T15B84237C7C97D6B08D1B08E9A0D566D8AD513693F95CC23A02740E8A8CE4EE1FCE5C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036884, "uuid": "4164ddb9-ca41-4ea8-9c53-fa5b32deb867", "value": "6144:b9BfKAW0eL/Z9DoWS5moOOQu97C5ZpQF3zdORXBUBbkC7/P9S+DeZ:bf60eL/Z+WS5FOOpIZKF3I9BhC7/nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036884, "uuid": "33c03555-4585-4ca0-aa05-7aa06f42ebb7", "value": 405211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036884, "uuid": "68dfa5c8-f922-457c-9368-d177efe2452c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036884, "uuid": "2cc421a1-33e6-4410-bb66-409ca6736199", "value": "Drawing.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa3ec65-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1661999436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999436, "uuid": "338b92ff-49b9-4414-b7fc-d42625229100", "comment": "Malware payload", "value": "c9e7c700f8baaef92abccc68f5e5db5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999436, "uuid": "930453fc-b3dc-43be-b3d0-6f673b47e8c0", "comment": "Malware payload", "value": "92167584427794148d3fd13262825da5a30a8fef5f5a275451c21d8af8b78cd7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999436, "uuid": "f9393f83-cd75-41b8-9be7-8b889a45d96f", "comment": "Malware payload", "value": "7c29649c49aa0f74ea6438b5a2723b01c480e8f0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999436, "uuid": "faec58f1-a5ea-4801-b92d-073e87ab2724", "comment": "Malware payload", "value": "2cfda49f8d44d28318fde2c87e8ce60401b0a81d01b904fbb15d919b45d5e2711362434c9c8dee8cf33d2c03e6e441a8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999436, "uuid": "8903d5a4-c045-4554-880e-eee799f52b23", "value": "T18F252360DFCC2F9FDE284379940BDB1D21C1DEB0A06562AB93D8749F2579AA094C7C26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999436, "uuid": "f794a3a5-ed6e-44c8-a23c-9cb988e23e61", "value": "24576:cwLR/GnhYzWHkCmdHn1F551gP23Rg+bb/qaVfYEiO:chhlIH4R+XCTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999436, "uuid": "3e00ef37-c324-4c86-81af-9670f519027e", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999436, "uuid": "8afce7d1-5d60-4c9d-b24d-e70c197948a9", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999436, "uuid": "3665f84e-a922-46e7-a0ca-70f349cfe442", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.14078.21805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d863060-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662036933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036933, "uuid": "9b49711b-453b-468e-85ee-67d59e8cc34f", "comment": "Malware payload (Loki)", "value": "4ef48a879e2e8d183dfcac89f73b5001", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036933, "uuid": "4c51c5c4-9bcc-4516-a47c-56e8bbfaaeaf", "comment": "Malware payload (Loki)", "value": "927522bd625d55b0b2f858696d01c77c834e2f2bcdfa741f003348c2a6324d06", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036933, "uuid": "eaad23ba-963a-43f6-b2bc-9d1a67bb462c", "comment": "Malware payload (Loki)", "value": "812d055740bb9ec9719a5fafe2f0ecdfaf46fa62", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036933, "uuid": "8efdcc18-a410-45da-9206-0a0a28bc0771", "comment": "Malware payload (Loki)", "value": "b5b00ec3e12ec6054bc35de57c4397248d6a8190e58ef27767bb708abb5e616d0aa472b255bd1911fb390528cf5c47a4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036933, "uuid": "007b3662-1c14-42e7-a075-5230037dad3a", "value": "T1A7227C7CE147FC0AD121083CF05682F5E71A82576A22B92F2059B2EC07A1BC347DE9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036933, "uuid": "08a5b412-dda2-4fff-adc6-0163c8c8357a", "value": "192:ScIMmtPf+CUG/bA3/w2ODOrdlJFmQDZ7rhhap30i7V:SPXumAODOjJFmIZfhMFPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036933, "uuid": "429d4c46-c971-43cc-a73e-f404b51e3967", "value": 10349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036933, "uuid": "b3ddc200-f6cf-4183-a526-9f6c41c24b2f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036933, "uuid": "1a5cfd7c-491d-47e6-965b-1c822d6fe168", "value": "Universiti Malaya_1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08932a01-2993-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1661994699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994699, "uuid": "667135af-a4ff-4e2a-8c68-4c0601b7a236", "comment": "Malware payload (Mirai)", "value": "589e8e828113dcded6f46a4080fdd4e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994699, "uuid": "8b1facab-d5c9-45dc-bc77-4103b78c7332", "comment": "Malware payload (Mirai)", "value": "92adeb7f1ddadad51932e88505e3f0e5f2d9eb94273aab09498f6d30daba840c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994699, "uuid": "fe1c9268-5d89-45ba-929c-8ab1790f88bf", "comment": "Malware payload (Mirai)", "value": "36bfdf2a13d8ffeb6f63ded474b52d8c2b896d6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994699, "uuid": "ea9807e7-381d-4ae9-a236-502a28e7db6a", "comment": "Malware payload (Mirai)", "value": "37a931593775e30e42b13214fba6465cd4865d83ed6fba852fe9d7261f587b46717d3695c255dfdc18b1c56edf2c3e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994699, "uuid": "1b5f9f1a-a38a-481a-96ea-4442194701de", "value": "T1F9B3185AF981AB11D4D926BEFA0E118D331357BDE3EE7112DD204B2137CAA6B0E77412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994699, "uuid": "7fd15ccf-f63a-4776-8c5e-1397d3df7b95", "value": "3072:OigKi2KjKWKFKhjkqU7TdPXf8caghgtTD6WBlWOAE3vY:BoWNQk9PXEcaghgtTDJBEE3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661994699, "uuid": "8178a740-e4df-4679-96b7-c159dd24471c", "value": 108136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661994699, "uuid": "a5af86f8-b1dd-4dcb-bd4e-59f3528cec36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994699, "uuid": "90771a85-9d5e-4b9f-a450-c8f78005001d", "value": "589e8e828113dcded6f46a4080fdd4e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66884e33-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032223, "uuid": "82b8908c-2992-41e4-bc3f-87ea6fc6fe29", "comment": "Malware payload (Mirai)", "value": "74ac7a891249458f17a0fe78690f8b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032223, "uuid": "2174b490-c661-4561-94ef-152bff1855d0", "comment": "Malware payload (Mirai)", "value": "932c3c8ea355e0c014c90af4c130e303a3c0ad182a68e2e46eb1a9a0b90a24b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032223, "uuid": "c8866803-4dc3-4bc0-92b4-7c6fccc363eb", "comment": "Malware payload (Mirai)", "value": "80b9d8544bd52ab106b601e321c8fc8c891bf7da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032223, "uuid": "08ddd96b-8bc9-4574-a300-650e3edba271", "comment": "Malware payload (Mirai)", "value": "5170bd50009c3b0dc5ea2d8378c79fce505ca99adbf5dc708e182b9bf7eb2729bf343f9346649479da996e357d47b3a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032223, "uuid": "86efe660-d5b3-400d-83c5-c2c8399df2d2", "value": "T12A232AC4B243D9F9ED4601742036EB369EF7F0F6A25DE987C3A495336C52602E906ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032223, "uuid": "66be14e1-8205-4f2a-bf9a-a157c21083f6", "value": "1536:8cieNV4h+60NN3K9D4zgoyBRi9YLYa+IxK0GJdnJnu:OkV6/0NN3K94gbviKLf+IgnJdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032223, "uuid": "0e93b77e-bcbb-415a-9d5f-9fe094e3fc7c", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032223, "uuid": "0f24cf7d-144e-42a0-9ee7-8b2c4b96afe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032223, "uuid": "b857e151-a7e3-4dc6-b000-638042f58666", "value": "74ac7a891249458f17a0fe78690f8b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8901bec-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662022133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022133, "uuid": "94295f9c-35e2-4cc6-a6c2-7660a4920255", "comment": "Malware payload (RemcosRAT)", "value": "cd9c60adbeb491a135a51b1652288a1b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022133, "uuid": "71b070a0-8d99-45e3-9f4b-555c491c1f14", "comment": "Malware payload (RemcosRAT)", "value": "934397780de1890617053c704e2cee81f290e2f865a650f30874737800797577", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022133, "uuid": "48ea3182-56ca-4303-b088-d5735b286b23", "comment": "Malware payload (RemcosRAT)", "value": "02e393e82c44541a160ac0198040b36f39ac54aa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022133, "uuid": "33613af6-3f10-4a34-855c-66a0372c3c0c", "comment": "Malware payload (RemcosRAT)", "value": "8bae5442fe23824b181331aed29faa0efa4780965f51db25e5af153ac3137c56c896c23ff33d0183ef89e7c11ecd3364", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022133, "uuid": "c86fc789-d671-4ad8-8222-3d2b9bbe8b93", "value": "T1C9C19FE486433E1313E2407DB0CC020D9D8F4E18E77562324291E9B10DD68BAD9FB45F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022133, "uuid": "05120e9e-8430-470b-9fb1-736c40bc2b13", "value": "96:m+jxHq/kTLGllojeV8f0LU8LHv0cj+JEar113f7O5oqULT1VS0cdS8D:m+j4UylTuAU8zvPj+Jjr7krSPS0cdSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022133, "uuid": "c3d4de0f-39ea-4fb1-bc14-8d2336492fed", "value": 5651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022133, "uuid": "fefaa38d-28d5-473d-a4a8-aef46793b5d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022133, "uuid": "5ac89751-a3d9-4dd3-a801-b705f16fcd11", "value": "ORDER No. 2210748_10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b8681c-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030955, "uuid": "3efb91b8-c39f-4742-816a-d5fba901193d", "comment": "Malware payload", "value": "3a47c5ea27e77d9c8c2ff0b4058609d9", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030955, "uuid": "e12dc9c0-8fd4-468e-a43e-423df30f7041", "comment": "Malware payload", "value": "93a59963bc2aae77665e4fb532cf9128ac7a04954b44bfc05484397f5de3c8ce", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030955, "uuid": "5ae40e9a-45cc-4d55-b902-c8ddad7d2834", "comment": "Malware payload", "value": "19a004e293403f3418cf12685255f1279e3ffcc0", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030955, "uuid": "46602be4-60c4-4ec1-81d9-4f601db16ada", "comment": "Malware payload", "value": "2297638ea75b116a4a2b7c346e179e84736897e8e537dc7a0f4ce98510e8eb32124f19243b40a1d7712cb11ba0923920", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030955, "uuid": "2673e467-efc2-420d-8e04-eb6a2acf2f82", "value": "T10FC353F99A171A9F401A0E28E50D43146DECDD6BE3EAD1F1DF0F4DB6AE1981408B1E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030955, "uuid": "41619a38-ba4b-495c-a725-25acb0fc7f93", "value": "3072:QaGJwGaZukWFQC88X/FZDEznVQ2jomrMZ2cZbUXyRjBjJst8EBMV+v8Yk:L3ZvWyd8tEznrMZ2cFUiVBjGZ8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030955, "uuid": "10d83cfd-8b35-4882-a057-0ed5cbf64070", "value": 123564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030955, "uuid": "3399a9a7-433c-40b0-9d85-d8c8d5b0ae21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030955, "uuid": "95739cdf-a714-4a52-ab56-c2d451f81283", "value": "ARH3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddc2364-29bf-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662013848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013848, "uuid": "6278358a-d106-4d15-8aef-1806e0c4595c", "comment": "Malware payload (RemcosRAT)", "value": "21f008218ab10140977c4f75ca44e6d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013848, "uuid": "6a14b0ad-b2fc-459e-98a6-69665bf471cc", "comment": "Malware payload (RemcosRAT)", "value": "94798c0478f2ecebff0e05360bb8c6f4646fa267811d15e9d534c7067225df97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013848, "uuid": "1ae87589-f951-4e07-b5b2-6deb95e4701d", "comment": "Malware payload (RemcosRAT)", "value": "82c64ed1ef627c8039c06b5b9ffd5108ffd3cc8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013848, "uuid": "db3e9feb-f4dd-44ee-b50b-333e6c3dc02b", "comment": "Malware payload (RemcosRAT)", "value": "befe3e362f8147d11ee4ef91062765ceb0d3b9774aab15856d431e9fcfe90cc70939b374ba063b6583ad5276b71aee53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013848, "uuid": "d4da6ccb-b742-4cf4-b27e-a29ef09fd7aa", "value": "T11465FADDB20188B8FC0ED67558545C0296533EEDA744F84E2BAFF0E307BB2615C89E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013848, "uuid": "5b7e3dad-a898-41b6-bae6-259c3fe8abcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013848, "uuid": "e980befa-fe7c-4ba9-9eb4-5b7dcd0cadc0", "value": "12288:WJOtwYcJ8RA1j7FsmfNXgT3ZGuSFvzckGxNSJQellllrdXjdXjdXjdXjdXnvmicc:TcbjfVgjstzcPNSJQV/xBKSQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013848, "uuid": "a475d462-01ec-47df-971c-07b7aba3a072", "value": 1480704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013848, "uuid": "232938d7-f74a-4f1a-b1f0-e6f4bbabc801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013848, "uuid": "7e599b6c-e388-442d-ab55-14d68171a08b", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.9827.9718.5885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a362e04-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662046430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046430, "uuid": "21324190-86ba-4113-801f-1f562b05b481", "comment": "Malware payload (Mirai)", "value": "6d7c78a8ab34902fe1b42839918e7760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046430, "uuid": "35dd8977-932d-4d0a-ad35-f7616fb64a02", "comment": "Malware payload (Mirai)", "value": "94a851f9ccea11e82077fbabfddc7fcd431393c49f46ffc5dadfab5e4b710c70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046430, "uuid": "e804c02e-b7a8-4771-a6b5-25f05722d7cd", "comment": "Malware payload (Mirai)", "value": "abb67e51ccfee36cf36d2e3a48da98575f604f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046430, "uuid": "d593fda4-97e8-49b0-b33d-29fbcc92707e", "comment": "Malware payload (Mirai)", "value": "9ab1988907110c4150d769222a2f0ae29b745fbf1513962ec7e58ae61501dffbf0cdaa329090af3e7ff2fede2dfee496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046430, "uuid": "7e95a798-bbde-401a-9de5-741b41d5cae2", "value": "T1CBA2D1BF98964997DDAAE13B011D04DA00BB2C5453B782C23F6575B3CD778E8F836680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046430, "uuid": "39d7443c-d54a-4139-bc40-e5e388f273aa", "value": "384:MVcDqRfKUWFH39z+/49fTVQrGLruI8qB+eANnlBQpMr/q++v1RpC:EMkKJFH39COVQey7qsZoMTGpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046430, "uuid": "d3d5cbc9-27d5-499a-8a39-ffbbaff15234", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046430, "uuid": "42bd17a4-57fc-49d5-a9f5-4bcbaed7a5b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046430, "uuid": "9dd1627c-917c-4257-82b3-6bd15a3f4d86", "value": "6d7c78a8ab34902fe1b42839918e7760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8d22a6-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022169, "uuid": "1fe7e269-bf9e-4668-8d20-4196f82ffabf", "comment": "Malware payload (AgentTesla)", "value": "4fdf3bcef29d971538db6123aa2b790a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022169, "uuid": "0c0b682b-04ed-42a8-ba9d-1149d60b910a", "comment": "Malware payload (AgentTesla)", "value": "954e24d36e9e6949723a6c1b8f1274c9eb3efd50eb6328da9b9389d170382dfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022169, "uuid": "385aaaf4-37cc-4c74-b561-0496c754f8a0", "comment": "Malware payload (AgentTesla)", "value": "3502d139f45a95dc11a31bc9436b375b0838a5ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022169, "uuid": "c84d087b-5372-4c6d-8c4e-2e6f14536845", "comment": "Malware payload (AgentTesla)", "value": "f894f67a9e447b7b8032d3606fbbe50a102c48ffabfe401ccb1262605ef7c171737144c84721456e51143233f0e22b74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022169, "uuid": "d061b054-1588-49e7-995a-4a5117ce5ba5", "value": "T1944539255BB00522E56407B90BF67362BBB0F89135B40663721E632E9FAD9868F70CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022169, "uuid": "ddb83aeb-e1c8-4b9a-932f-4e98de3bd488", "value": "192:g8fuApuu8r8SKd9LOl8E0MSaSWg8G1nL/+EW49/N6d:YA4u8r8x/LOl8PHazg8GRxW49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022169, "uuid": "29f7f0f4-6970-4d08-8e43-abc9d174252d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022169, "uuid": "c5937065-b323-4564-bac4-f62b2f130da9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022169, "uuid": "4a2b3696-a0a8-4785-ba8f-6024bd395a11", "value": "Technisches Zeichnen.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb114c2-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031083, "uuid": "21c82037-b018-452f-82bb-c12881181cd3", "comment": "Malware payload", "value": "0664f6990e21a7cb0e8c046e3350622c", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031083, "uuid": "8eb0a0b6-c4ff-4324-b870-85a8d9372388", "comment": "Malware payload", "value": "95b72e00c8f130a64255b1adadaa2eaf7c71a706b50094e1650635587787b5bb", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031083, "uuid": "c1c097e8-3452-4d18-99b7-a05382077142", "comment": "Malware payload", "value": "c250cbfe287e5704536e2d3cc4c2fd599b3abf12", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031083, "uuid": "a2c58d15-9a89-4419-a58f-75fdc1468a24", "comment": "Malware payload", "value": "5103d0c38eab5419256aa12d3e7940991dbcd5c4e36113e2826d18f8f7a69e1755530aab36564bf86f45bdb96cbaf956", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031083, "uuid": "5d29e773-1743-423a-a0f4-519b67db2fcb", "value": "T1CCD24A732F93FCE02F7D1C47E14675810C8E3E5B83684C99FE9909A668A5311DF6E828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031083, "uuid": "50ea007f-9b89-4ad2-8442-8f7be4b08f0d", "value": "384:yXn9VSy+O1YuY/68GjxrBRBiG4UIGCXD+l1mLYMZvOxDDLhQx/QPASet:QzX5uX/KjxrPBv4UCX6QZvO9xIQPAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031083, "uuid": "43935980-455f-4427-adc8-1be9860ea194", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031083, "uuid": "4f04c4af-e932-49b6-a33a-77ad9b4348bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031083, "uuid": "5e9b77ac-8bc1-4b4f-b6ae-0eaf216de45c", "value": "Downloader F3 .txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17cce76-29cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1662020726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020726, "uuid": "59d40bda-8508-44f1-8cb8-29f65d4ea255", "comment": "Malware payload (OskiStealer)", "value": "288e1e9a0d79b265aaf409a1c39b67dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020726, "uuid": "7abe660b-924b-4230-8dbe-4122c52bd380", "comment": "Malware payload (OskiStealer)", "value": "95bb38f864cb2a18cc598ce238ef85dc5eae8de91c0f2e58c175460fc8ebe94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020726, "uuid": "13272ae8-66de-4368-a93a-1d5145346289", "comment": "Malware payload (OskiStealer)", "value": "daccc93545a168dcb69dd8b18ab01ca1f4a68cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020726, "uuid": "66547614-de90-496f-b2ea-92d7fc8c1367", "comment": "Malware payload (OskiStealer)", "value": "65430fcc174ea022a14da5e29d3ebd7992826582364770975e735cd1a908c740e7a37ff94f5412f295fba7d0fb969421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020726, "uuid": "3aec747d-804d-447a-bdb2-b137dc31636b", "value": "T1C125128A9684C3B2F4170F7011A1F325C6BEBE159671C6D96FCFF2EC49A4B029617A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020726, "uuid": "77c0187b-3bf5-478f-8a0b-18fbb3f17604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020726, "uuid": "a3402b59-6a7f-4e7b-99ad-bb95555542b3", "value": "24576:jZ5hSCAlqmCXyvuDdGBGwZcZoyMgvN6QAJXY+mzo3bv:d5hStqmSycYGayMgl6QUlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020726, "uuid": "171ccded-9bb6-45d9-9466-1efd4fc98fca", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020726, "uuid": "1d378231-afbf-4375-b69e-324a6d37c3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020726, "uuid": "7dbb7b7c-2f87-4374-8fb8-cd28d3ae943c", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8346d3-2a02-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662042597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042597, "uuid": "a0c04914-b5a6-4fc2-bde6-0e64ce4be6ac", "comment": "Malware payload (Gozi)", "value": "dd5d375643c38d60ffb105471c77a2ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042597, "uuid": "8071e29f-b434-4065-879b-83b35de5cb4b", "comment": "Malware payload (Gozi)", "value": "960c675dbf990fd846ac17ac7a279df8cea22e1c0a9a6ffb06910a32873edcb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042597, "uuid": "31e13bb8-5fc9-4ae7-b616-a69c27ddf4ae", "comment": "Malware payload (Gozi)", "value": "19f1e2b0cd4f0b7318726a05098d4c7bb28bb68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042597, "uuid": "9bf21a38-1f63-48e7-90cb-b00b2a0df5d7", "comment": "Malware payload (Gozi)", "value": "3b35a5381def49a31cba27899e314b7689d05f0fbe6abc09fd6bd2223e958396e286bb0de4dffefd4be1ee8fbab32a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042597, "uuid": "8a521eba-1743-44c6-b510-c4aa528b51ef", "value": "T10FA48C97F3A940BDD0AFC675CA52961BEBB1780A1234E34B42E0DBB61F13B71661E314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042597, "uuid": "4d7c2c9b-fa7f-4210-8c1a-b0c038e69b9a", "value": "12288:mLs5pGwFbmeTVmgmk76o3UP7TkM5LR0V7AFGI:mQ5Ew5meTzmMUPfkNpAFGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042597, "uuid": "0a547a6b-576f-44ca-9b5b-adb10d28a95c", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042597, "uuid": "fa39972d-e132-4cb4-9f4d-2f31f5158131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042597, "uuid": "eee23385-b976-4b89-b08a-2f3e8e08106f", "value": "fcf0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4fac34-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024393, "uuid": "304a336a-3fa3-4bbb-8dde-c28ea4cc3883", "comment": "Malware payload (SnakeKeylogger)", "value": "e69161d9fa603d8c8fb7b79276bbb15b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024393, "uuid": "c473dab5-848c-4875-8d85-8238ce9ddc86", "comment": "Malware payload (SnakeKeylogger)", "value": "96abaa1d52d4360e9a578e7765902398e6267073f5a7b472fa0fa02496f5135d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024393, "uuid": "642bce16-59ff-4df3-b3d7-d55a5a0a39bc", "comment": "Malware payload (SnakeKeylogger)", "value": "81639ab25039990710143837b3710abcaa0eba90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024393, "uuid": "3e0c7f13-5881-4f05-b706-4264676564b8", "comment": "Malware payload (SnakeKeylogger)", "value": "0206aac79cd98fc81c221be64f25f06687f2289658a362e42ba5994b89b0073714120975da06d7f832a0725acd646820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024393, "uuid": "17fd73df-535c-4fac-92d8-ec5cf0596ce7", "value": "T172440210EB5DB731DE7833F11678950503E27AC57160DA89DF8AB3C612E7B112E6AE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024393, "uuid": "d5eae23c-1d99-457a-bb32-6e174b5bf757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024393, "uuid": "6f723b91-92ed-498f-ac2e-f621a2517a53", "value": "6144:/DBkuri/tJalHTua3VtLlzmSChRIV4nzdlvr4nGFub:/1kwMAcEwhRWQAnGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024393, "uuid": "210ba257-1a0e-495b-ba05-d2c0d4701b0b", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024393, "uuid": "159f873d-643d-4ac4-aeef-1b113f182ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024393, "uuid": "d03e20fa-1f35-4d5b-b544-6547eb874b69", "value": "pakistan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb7f32e-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662027293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027293, "uuid": "e87742eb-4f1a-43ea-89ef-fb6c18e43d38", "comment": "Malware payload", "value": "bd31199e3448cfec7138b22b93207c8d", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027293, "uuid": "ea50abc3-735f-4c09-b1ee-866e7991271d", "comment": "Malware payload", "value": "975308639a0f6a35f5089b997654d8d10b9890e975145cb83dcd08cc2339a487", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027293, "uuid": "5b65216b-c792-4da1-9b3c-bc3c01af07ba", "comment": "Malware payload", "value": "190b8f86011a08bc8d9662b29bedd3c2203cecf8", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027293, "uuid": "794ebee2-5b8f-4401-9e04-7dd3e637f8ce", "comment": "Malware payload", "value": "47f58bcf59fe150984eaf11908209cdbba56948aca946a145146d0107558fd26c91ed2fd78f9a3bf6fb18566583a6bbf", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027293, "uuid": "4405151f-428d-43ad-b1a9-6900c3c4c68c", "value": "T1BBA61182D07A64CD5A8AD91F91BE1F9C470B7DDE2F3DD4090666B89530F36C38E97222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027293, "uuid": "8bd1bdb1-b4ed-48b3-98a2-8b060a0eb3e8", "value": "196608:ws5BcYwg+/mDDCuHf3AGGWzBn1m+uAc6kgRBR1fnelBc/oll+twFIb:ws5BpFM+5pBrm+Rc6fbfnely/Yl+2Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027293, "uuid": "9eb768f3-fdf4-4c4f-a025-ea036df832a9", "value": 9779179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027293, "uuid": "bd8856b7-363f-43ec-82ad-a12ad9ac74c0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027293, "uuid": "70009f75-bb82-4ef3-aa75-05613ed88503", "value": "new27b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d1286b-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662036886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036886, "uuid": "56d838c7-2d02-40fc-aff6-f4c21178413e", "comment": "Malware payload (AgentTesla)", "value": "96012328fe57a6b5d20ed8cec4000479", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036886, "uuid": "99b25557-a8cc-47b7-a5a9-c37648bbf7e1", "comment": "Malware payload (AgentTesla)", "value": "97efe69bce82e3ae44323d4e6eace3ef4c5e8b041f4d067ffe3e17eae321d264", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036886, "uuid": "03e8fc98-7cde-40a1-a212-404d4380d8b0", "comment": "Malware payload (AgentTesla)", "value": "745216d0d116c06e96112d24e755ce409250209f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036886, "uuid": "70060907-e68d-49a1-8223-73627736ab22", "comment": "Malware payload (AgentTesla)", "value": "accea65e092475a01966384269bdade9f0acfe6960da43e127698517facc71f9586f86418a9123cbae20b59daddd1106", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036886, "uuid": "021aa41a-e925-44d0-9e65-6d2a35ad4d00", "value": "T1991523DC6C3CB518B9F67E918A45B37D2C6213792F2F28318933855AE6BBE311260761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036886, "uuid": "bda92d87-1bdf-4ab5-9a65-3366c5f6866b", "value": "24576:6gK4bWkACncGCADdcUnOVHNo+NllkPgob:PAUcGjDdDnUNkPgob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036886, "uuid": "d13d1fe7-e01b-4dcc-93ee-7a6234229e14", "value": 915451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036886, "uuid": "ebefcd60-e69d-4f6c-b50a-c8cb6e036ce7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036886, "uuid": "4d4fa522-f5ba-406a-a032-0af1798e15e8", "value": "Order-E%50 procurement_AHA INT B6-Folic DOC_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d9746d-2a46-11ed-93bb-42010a9c0043", "comment": "Malware payload (zgRAT)", "timestamp": 1662071763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662071763, "uuid": "6f7c3d3f-05ea-4776-87e5-a9281861f66c", "comment": "Malware payload (zgRAT)", "value": "4efd50bdda506acbd58a7d1d8278a586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662071763, "uuid": "7a6702a1-ef53-472d-8f6e-3e5768668da1", "comment": "Malware payload (zgRAT)", "value": "9934a76dac67d2b65192f477720b42237dac4cd5cfe9c52d9d23ed1e57b6b39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662071763, "uuid": "7cb8d395-fb5b-4343-8c51-d4ba50f5ef95", "comment": "Malware payload (zgRAT)", "value": "abc5ae1588d82e3c0da37d0ccca03700b38704b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662071763, "uuid": "31b14a23-dafb-47dd-86a4-abadee2aa4b3", "comment": "Malware payload (zgRAT)", "value": "ab5fec6ba2f6905099fadb7c843575c7e54ea82a0adeaf3138fe600c14e764646c67bb97a1c62d40c7e87a3904aa6d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662071763, "uuid": "406c3135-6af0-4f9e-a609-b58686927b87", "value": "T164B5336D5BE61F05EE4F0B3089B25A4519335EDE5EE5A3EC400CBF4B36B0BE0522652B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662071763, "uuid": "7ca4f968-4372-4c8a-b467-2b162bbdcbb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662071763, "uuid": "b4ac7e46-5fe0-46b6-9a7b-81339de090e7", "value": "49152:C6CBI51pHlLfjjLgU+cheHrEVK/MCCK7Ru5G4g5BWG1:CrIrpHlvngUnoH4IMcRJn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662071763, "uuid": "3cb55d5b-76fc-43fe-bb30-5bc92ad07f31", "value": 2318504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662071763, "uuid": "94de5ebb-5a1f-4d47-bd41-4b2e4478b5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662071763, "uuid": "776355a7-4538-4044-87a1-07dfd2f7719d", "value": "SecuriteInfo.com.Variant.Lazy.239039.17895.22952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc886e6f-2a08-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662045252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045252, "uuid": "1e4daa24-47e5-4ee6-8972-ea4acbbbe864", "comment": "Malware payload (Mirai)", "value": "128859a32c7335b39aa9e4a3d39d176a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045252, "uuid": "ba593cda-1f89-4457-b48f-6e17399acec6", "comment": "Malware payload (Mirai)", "value": "99ee10073df39489a5e8cdf8db528b031944db95186289bd12942a8c646297a0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045252, "uuid": "d6109698-c2d5-41a6-baec-024dd854f48b", "comment": "Malware payload (Mirai)", "value": "7496924c8ae18ae7ce8b600daa3212b42a27eb28", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662045252, "uuid": "2a0c2723-b7dc-4cf7-8be3-72b3e0ffcfb9", "comment": "Malware payload (Mirai)", "value": "e57f05d99e89ad514f938a2f6a9ac0db382638bf79b99da460e9d4f30f30a9f093fb433aee26c6eb90e4e3b5cf8cf55f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045252, "uuid": "56c78c52-9325-4680-82b0-c73a92afc588", "value": "T15DA2D1BEFB20C1CCF046847E2967167B456FF8964798420A9E15D0DB01C79CE9499EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045252, "uuid": "7d5ebe2c-f4be-42de-909b-4f343391d922", "value": "384:CDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbXPhiM4HhBJhpExUC03uhHB3QJmRxEcuid:CDZ5Dw7RjFjcU+O24sDj4HhrhpEguX3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662045252, "uuid": "526edf61-0dba-4b96-b8c9-979ce929847a", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662045252, "uuid": "6ab47f6c-96e1-4655-9b79-978a73e85189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662045252, "uuid": "9a74d0c1-88fe-4569-be69-755a2264e635", "value": "128859a32c7335b39aa9e4a3d39d176a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32515ca-2a19-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662052619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052619, "uuid": "aae5c87d-3697-4d8c-950b-fcc91a504492", "comment": "Malware payload (AgentTesla)", "value": "0d8f31aa7edeac9f17f59a2f0dca365e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052619, "uuid": "71e4a37d-a414-47ba-9256-085bb4041108", "comment": "Malware payload (AgentTesla)", "value": "99fc63bae0f484fbcdc0328e772895ceb2768268e3b935063a20b48206600ba5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052619, "uuid": "cfbb5892-9d0b-46e8-adf8-2bb600f44946", "comment": "Malware payload (AgentTesla)", "value": "7c0696e27271a3678969f58a4735aae4297222fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052619, "uuid": "ef8fe832-41ad-4374-af62-bfd81a902769", "comment": "Malware payload (AgentTesla)", "value": "41a46b644603b0c22fdbb161f8e5fec650d5461affe7c31523536cb68862a3cfd657d4b0c2d11a55d2637b91af5a22a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052619, "uuid": "0af87c69-794c-48ef-8e8d-fcdf50619c7a", "value": "T16D35122E4A895B11F4903BF442B0E25192F9AE251171CB41DDF4B3F829F8B9FED4261E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052619, "uuid": "0ed41b06-6fc5-43c8-9780-3725bc21aa88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052619, "uuid": "f37bf254-774a-471d-9416-3f84b3a57a22", "value": "24576:0Ey7Z5Rx8EfjUXY+mzo3bv946Z22vYczzZyBysBcY4lP:a5R2EmlmzMm6KcXZEBc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662052619, "uuid": "790d2cd9-e71c-498c-b7ef-c6d8553048da", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662052619, "uuid": "1271189a-b995-418d-89b2-ee6f28aca13f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052619, "uuid": "f6048d23-aa82-4476-8c06-8d9cd01c145e", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2598dbe-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022123, "uuid": "2092e209-d5f7-4448-9f52-c8c4539600d9", "comment": "Malware payload (AgentTesla)", "value": "0804268b1e4f228edf3a2b1584aaa5ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022123, "uuid": "17eee02d-5f60-4f4c-86f4-f669f8c52790", "comment": "Malware payload (AgentTesla)", "value": "9a201fa3fd9002c1ac0c0b31f2c6af9167eaeb5224df4ecfe0b9f343a7abfb0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022123, "uuid": "c5d2b79b-5bee-497c-bc3b-40701283f83a", "comment": "Malware payload (AgentTesla)", "value": "99ff25d89ef10497186d54e6b7692e4b57e9e4d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022123, "uuid": "df1e4b28-9221-413c-9973-eb739f82cdab", "comment": "Malware payload (AgentTesla)", "value": "a0c24f2bdbb33547769be5672eb607e2c7e4e4032ec3f45edcdcafb32101f69546b7806e1d0ff3f44ec9d5bb4017c202", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022123, "uuid": "531b622e-e2e1-43ce-b0f9-a9e733ab5700", "value": "T1E4A423AAF515E10C3A8B1B09D84C48F0DAF8393BED56339600565E7978CA2B7DDEDD01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022123, "uuid": "e608ee99-6640-47d9-aa9f-385e99b9dbd1", "value": "6144:8F2vJDjmCVaCGymrUb5AH9ue5mSPaGWA94mqI/jndS0HPp/Tn9D4u6O5w2cUHpqS:LxjPCUbDenrWAl7dHX4u6awyWgjwwRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022123, "uuid": "6a669026-0f90-4fb2-9043-ab6a7f489bfe", "value": 470122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022123, "uuid": "1892c4db-39d0-42fd-85e9-e4017f63d87e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022123, "uuid": "5bd7cb1f-698c-455e-b749-449b24d06e4d", "value": "DKJ~1234567-09876543345678-098765456789-.GP.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a9c1a6-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031098, "uuid": "b2fa1ec4-acfe-49f6-a3cb-aeea81c798a3", "comment": "Malware payload", "value": "002bd2f002e83fbc3617740deb3f7f54", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031098, "uuid": "996c14f0-76db-472d-bd76-cad2ae8498f3", "comment": "Malware payload", "value": "9a849b3d91f1ed4292fd3e2a87d6dc0cdb057fae3d930993bab478523185182e", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031098, "uuid": "064c34cc-067e-4fc7-8dec-6ff0268a6e41", "comment": "Malware payload", "value": "743b79d5652fbe604cc63922f5be0bc6ee4db65b", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031098, "uuid": "f6264897-1034-4bfa-961e-81a0ebe7be10", "comment": "Malware payload", "value": "54401db84c069a0cadf16f772623f3bfb0cbb890c77e655ef35223a69372c94e8dd6607bfd9072ee88acb1ae0d38dbe5", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031098, "uuid": "61c07d68-ac2d-4a45-9ff1-369c2342ea37", "value": "T1E01309B30613FECF1B260E41D40C2115EC99ECA771D8A9ACBB4848E58BD9114EDB8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031098, "uuid": "3aa07d9a-322e-4881-88ab-65c6af4c8f8d", "value": "768:kG2xcYNft++m8YFsjoYIGbmxBb2kfgnt/XpXc3Rt4:kGcf8+m8YFUIGyDKkfgt/XK3n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031098, "uuid": "259c9c91-4376-440f-b541-3a63deb62fed", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031098, "uuid": "cad0a53e-b95d-4635-b2e4-0b88040bc0e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031098, "uuid": "aa6fed06-3fad-4ffc-8f75-bb3e2f2d18d3", "value": "ny1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4807d5a-298a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661991230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991230, "uuid": "060e0b02-bc31-4d0c-9fce-41c9f5cbcc14", "comment": "Malware payload (Smoke Loader)", "value": "859d427a0c66b68457ee9e5967592bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991230, "uuid": "cd78b07b-de56-4676-83d6-c85a0c8bccc6", "comment": "Malware payload (Smoke Loader)", "value": "9a9d2c069fe63c73ef778bda836ecf6eaa67681b462b759b18020f5fdc3c646e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991230, "uuid": "caf47064-b572-462e-9723-7eb70f6d58e1", "comment": "Malware payload (Smoke Loader)", "value": "40be25620423b5319e53ceb690946375db653c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991230, "uuid": "30d7709d-90bf-4c24-827f-ab8f6b843738", "comment": "Malware payload (Smoke Loader)", "value": "81e5d29cd7383ab35884aa8e6ac656afb8669ba3cf95338df82f899476af31b5d5c003877d116a0564b8f7dac4e4480d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991230, "uuid": "844a90ed-0e7c-4c54-bc54-df2bb0b0b93b", "value": "T14854E1027542C5B2C44505F0A470CBDCABBF95F11674148F3BB92E6E2FA32E19A767CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991230, "uuid": "7b55b5b0-995d-4324-9416-9df84f23d693", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991230, "uuid": "75b9bd45-803b-4154-8318-134b7bc39bac", "value": "3072:uXZ+g75DdiLv3UOPDn2XxC4ZS1ABnM6QQb/XK4V/Du5Zw:2WLvnDymAMb4V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661991230, "uuid": "520d4020-04ca-4966-b60e-3b44f05a5e3c", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661991230, "uuid": "8124efe9-063e-44ce-b995-b3b390ae7475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991230, "uuid": "f00c3ae0-076b-4cdf-a077-27cb9c987ade", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9ed157-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031133, "uuid": "807275b0-c326-4438-95dc-3d981055c8e1", "comment": "Malware payload", "value": "21a169e34c7a5f4cf23a2dd362b868ef", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031133, "uuid": "185b0dc4-5929-4fa7-b574-fb44e8e95af0", "comment": "Malware payload", "value": "9b5a66ca81124a7affa85762572b366d7264499ffeb091eea93ef30ab54cc6bd", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031133, "uuid": "97bc4653-15ab-4343-bf24-7f8fd8c1398d", "comment": "Malware payload", "value": "b3d913c8a0afcd5d8257d672c14e027bd5d16066", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031133, "uuid": "9fa9b06b-8029-4222-9955-5526b38f3395", "comment": "Malware payload", "value": "b2bd71ebf59ff702fd9187407ee9908c2fd7eaf18ec00d973ca4268aa1381b31e9b222c73005f926102f656c00a13a8d", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031133, "uuid": "73a3f263-4b26-4f31-8391-801ec9341a02", "value": "T19A13E8B30253BECF17260E41E40C3115DC59ECB7629999ACBF8848E68BE9118DDB8DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031133, "uuid": "35585340-c9df-4fa2-b119-fae041682a72", "value": "768:mGaxox+dYNfY++m8YzEj9smnx02kfgnt/XpXc3R:mGautfx+m8Y4j9jxXkfgt/XK3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031133, "uuid": "89855fc8-39d0-4cc0-b817-af3cfcc27711", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031133, "uuid": "1e63a60d-39dc-417c-9172-62779ad96c8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031133, "uuid": "10669668-b2e6-4f50-a36e-6368321fcdc2", "value": "P.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47eb22f4-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662027877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027877, "uuid": "c72bd94d-ab7d-4e48-9ebe-b1d4bc70fb5d", "comment": "Malware payload (ModiLoader)", "value": "d718b3de01e3644b0b584164e410b398", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027877, "uuid": "1fd46f9b-c95b-4524-894f-1f632b63c0ab", "comment": "Malware payload (ModiLoader)", "value": "9b65b80069bf9bcf7dc4190bc78c5f897d014ab36104121a136e3d440d1d8d47", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027877, "uuid": "35518ec4-ac58-4009-a752-901f55e23e7b", "comment": "Malware payload (ModiLoader)", "value": "a00e3594d5dafcbb5d9e1830293942e6861a68a5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027877, "uuid": "ab66db3c-a201-4f5d-b082-451e21608b7b", "comment": "Malware payload (ModiLoader)", "value": "a4776d887bd29e754b82a6bb2f31dd854f4d485fcbc2b2b0e3b26a4edff23e47113307633f2f5a7a33685b7334e4143f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027877, "uuid": "bf5f7fef-721c-44e8-b566-2cc2fdf5d006", "value": "T1B615BFF6B2E09A33C0731679CD5B63A4DD29FD115E00B95E17E1298C9F78681382FA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027877, "uuid": "bc8f9f1c-31ed-4b84-b01d-95c7b2a678b8", "value": "e44b1ce3d13e55963ede0f334a1c0840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027877, "uuid": "a0094a12-36f9-4f3c-bc69-700a52da78a7", "value": "24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027877, "uuid": "4eede276-8e80-4730-81ce-627279f3cc14", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027877, "uuid": "f43fa49d-b51a-4877-9d43-d2e445c04f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027877, "uuid": "e097d580-4e41-48d4-b5c5-0fd9f04bbd9c", "value": "dhl awb 345277827 shipping delivery notification,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b365d5f0-2a04-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1662043519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043519, "uuid": "0c9917c0-9f7f-4e07-8b08-96f9e0753639", "comment": "Malware payload (Vjw0rm)", "value": "ecc010e3891a10b483072242e09797ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043519, "uuid": "b566e19d-b307-404e-b82d-f1a64ba61057", "comment": "Malware payload (Vjw0rm)", "value": "9b8749981b6edc00313459a909eb91377f42580f17fe1831fc994f2dbb8e9ce7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043519, "uuid": "117bb52f-3201-46f3-b510-e0766e47d3b0", "comment": "Malware payload (Vjw0rm)", "value": "e7c711d77718c65640033db9b5887e80d073d80b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043519, "uuid": "559351d5-9aed-4f20-9c36-eb01d7f72ac0", "comment": "Malware payload (Vjw0rm)", "value": "bbb2e2a08dac85b560c15786f8e58f1bd8a98b4e214ec06af98d9324fc9b64dee9288495845af9fef8f9a8520bbb7c10", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043519, "uuid": "2eca9b4b-160c-489d-b435-f0859c504302", "value": "T1DE428D623CB8FE8C4BC31A9159BE4C28B7EC0E5664A1691BC931F54401EA4A6951FC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043519, "uuid": "ec20dfc3-002a-41fe-9d7a-186493169db5", "value": "192:MSHX72nN0b5PCi3m11uL6FgnG0hu+NVmN3RJizLVv9v9/ziulg2SwIlQKRKRQDgh:rHr2mvAMmzUTKKlv9vpmulg2SwQQKRKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043519, "uuid": "867332b5-db74-49e4-97a6-8bd3bb491a56", "value": 12227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043519, "uuid": "06a8ebbd-af22-4db5-9339-cc5413b211d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043519, "uuid": "5b629926-8d51-4b5b-a298-3cdade6101b8", "value": "6b4867e44bbf1e541c6adceacc336fa9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0643b0a-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662027301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027301, "uuid": "0f6c740b-7786-40f8-930a-3ccca42a6c4c", "comment": "Malware payload", "value": "532adf8bb717ef50a706eaa2957d7ae0", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027301, "uuid": "88c69112-43a9-4544-a5b4-c9f34bd350ee", "comment": "Malware payload", "value": "9dad7597f255e83ad676f4ca7da76fbb8014d9e40acd89d3dcfd4f2ac31e9602", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027301, "uuid": "75c0deb6-6d8d-402e-aad8-26149a4349be", "comment": "Malware payload", "value": "81c35d66355f6de1c40997fb5f9a892b7890ae63", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027301, "uuid": "3a854b31-4396-431e-a2ac-0c114ce8b40a", "comment": "Malware payload", "value": "6db6c1bc80380389a9b98b04111f3bb35c21c9955989ca6737da36618e3ea70f183e4b5b921f799d667c18b3bb773f99", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027301, "uuid": "d3cd0a5f-4fac-4b0d-8514-ef0a35fce08c", "value": "T1A8A6334DDD57AAE6DE409D38D40B0F4233AE4A559CE1F7836F32113A1CB772826E7286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027301, "uuid": "93b5f8cf-62a0-4a93-af9b-c3e2a314f563", "value": "196608:DMQVFyNlwksUpvYOJIY3KYOaVA1gCc74D9Z6F0i0p6qbenDt+jv:DMQyrwksLeIY3KYOB+4D/6j08jnB+jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027301, "uuid": "ae5b062f-e14a-41f8-8784-861f2b880880", "value": 9779179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027301, "uuid": "19337b66-cbd5-4b48-bf25-c9cb9b2e8f5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027301, "uuid": "f4db9880-6ab3-4c64-9fa6-5656344bd165", "value": "nnew27b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdc5f1d-29d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662024830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024830, "uuid": "6c7db1be-97ea-4073-8d22-d942490083ac", "comment": "Malware payload (RedLineStealer)", "value": "6f4c0bcb5502dd154593912f25b0f89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024830, "uuid": "99fd7359-30a8-4636-9449-70b49ea80f73", "comment": "Malware payload (RedLineStealer)", "value": "9ddf8cbbd84ad8657b952f1f1396f12ce43780766f8346e817d7e8374b35ec39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024830, "uuid": "81fc8aa9-2ef3-44b3-968c-39fca12a7cff", "comment": "Malware payload (RedLineStealer)", "value": "5f3f347cfb257654ccd28542cdfe33d3493fe751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024830, "uuid": "bd037227-5a44-4a90-8e55-178920e3f4e0", "comment": "Malware payload (RedLineStealer)", "value": "82a721541a7806725ed86d3db76e05619b797fba344af49c6298bbe1955968e15faf212b754708e834ba3708c26c6d3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024830, "uuid": "ce8d20f0-9db4-4a80-a272-6bdd09299a04", "value": "T15E361277336111D1D0D98838C933FFA532F69176878194FA69DEAAC02F129E5E2236D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024830, "uuid": "83be5cb0-4f71-40dc-9af9-714df2a4ba30", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024830, "uuid": "c4c9fa49-0b5a-4c23-a110-a445fbbffb42", "value": "98304:unrAJGAwp5gKTBTEDk9lgbVxP9P7aC6ztSd7oa6tYlp0PCkFg9rq6LKDjvlz:uDLrj9EiGB7IztSpoGCFCUDjtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024830, "uuid": "4927b55d-e65e-4bc7-bc76-f439739fd6d3", "value": 5234024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024830, "uuid": "a7b389f7-958d-43f4-bd3a-4e632070fdcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024830, "uuid": "b4dbf12c-b7a6-40bf-b1cf-887a635382ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2074d44a-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1662024375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024375, "uuid": "d3e20b42-3fbe-4e10-a9d5-59f71c8440b4", "comment": "Malware payload (NetWire)", "value": "bdac02fde5e13cb5c08b10df39cfe445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024375, "uuid": "8a38d074-7852-47a1-9595-0c3f8a225254", "comment": "Malware payload (NetWire)", "value": "9e90590b4333c2a963369cabf3c7671037039829c6d42a51f824356e621dff86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024375, "uuid": "4e1641a2-7b01-4be7-ad9f-69f8dafbf90f", "comment": "Malware payload (NetWire)", "value": "85f0703fd663c0fb491cfb71ebe5609f78312a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024375, "uuid": "f6d38377-84cd-44d9-9d65-55d4c17a3483", "comment": "Malware payload (NetWire)", "value": "1054d8083aad9c06b0e1b8895161ffafd4533714d48086424e3534fe95f9a90f5931925c89f74cdb3911fef69410821a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024375, "uuid": "9aa78876-246c-4780-90c9-4979a3a62457", "value": "T11425028966C4C3B5F4260B7011B1F12986BD7E15D2B1C2C9AFDFF2EC45B8B169217A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024375, "uuid": "ffe022de-0c32-49bf-8a35-6bf144af496a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024375, "uuid": "3ba8668c-7833-45ce-85a9-d86c46a321b4", "value": "24576:ZZ5+XY+mzo3bvrn23nt+uK6ogSOY2OKP1:D5YlmzMjcocoOYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024375, "uuid": "41434d59-b589-4214-8732-b0b2758bffa3", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024375, "uuid": "7c301245-3cc9-4c6b-be17-19280e260c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024375, "uuid": "4ef6e571-b1ac-4527-a496-25d7f472104d", "value": "F02EVEOU.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e9a597-29b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662011209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662011209, "uuid": "cad95701-1189-40a3-a9c0-9326fce3233f", "comment": "Malware payload (Smoke Loader)", "value": "5a7a0136d79d71c3de8d14e60109ea9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662011209, "uuid": "61ca58c6-45f6-4592-bad4-08c6829cd158", "comment": "Malware payload (Smoke Loader)", "value": "9ed74daf3c641463478f33302a3b61f5e36d709c8e871170772fa18dc72208b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662011209, "uuid": "bb33de38-f7a6-4328-95cc-dc1512bbd968", "comment": "Malware payload (Smoke Loader)", "value": "a1ca906715ee65d5c70da07d982e78261826175c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662011209, "uuid": "cdc4ba9c-880f-40b3-9037-d235a9398bfb", "comment": "Malware payload (Smoke Loader)", "value": "3f0161c1948afcbcd44bf0a058ac168e161f7d2e0af8965149032dd5a26da0026bb2cfd9e70998ef0394cb758291e1dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662011209, "uuid": "bc7d8a09-d4e1-42af-a437-a1ba3885196d", "value": "T13554D016B493C0B2C851107C987ADBCC6ABB5835067159473B6D2B7E6EB02E39E7630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662011209, "uuid": "8c4d7a0f-f80d-4429-ab6b-245e5ecc905e", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662011209, "uuid": "d2ef2d05-4e78-4d19-8817-5f4a30ef00e7", "value": "3072:06Xp+NHOXIwLfyl9r2oIfObLhpEGKgg9V92r/Qx6mW:fJLalyfObYHdt6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662011209, "uuid": "67a615f2-4509-48ab-a5f7-d378848478c8", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662011209, "uuid": "627a5220-9dc9-4904-ad2a-d72fcabd3130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662011209, "uuid": "e94176e8-1d85-415e-9c8e-1cbf97c3196a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f3eabd-29e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662029597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029597, "uuid": "1b43cc93-5fec-4309-84e9-8f985d120b21", "comment": "Malware payload (RedLineStealer)", "value": "53a6fcff9a72d644ab9d6fdc18dbe590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029597, "uuid": "2603041b-5263-4f7e-b982-a4308d997fec", "comment": "Malware payload (RedLineStealer)", "value": "9edb83fd3371be0748a1be964a7153980def6698bd8b8e7e67a91deb14a3b685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029597, "uuid": "c51af59e-0a47-4b57-a355-2575e192b3a4", "comment": "Malware payload (RedLineStealer)", "value": "0ed313c262cf7c377ca571b4ef79b5e8a93418c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029597, "uuid": "3255c4d5-f267-4339-81b2-1f46e5d394f7", "comment": "Malware payload (RedLineStealer)", "value": "e2c4443fb6c02f934c2b0fa1da6d7bd712af2874277f6359766be081bfcaf49051e59a9b94124424a39155dbe296378c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029597, "uuid": "55ccfaf4-f296-47db-930a-92dde394c909", "value": "T1B236123712610196E4E9CC39C567BDE432F603778B81A8FE65DAAAC42B215D1F323E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029597, "uuid": "59fed0e3-8ed9-467f-a090-60a8c587ef4d", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029597, "uuid": "a45751b4-8c58-485d-93e5-29f916896317", "value": "98304:1blNxX1B3OmiMId+9GCN525Se7liZvVIKk1vWk38/eYHZLINPycTGf:18mi/nCcBOmKiP3gT6PCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029597, "uuid": "9dc9deca-f776-4569-9f06-70e2b60a60ac", "value": 5239656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029597, "uuid": "4da7a5d2-8c26-4328-a66f-9774d921087f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029597, "uuid": "c8508a86-2b1e-4529-b33d-efc04ca65e0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9c7d4d-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031103, "uuid": "3e57a41b-0a96-48db-8023-da1ac1a267c8", "comment": "Malware payload", "value": "4385aec7a990617798e4a4d34cfdd579", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031103, "uuid": "2dc7c258-411e-4c96-bc68-ff39c399aa32", "comment": "Malware payload", "value": "9f035abb87958166ca272173ea5c703cac3868e66d9abcc0ef46a5cb3d191083", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031103, "uuid": "3c391492-6fcf-4548-a841-0b917ea59d5a", "comment": "Malware payload", "value": "3865a11b023f1cd745ec9cec6dcd34c8e9a15536", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031103, "uuid": "48b40fcf-da1d-4139-b664-fa76e14ba54e", "comment": "Malware payload", "value": "4d9fdfc189e3140a4f9d2bdb9cf02c5f7f57c443fda1cc64c598f8aa728281031759558f60475ee68281157d90ab521b", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031103, "uuid": "67e44df0-3d95-4c6e-985b-9782ca1e9ff2", "value": "T14113F9B30213FECF17260E41D40C3115DC59AC677298A9ACFB4899E68BE9118DDF8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031103, "uuid": "95fd7e76-9a80-4d78-b5d8-536155f32ba0", "value": "768:kGmx0pYNfd++m8Y5sjoYIfbmcKxw2kfgnt/XpXc3lte:kGmpfM+m8Y5UIfyhxjkfgt/XK3be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031103, "uuid": "0b18d207-c072-4509-9fa9-99df56ed7d9b", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031103, "uuid": "7eb99701-b9ac-4595-af0c-79c0b23cb839", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031103, "uuid": "d2320ff7-a692-4f5d-86ff-8765d14ad6fb", "value": "ny0.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65d8dd3-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014748, "uuid": "5c685285-ee9e-4c60-a79a-a4bff30131ba", "comment": "Malware payload (Mirai)", "value": "1def418559b51fbcda313a826c84ae97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014748, "uuid": "212dc272-a281-4d25-a376-1f36baa8f7dc", "comment": "Malware payload (Mirai)", "value": "9fd13ab7ebc8ed38ad0eabe8df40e999d80da15ced4dc115e3917bbd7df79d6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014748, "uuid": "5f2ae4a9-48c3-47cc-9b11-4716858ce4f2", "comment": "Malware payload (Mirai)", "value": "3c20176736da76eab5e582e6a66bceac7cb19f6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014748, "uuid": "4feadcac-2b84-4907-b0ff-07a9768a1a41", "comment": "Malware payload (Mirai)", "value": "1b6fdf2aa1c6475f0a69e8b453eaafab90c5afd45c7df92036c423c744d62263f49dcc411484a7a94bb8d8605825a4e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014748, "uuid": "f954bacd-2144-4ab6-9aaa-45e49b3f3208", "value": "T13063180BB94180FDC05AC1780B3BB93AD977B4FD1238F3A967D4FE262D55E621D1A809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014748, "uuid": "4ab952f3-d607-48cb-a110-8c8c069b5b45", "value": "1536:GCRbCWkw8OlIDSRSw/Ogy8dBcZt+p/H+UqZsqzzaKvtqww0smc:hbLkw1yDgSw/dbHcAZqbzhfw0smc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014748, "uuid": "96435cbd-d9b9-457c-bb49-1c22be409392", "value": 69184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014748, "uuid": "669bf194-3472-476c-9e28-b5762c666b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014748, "uuid": "44ea3830-885c-4978-9b0f-cb32bb55e0d7", "value": "supercat.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39ac497-29d5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662023360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023360, "uuid": "d518546b-4213-4f66-a8f5-c07fa1bee4d8", "comment": "Malware payload (Formbook)", "value": "22925d71999050e7a215d1c6ec6d3acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023360, "uuid": "3ef533d6-1aab-4b30-953d-c7a357480340", "comment": "Malware payload (Formbook)", "value": "a044da065d4eaf497ccc5365580e78eaea4411b8650e62052407f16afbb150ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023360, "uuid": "ea63a52a-99db-4c2d-8421-568a255a2036", "comment": "Malware payload (Formbook)", "value": "25c00ee11da16e309dfa3e2afab98aa4ad1ad509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023360, "uuid": "71e9eb5e-4b3d-4f98-a7c5-44d3f0d0c8b3", "comment": "Malware payload (Formbook)", "value": "c93226f9bdcd99e21cdae8aed59bec5d1b22b01aaae9ea8347b2c67e2979b425c3902ac775af78c31021ea40f8b04c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023360, "uuid": "b7092540-9433-435d-b427-be65cfa2f81f", "value": "T1D40501353BFB8D66D4A150B814A6DB80D3F17F25DE23E78ABCD9211AF4513C92E09287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023360, "uuid": "a08d0f0d-0e45-404a-8ec1-45a2df1ed995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023360, "uuid": "882a96c6-40ad-4dff-a10c-79dff8684319", "value": "12288:ozY6na/lSUjDePOu239tVrPAHWg6LINf3GmzPpUgNEHslgDajmU:co0UGPFy9thPtvLc++m8Cw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023360, "uuid": "842cd0b3-d5e6-40b0-bf2f-39ab2ffb6907", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023360, "uuid": "0d67caf7-54eb-4375-bce2-89472f4fec1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023360, "uuid": "3660d300-2c79-41a0-a575-c1703e597a30", "value": "USD92.15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561ec52b-2a1e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662054530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054530, "uuid": "8982536f-25ed-4850-a97a-10778a812910", "comment": "Malware payload (Loki)", "value": "b40e9fd7e8d1888503a99b5ce8153865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054530, "uuid": "0dd7e534-359c-4287-9bed-64dc50adb7a9", "comment": "Malware payload (Loki)", "value": "a0af04aeb4d0bd20a2ac8089b0f88b1935d8334400d7190b2751be7d53e16716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054530, "uuid": "3396accd-0d47-4c12-8608-c887273bef63", "comment": "Malware payload (Loki)", "value": "42248620b82c82414c54db6f76cf9ac436f3a298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054530, "uuid": "e0bc0401-11ff-4330-8e33-51a805d411d5", "comment": "Malware payload (Loki)", "value": "c6f8821ca50e69c7ec196341a936cfdb4953148780a23f884fe3d4e79f92d7045cf62d466bf796196b7de6015a2692c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054530, "uuid": "a16ad601-1aaf-4980-a03b-61ac007af659", "value": "T1F805125ED2849B12F4AE0B7952F5F71243BE2F1AA172E3CC5CC8E2F415ED3664147A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054530, "uuid": "d7d490ae-82c2-4d5c-b28b-12e5ec4f2b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054530, "uuid": "39c41acc-11bf-4f5a-84a5-2e9c042ca20c", "value": "12288:mF75e7gPwqoXY+mzoRtbvRT7mP2xb1rMCkVU2M4eKYkViqY1So+C7tCY+UI:mZ5KXY+mzo3bvq2xhwUOjYakQCz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054530, "uuid": "20fe701f-f7dc-4486-9d71-004ec946d21f", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054530, "uuid": "52f7ab23-ced7-4b1f-afd3-4acd97e3c791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054530, "uuid": "9185d039-530f-4f27-8b57-f55019737397", "value": "b40e9fd7e8d1888503a99b5ce8153865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddf5de2-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1662028343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028343, "uuid": "427fb4fa-9b7f-4c1a-9003-ac4d272d7f88", "comment": "Malware payload (Socelars)", "value": "859a93566b5667e547317e79f554b1a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028343, "uuid": "c85efaec-fc4a-4902-9072-39afa68e98b1", "comment": "Malware payload (Socelars)", "value": "a0f77dd8c730f73cf6834bd962c49057a0a57c21892b0abe5a3c4e13400a33f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028343, "uuid": "53469d8a-bfe2-4ba8-85b5-b9b007428f0c", "comment": "Malware payload (Socelars)", "value": "83d6b559d84e4959fb5c3c1e11869148510e4cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028343, "uuid": "916a13c9-a2a3-4829-a11a-58bfc8623046", "comment": "Malware payload (Socelars)", "value": "c5955d8e6e4967abb027773a9bee2a10a45666792d2b6c4158625064faa52a65b73af9a0605bc7704f285e96e166ff3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028343, "uuid": "43166d4d-aa8c-480e-9371-3b2ec9b1fac5", "value": "T145659D11FB42E036E8E300B282FF5BFE9D28B621131894D7E3C45D695A719E23A37657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028343, "uuid": "aa77ae42-91af-40f9-b1ed-4bc28f6cd4e3", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028343, "uuid": "49db5697-377e-43c2-a38e-c88b98d6b370", "value": "24576:Z3MDpobXmmlFSUacscm2ns1CqSzqrNv+9IxPGS5wDKYjJinc:Z2pI3t5XJixPGSqDZwnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028343, "uuid": "e5d07a01-e39e-4de2-a2e4-e9655e45a1e0", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028343, "uuid": "cb68bbb5-36ad-4d17-9afa-137731ad6064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028343, "uuid": "9a85ec47-fa3a-47e1-9ad4-51ad86e084c9", "value": "859a93566b5667e547317e79f554b1a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0ef47f-2a14-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662050137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050137, "uuid": "6f60745f-820d-4322-ae38-d03d75fb597f", "comment": "Malware payload (RecordBreaker)", "value": "33a7ce9533c693eafad9ce76c784657a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050137, "uuid": "7199d6f1-4172-4db3-ab76-8079fa489254", "comment": "Malware payload (RecordBreaker)", "value": "a1f0489b21cfdff60f8910f5e0709f5531e6d243786a2cd2624b48d81d114fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050137, "uuid": "efd66035-cffb-4f99-909c-d5b81a8f2f06", "comment": "Malware payload (RecordBreaker)", "value": "70bb45e3a1208b63b86482281c8bcf2809145ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050137, "uuid": "9f007799-9fc1-4332-b1d5-7481b215d62b", "comment": "Malware payload (RecordBreaker)", "value": "d6c386cf138407ac8257d515940292cefed113d449710c288f84cc60437fe69f2627ed8dcc7aa79a13f979211a639ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050137, "uuid": "1d9b38f1-88d7-4069-bd29-ee0ecdc60def", "value": "T1EC547C10AA90C035F9B212F449B69378BD3E7AA09B2450CF52D51AFE97386E0FC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050137, "uuid": "e70ebafd-978c-4a91-a36d-ff5ada0e0f25", "value": "f294e5cc5a2e2e2c9cea0da735e71e95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050137, "uuid": "72f13a8b-653b-47bf-afbc-e965d5f03e63", "value": "6144:lyrM29Hv6+W0V0ZiAq1CrWavPzgzF29nU0F0:grMIh3GoAq1CrZPEzFGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050137, "uuid": "1debb260-44d2-4f08-9831-127967ef8d12", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050137, "uuid": "08d16838-9dd2-4ca4-9128-9eba788d26ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050137, "uuid": "f4f4e10d-d9ec-4407-ab0f-65bdfbdbff67", "value": "33a7ce9533c693eafad9ce76c784657a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dbbe60-29fb-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662039733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039733, "uuid": "0ba1d4d7-0e52-4f98-a4c9-3727ded62f4c", "comment": "Malware payload", "value": "0a7e0d291e852eb126dab8a50f4aa3c5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039733, "uuid": "35a90aa3-cccc-418b-9258-8a6c064f3232", "comment": "Malware payload", "value": "a3039c9318d65636cff5162e637ce5eb893ce8583089aef4b27978b9abd3e006", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039733, "uuid": "4a977883-78d3-4a98-ba0b-1feb1e374c87", "comment": "Malware payload", "value": "55a4827826062df65eacc062489534c5eba3e024", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039733, "uuid": "cd47c49f-81d8-4ede-b8b9-d6f66d7ce418", "comment": "Malware payload", "value": "e5132255c51fcb3860ad7ad52a05230b7542c0ce0a4198561ef28f5f7ef72823143c2ef1145c396b29adb339ee83a72c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039733, "uuid": "8ab80afd-75b7-4997-94d4-4c16f499e46f", "value": "T1E8252381FDE06FDBCB529238455FDA4EA14DFE8D6F40D0B6C7983483527AB3B90A1608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039733, "uuid": "4a8ff397-9214-4390-9f6b-2660ead46813", "value": "24576:U0eYMbTrlnylYZyC422YGnqL4Hh2Wlu6S:UhnTZKjFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039733, "uuid": "5cb458f4-f17f-4f1d-b23d-a36e357af1f1", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039733, "uuid": "caafb2f2-3e0c-4534-8514-3b37af939b19", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039733, "uuid": "da296941-fbe3-46db-ba11-23b258370101", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.32024.21137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0991d3b9-29ed-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662033356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033356, "uuid": "37d7305f-df2a-4cf0-8060-ffe056798b73", "comment": "Malware payload (RedLineStealer)", "value": "be9445e450c925bf89e59d752cd40440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033356, "uuid": "1d77ae97-9025-45fd-8280-ec59d1cd3db7", "comment": "Malware payload (RedLineStealer)", "value": "a348717d7eb23c235b0e9dacc38b5f4612634b9f811ffaa1c43c9c515f2729de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033356, "uuid": "ba682f0a-5369-4b9c-9e01-526d37fe6f08", "comment": "Malware payload (RedLineStealer)", "value": "c9b8d7f6d4d0ec4d735c50f35d5d3b22770ffe55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033356, "uuid": "45e22b3e-5a1d-4b6d-9651-aca6259a6470", "comment": "Malware payload (RedLineStealer)", "value": "ab00a879ced7d5aa05316e3dd8707065814ac917979736512b289c49517cc8fdb5db75f94fb65681f79cc7d94f7ba76a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033356, "uuid": "38cbceac-625c-47e4-9a04-bfa246b2f07b", "value": "T175B57E90469A5CBA8E8BDC8EC628BBD40D321FAFBA8552B7415140CB97B34478C7DDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033356, "uuid": "b63e2c6c-8f03-4cd8-b4ab-cecf3ed03609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033356, "uuid": "61186d1a-b0ac-43dc-bea9-3a29d7a331e2", "value": "12288:ryJ0qcSwAR1ipxRZvRex0OPKk3Ls87oLUa1l+5bM/qOeBW8t:uMzec8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662033356, "uuid": "046e4100-dc9b-40e6-8356-91667a1a0bac", "value": 2479616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662033356, "uuid": "cefb44a5-1b89-4671-9697-f9fb3dad6834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033356, "uuid": "f96572e8-24c9-49ba-8ece-9cd21303be56", "value": "QUOTATION081822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c354728-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049037, "uuid": "1cbd26be-dd85-4051-bf6b-782e3a32fc61", "comment": "Malware payload (Mirai)", "value": "33f4a65689ff49a6d1f9c7fb924b1974", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049037, "uuid": "449ddefb-4ec9-429b-af31-3f57a36aa6ac", "comment": "Malware payload (Mirai)", "value": "a44d7276e2d658ea14d5538261f60c4001b4fb9b22a53ccc909721c3f24031af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049037, "uuid": "3b0f1841-7cef-420d-b0d0-7479c681f83f", "comment": "Malware payload (Mirai)", "value": "20879409645aae5f921468b617783973ffa912ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049037, "uuid": "cdc4349a-3a35-4537-96c1-0c8e340180cb", "comment": "Malware payload (Mirai)", "value": "6bcf16a90c6008ff6da09fc0ce4220ea26a81360a93620601534ec477aa8dc0d11a01d086095414e59d4e477e1287ce3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049037, "uuid": "49360f80-49ef-4152-bd78-33aac8cbff18", "value": "T17F530956F8C18B11C5D412BAFA2E118D331757ACE2DFB2139D206F24778A96F0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049037, "uuid": "84d4b0cb-3ca7-4fa4-9390-5f8a6fda21be", "value": "1536:Xsn4APEcP2An9BVXKzfLGsOADQkMci/EXVGyqh3:s8cPnRKzfLYEXVGyqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049037, "uuid": "138f3b93-ee85-4e64-acbf-a69db6373259", "value": 63892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049037, "uuid": "b0d3d6af-1012-4aa6-b839-ac3ad0ecf354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049037, "uuid": "108c5ba6-6673-49e0-9f97-e4048d8fca8d", "value": "33f4a65689ff49a6d1f9c7fb924b1974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68184a63-2a22-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662056278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056278, "uuid": "7e2edf99-240c-43b2-84b2-b98fb8133a78", "comment": "Malware payload (RemcosRAT)", "value": "654b861bf3a0228b2caa5bbc4f89aac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056278, "uuid": "3df14fe8-181b-4dbc-b5c6-0d90e33c4fc4", "comment": "Malware payload (RemcosRAT)", "value": "a4d581d4b2f86fe13187477c15e41140f6c734318fe140d5383820614d3be1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056278, "uuid": "f1874aae-4fe4-438f-87f9-b5f50429e3c1", "comment": "Malware payload (RemcosRAT)", "value": "8c013c80122be251d513b40fab8588f32265840d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662056278, "uuid": "fa9506c6-e194-4ea1-b945-14fb83f620bb", "comment": "Malware payload (RemcosRAT)", "value": "8766503d4e0d7a726bf5be1a1db6db4042a0fb20c93343955f6842d3d24b2ccc58b77877ff5b89b26e2b1c42dac6f054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056278, "uuid": "e34cc76b-a24b-4af2-878e-3c6e3dffd0dd", "value": "T1D555CF3479EA4019FC33AF741AE43C969AAFBE733A36945D109133864733982DD9253B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056278, "uuid": "5254f0e5-7d45-44f5-bcbe-c195b3566766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056278, "uuid": "54cbe41e-c45a-41d4-9def-3f35ad6970d3", "value": "24576:FPUA0AUj2XY+mzo3QO7pptO+hcwawrceLyMAHki6snl55K:hTlmz/0JO3wawD2MAv6sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662056278, "uuid": "a7b9ef94-6a38-4874-bca4-c0b8e160f061", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662056278, "uuid": "e73aa9ce-846b-4401-9404-09dacafcdc65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662056278, "uuid": "4e6d4e8b-23fe-4898-89ed-a232318c5792", "value": "TT advice 232345ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad8b84d-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031023, "uuid": "dccb1a1c-0e89-41ce-9891-da579121c335", "comment": "Malware payload", "value": "0bf61622d40354606ee8eebcd95dec34", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031023, "uuid": "be992579-f3d0-4afb-ac06-dcadeac84053", "comment": "Malware payload", "value": "a60d3ebbcde7beaef90eeb1ead453b5ae8058fdc6a15988bbe479c1265871e04", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031023, "uuid": "b00a745b-740c-44c4-a7f3-bb6caf36247d", "comment": "Malware payload", "value": "c3a1d988e1fc76ef0dc45dce47545fd0de4a86bb", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031023, "uuid": "989d401d-33eb-4960-a7e4-466913827b2a", "comment": "Malware payload", "value": "e414f7982ec57e819882b90b038c045789bc47938e57495e8294bd81e35da059e7740d1fb0a491f9a7ca652db93af157", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031023, "uuid": "bca5fd91-f3e1-4029-96c1-0c4b3be06ebd", "value": "T122B37B5068EEF33DB063EB549EF4B9F2CD9BE22AB51924B601B0823346C1F40ED55979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031023, "uuid": "84835e97-31ae-455b-ba53-b37d63998d92", "value": "768:QuwXlBFUgktK/Nbs7YwhCBiyynuNhtA7YHFY4NK4u8nk7YUQ+:8kgBenhVnaiGdKree8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031023, "uuid": "e1306338-52f1-47ff-9c94-b4cfbf6adc9f", "value": 109202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031023, "uuid": "0397bc9e-ec56-4a62-b3ed-23440b9eb998", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031023, "uuid": "08fd53cf-2238-400c-a381-855c65f71bbb", "value": "3estrellasPe.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cbdc96-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662039869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039869, "uuid": "e73e3005-fd6a-4d9c-927e-426b349304cc", "comment": "Malware payload (Mirai)", "value": "162bca92e8498533acebf8991b3f7197", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039869, "uuid": "bc79e935-6d55-4271-b3ef-9282049484ff", "comment": "Malware payload (Mirai)", "value": "a654d988e8052a610435139ac8b5256621b586083cc0206ae513f97b93880273", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039869, "uuid": "ecee711b-1b87-478a-a676-6e7043875604", "comment": "Malware payload (Mirai)", "value": "aa4a1a6653353c5bccea50b0b31ef41746c08aaf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039869, "uuid": "23f97068-85a2-41d9-99ea-f3335ba38f16", "comment": "Malware payload (Mirai)", "value": "9fde6872e70f3d94109771d8a548762a08c46ecbb20f8ede72dd0b343ce9718fb4f91d6967884f92d5970a6c5186992f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039869, "uuid": "aecf1bf8-cc8d-4ac7-adb2-7849f3bb0eca", "value": "T1B3D2E184A69789FEC3905432CDE4C98BBE9B6F6DE3FE28670759038E3D4518117F8052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039869, "uuid": "7a9361ae-0922-4b8f-97e6-ad248e601fc9", "value": "768:YOYWiue/wazo0HP/GEnGgPdOQ9zOQRJV8WND69q3UELQU:PYUU9zBHmEGsdO+f38MvLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039869, "uuid": "f0014fee-5a9b-4af4-ba62-902927ac98b1", "value": 29616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039869, "uuid": "24169551-88b6-4b4e-95f0-5e778e0c2635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039869, "uuid": "2b1aaa83-2b81-412d-8b42-23035d330d9e", "value": "yakov.arm6-20220901-1344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a85236-2a0c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662046966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046966, "uuid": "466f768c-dbf4-469e-bfdc-92cdd336ee74", "comment": "Malware payload", "value": "f321da5881a6aaeb53da13d5c075406b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046966, "uuid": "11c2ce93-407b-494f-8492-33ec1c4fc3e0", "comment": "Malware payload", "value": "a6bdf9fcd293ff8169731da2a0a9501ad3a4fd14ce1559bc3f3d26dae9e6f57c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046966, "uuid": "9bc55405-110b-488c-a338-bd969aefac7f", "comment": "Malware payload", "value": "979ed66205d2bad63fc016dc8c32cff6a2b6fc05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046966, "uuid": "70270595-7422-4f19-afe8-a448d21d00a6", "comment": "Malware payload", "value": "4972d6ccfcc90a9f391910f03b737bbdfe1fe08e9735f7928a140df04056af5cbcc8b7760cbd7829a0aead423df9d800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046966, "uuid": "72fe45c8-de51-435a-9611-367cc9ef1483", "value": "T169E1C561E3E88B76DAB68B359C7363410BB6F345C927EB6D14C8410E8E633510663F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046966, "uuid": "5fd91505-0de1-492f-93c0-baadd1c257f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046966, "uuid": "3d77f5c9-693a-4cc7-8f76-5e7adbbe9683", "value": "96:TqaGgTpjcn+PoH7+QNhf+Ya684bSX0VajcMMzpKDAlgzzNt:NTponCob+QN9la68WSX1cM3DmgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046966, "uuid": "1cc9cbd1-539c-44ab-95d6-e02d7034326b", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046966, "uuid": "12e7c21c-f2be-4c75-83cb-6b85f57502b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046966, "uuid": "faa0d283-cd9e-415a-a1da-eb0a58de2d85", "value": "temp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9549ba3-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014753, "uuid": "1c71ec21-0ce1-4988-aa4d-9f283298b3e7", "comment": "Malware payload (Mirai)", "value": "46dcda0beef83ee2a1af6f667b267452", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014753, "uuid": "8c8cca75-42ea-4723-b120-ec398f051339", "comment": "Malware payload (Mirai)", "value": "a6d8fa58c506e5e6df93575614f3ed1c721f9a82bedd341621614f1747624193", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014753, "uuid": "568623b3-6d1b-4bb3-b434-41ac4a9d081d", "comment": "Malware payload (Mirai)", "value": "93f3cd73b8584d7d806205160771b02a5c465489", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014753, "uuid": "7c99c78a-8784-44cf-8624-1569a9847c19", "comment": "Malware payload (Mirai)", "value": "5d7a5019dece8414c7f8d6ebec6cda6b6218e0d658c0b9eb6e65e270d5c7123547e84f84a70464e6569f9a2cd90e76b6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014753, "uuid": "d459f1bf-fd11-4315-b06a-f876fdcba705", "value": "T1D823D792BC819A1AC7C01375B99FAA9D3360A7D8D2CEB347EC102B2479D650F0D77E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014753, "uuid": "8c86c77c-00eb-473c-ba8c-ea8a9fd33adf", "value": "768:oWu1Z4KijNG5V45fA4d36QMytl5199Byq0mFkQ0mONkbsGVVf0Jak2iet0tULoaI:QipG5VN4d3hrR7/0OoUm8BLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014753, "uuid": "550708eb-1b16-4bbb-8d45-182ae7f42c83", "value": 47432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014753, "uuid": "19f397a6-c0e9-45fa-a986-022173bc44a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014753, "uuid": "134b57b2-b274-4cdc-87cb-a0d4883ae3b8", "value": "supercat.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4f9ab2-29d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024391, "uuid": "d5cb7932-ec51-4e40-9f0a-37b0de5e3598", "comment": "Malware payload (SnakeKeylogger)", "value": "883b988dd0c0081924f1980a27dddce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024391, "uuid": "cce1cf03-a7a9-452f-8f59-c7a1bd2d6243", "comment": "Malware payload (SnakeKeylogger)", "value": "a6e894bcca9fe87fdf65e222656050c97d85f8cfb75875a84a124571b045f4e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024391, "uuid": "14088fc6-2f7e-4f32-a2f2-1fc8df450de1", "comment": "Malware payload (SnakeKeylogger)", "value": "1fe9c5cd28c5ed7fbc2c90d8fa4f0f64ea558f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024391, "uuid": "57853f81-e853-46aa-9c7d-e98b423b68c9", "comment": "Malware payload (SnakeKeylogger)", "value": "06ccc7011ebe8e2efc5710d15714f55295984247fcf81befa1d35eb497f45e95e7953117dc74a52f937d3fb8f1386d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024391, "uuid": "2447be07-f7ea-481a-a954-d203740dc02b", "value": "T1CC150289A584C7B5F4160BB111B1F21446BEBE16D2B1C2DDAFDFF2EC49E4B129207A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024391, "uuid": "33079535-0c11-4f14-9d9e-66e90c3ab30d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024391, "uuid": "fc28cb3c-c3e2-409a-9850-f34a5d05ece0", "value": "24576:tZ5eXY+mzo3bvYcMlOwfBLadbFk6zmqb+B3:f54lmzMQxswpge6qB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024391, "uuid": "1afbbfeb-6267-4c79-8ee9-4340989718bb", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024391, "uuid": "c07bb8b6-de7b-45a6-a9bc-d96c7836f5f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024391, "uuid": "fef8257d-1add-4b8d-8793-00e5b14c1e81", "value": "Vessel details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38623ebb-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662039877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039877, "uuid": "85c72580-71c3-43f4-8875-d606f16d3db0", "comment": "Malware payload (Mirai)", "value": "1f50cb46787ce86b458af406335cb593", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039877, "uuid": "047ee331-608c-4e97-b1b0-648fd03a5a0a", "comment": "Malware payload (Mirai)", "value": "a72ccbc340cc1bce317bc266629ee7f12090178089bfb064a6ffbb2264e7cbaa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039877, "uuid": "441beb4f-2fe1-4840-89b0-72eb20c9016d", "comment": "Malware payload (Mirai)", "value": "df96d87868c20a2428c54398f0b94c1610b61d1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039877, "uuid": "d293f794-421a-424a-aee8-ef598c2387d9", "comment": "Malware payload (Mirai)", "value": "fb901a19e43ec15faf6ca9cdd539f68dfaf474737819f6aaca0c74ddb1d9f11b33acb6dda19255e0b3c22c2bdd9db1bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039877, "uuid": "b1b31f05-d18f-4e00-8eea-9f793b79df4e", "value": "T104A2D1201453D9F1C0A06837CBBC85C737F74BBDA3E67163B6A106B1A0D4A1A36FE14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039877, "uuid": "6e4a8475-4738-4729-9364-a0a55fe30c2d", "value": "384:P5d/CRqx7xruTTeXYAPnNOYkUWMWKfAjyq1Ar6eZ3n0hymdGUop5h5NNi:LaRa7JUAPBL1BfAjrAeeys3UoznPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039877, "uuid": "500a1a3d-db3d-4a93-881a-d0f6342c2b76", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039877, "uuid": "1377e2f9-0240-45e9-bbec-a1c703852061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039877, "uuid": "5b2fbdf3-b84c-4848-aa55-288aeaaadb8a", "value": "yakov.arm5-20220901-1344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed768cd6-299d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661999378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999378, "uuid": "d3c5e1b5-d1e6-4e74-b1aa-14a015fb0a95", "comment": "Malware payload (Smoke Loader)", "value": "c18e64a969799bc78bbcbda34293ea29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999378, "uuid": "bc07e3b9-f67a-4092-b4e2-c83bc73970b5", "comment": "Malware payload (Smoke Loader)", "value": "a76ec7a40b7e6a406f514214f212972d413e82ba1e223e13936f4e18e8795c76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999378, "uuid": "b58e4d2a-1dd7-405f-af1c-728ee16e51fc", "comment": "Malware payload (Smoke Loader)", "value": "d8872e5e17560a5de08ce7dffc0b95bb930c6d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999378, "uuid": "543ee864-88c1-4a91-81c8-ee380f913f86", "comment": "Malware payload (Smoke Loader)", "value": "8466e150cdb7579c385d8c3cff04213566f7c317736f1357ef9e9b51b70661b0b012ccfd037fb63798febc26eed7bd3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999378, "uuid": "8817e581-af4b-4875-a869-fda16f18d5d7", "value": "T10B54D0227682DCB2C4D101706824FF956BBBB93016F316873BA426BE3F707E2567574A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999378, "uuid": "406743bb-bb46-492b-9889-d5a03bc4e290", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999378, "uuid": "0e432b78-7e34-49af-9650-0865f8aad567", "value": "3072:3XkUt4T852L2NAA8PqV2XxuWdcJ/vxhLht75HncFBJjlVkhL:noL2vgqougGH7d8FBJjlVkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999378, "uuid": "0d4d642b-60d6-4a2c-b6ab-7a7ae98d9e81", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999378, "uuid": "8bf65bcd-6d60-45c3-9a27-f74bb011101a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999378, "uuid": "785e18a6-cfb9-46ba-8cb1-021bf0d0e6af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8f69d9-29ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662033948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033948, "uuid": "d33370a7-db23-46cc-b1a4-c46f0dc77f15", "comment": "Malware payload", "value": "fcce3075affc0b7fc6c7ca0d4ce93297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033948, "uuid": "256b4e30-4cca-4f07-957f-7193fc8c441b", "comment": "Malware payload", "value": "a8024c0607c2e915af6cf1a3d962016d741a60b46292492372e2ccd089a722a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033948, "uuid": "ca403612-c86b-4f7f-8b49-c2b0652d273a", "comment": "Malware payload", "value": "c3210e3eb450c32c5268332cd4ed99e19be2e890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662033948, "uuid": "e77dd38a-f15e-4811-9228-ec641d27a7fb", "comment": "Malware payload", "value": "ff90e23931c3c200f03a9b7fb970d34aa68ae4b1a5776b60f2bdef9ffd4cc4a7e01e7bfc98e820fbea45003b17e12df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeWindowsXP-KB942288-v3-x86", "colour": "#B7F4DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033948, "uuid": "c8826877-055c-45e7-8ad0-572fb21ac8ea", "value": "T1E5E533881F8289A3D896417074476AB73ED1CC31A3A07EF3ABCD251DBC61362FDA49D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033948, "uuid": "719685a6-c4da-4a03-b665-20896ba38ee5", "value": "efa5f35372e4d62ace30c793506bd914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033948, "uuid": "3ac4a6b9-b06a-492a-9fbd-f46c1ee8c24a", "value": "49152:FUd8g4X/jCb21UhH35rTHhrnwtGVyaB3C1CvEqm+eYIDNVU16j/dbr4imHHXNv/k:2d8/XrU21ArTJnXVyoIqcYAK4MicHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662033948, "uuid": "37b6949a-c36f-4e3d-a43f-64b14e4d85f2", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662033948, "uuid": "5207375b-f2ae-49bc-bbe3-f506c323f8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662033948, "uuid": "15a594ff-e989-4e30-88da-090cf07c7d10", "value": "a8024c0607c2e915af6cf1a3d962016d741a60b46292492372e2ccd089a722a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444611ba-29e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662031307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031307, "uuid": "e00d91ea-8525-478b-b81b-2c22e82e84f3", "comment": "Malware payload (Mirai)", "value": "2395e5543940e198341416fb7abc127b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031307, "uuid": "2edfbb27-8fae-4f4b-961d-92033b84a75c", "comment": "Malware payload (Mirai)", "value": "a964857935afa4b8b66f5711fe1a99fee516678536d18ce0d11b59e7fd06ef1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031307, "uuid": "41e34cf6-4cf1-48dc-a912-3ba691cbae0f", "comment": "Malware payload (Mirai)", "value": "a2382db8732ed1ba50cc403e01d2a09d3567371b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031307, "uuid": "632a6da6-fc92-4574-901a-3bcc57478370", "comment": "Malware payload (Mirai)", "value": "6ea1834ce55d3fdeee694f4ce74bae284180b20b361201e8e541a57cc1f0217b1c19b23fc2ce055e6465a4ac37425974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031307, "uuid": "c7a36ffb-d8a2-415d-b3d0-d29397b338d3", "value": "T141431751B8819A13C5E4237BF9AE418E372523E8E2DB3217DD215F5177C682F0C6BE92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031307, "uuid": "29530769-2a8d-4ea1-8a76-3c4ada7dae99", "value": "1536:0eBu7TEh2MUlJt5TfleLCfmV6AVeFpf0sFSq:zBu7TvrtmiFpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031307, "uuid": "a026b4d8-400f-485d-9c36-9d1208765861", "value": 58360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031307, "uuid": "9930f07e-4427-4d68-9a1a-f1e7e8184abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031307, "uuid": "a37ade10-2938-4222-ba06-62937916ad65", "value": "2395e5543940e198341416fb7abc127b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c446ee8-2997-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1661996531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996531, "uuid": "8d91808a-f38e-4493-abad-783c6fd93048", "comment": "Malware payload (RedLineStealer)", "value": "611861fad66c6c01416c097769428558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996531, "uuid": "bf64484e-e240-433a-bbf6-860207da4a46", "comment": "Malware payload (RedLineStealer)", "value": "a9e9acea3e6fad3a0a16c31f4810a2957536015982f0ad21b35663b050aef38f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996531, "uuid": "c1b6373f-90fb-4963-af59-aa200382a9f5", "comment": "Malware payload (RedLineStealer)", "value": "4b8175712bdc6a3436fee69dadc6113134195171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996531, "uuid": "357b0644-2119-4732-ad82-c59244f363c1", "comment": "Malware payload (RedLineStealer)", "value": "19f5e893fcdfaf9516a1b81c35cc3f76dadac956ce441a4a34b5029bc952f5aba06b921acf8cb8bb2efc2cbec8936866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996531, "uuid": "264389a4-282b-4efd-98d2-9c417b09b024", "value": "T1B5716352A7FC5256E1B707342AB3C30067B5FE51CA67879E28D8262DAD22F108D63B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996531, "uuid": "6a7f7f4b-5b55-4dde-ad76-67e00c801d19", "value": "48:6+ItXXYX5FX44TgVPuulRqBFRqXSfbNtm:F47BWB1zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661996531, "uuid": "58c6d62c-dff2-4f68-98da-7c024f3e05cd", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661996531, "uuid": "aa7f2dba-ba20-4213-93bc-6948e716bdc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996531, "uuid": "d83cea83-955c-48c0-a79c-679831031e9e", "value": "611861fad66c6c01416c097769428558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bcdaa8-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024060, "uuid": "49d8c454-cde9-47a5-80ab-48338e83c5d1", "comment": "Malware payload (SnakeKeylogger)", "value": "69b62bff9858a3a4a209820a461e7e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024060, "uuid": "0b9edbe0-ce04-42a0-9859-8c8843b58956", "comment": "Malware payload (SnakeKeylogger)", "value": "ab4e0bc4a0613b6086cd4e9bf272da067de4f2d96e6e380311e4c46b8ac3aad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024060, "uuid": "ff561bfd-b08e-400b-9762-182db466d702", "comment": "Malware payload (SnakeKeylogger)", "value": "eab95de4f9592245b9115cb9fc759982e50247bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024060, "uuid": "10b9063e-a394-4c10-bb96-bd596de7a5bc", "comment": "Malware payload (SnakeKeylogger)", "value": "7edf1ac52c4a1d226a4d0e1f0b99441259141e69e34e45f93d386a9372758b8a78ab8c7d0ba288239c8d545d8f21ffa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024060, "uuid": "7a784632-549b-48b9-a73b-537b737565a0", "value": "T1A915028596C487B6F42B1BB015B1F21582B9BE11D171C6CCAEDFB2EC15F8B12A217A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024060, "uuid": "f69c7852-4cf4-4cd3-93d7-caabbd741b61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024060, "uuid": "8188c15b-ba3a-404f-99df-39f435fdfce7", "value": "12288:lF75eW02taK8BxqB8wy8c9cQ4Izsea3qcLV5n0G9gPwqoXY+mzoRtbvRT7:lZ5t8ejVbUsemqcLVlJ9XY+mzo3bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024060, "uuid": "8cdb34af-2a01-4006-82b9-d44c9ec2c9b8", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024060, "uuid": "0aad6580-e8aa-4a61-8c53-d7a2dae94da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024060, "uuid": "7e6539a4-f6fa-49db-a12a-b9dcebd03e15", "value": "INQUIRY P. O. REF.177254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5e2110-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1661999432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999432, "uuid": "67b75248-741a-4900-901f-45223df11f9f", "comment": "Malware payload (RemcosRAT)", "value": "971b9196cd4719ea52cb5485c3d0b475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999432, "uuid": "6e4639d8-203d-4c4a-848f-7535fa139453", "comment": "Malware payload (RemcosRAT)", "value": "ab60670d184fabfb1a2ccc70007207a654fc5dc1ea3c66cc13e1c86b6684a18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999432, "uuid": "ee46919d-4d47-439d-892e-0ee867cdbd8c", "comment": "Malware payload (RemcosRAT)", "value": "29b7aafc0d587583b42dc1c54c1aa967a3625f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999432, "uuid": "6e015668-655c-4f4e-93fd-01dd9d56e653", "comment": "Malware payload (RemcosRAT)", "value": "dae435f29e24c952e67cfbe446740042845e83224c5fb7f8992032433c4d89e2dd976336289f82d1b59958ae50168468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999432, "uuid": "4bdca599-eead-4be6-8bd7-5aea86a939e1", "value": "T1E2B4BE1CACDC77B2C863AF39A87519A105E39DA22DCEA38D0FC53678C9F5642790C51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999432, "uuid": "f70ef57d-6bde-4d78-a872-72471b80782f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999432, "uuid": "df2962c9-3d3d-400c-8969-b04d79eb049e", "value": "12288:LPGkXgjACnQZX1xMG+Br3Z4OlMxlylSx1C:JXgjAllMGMJllwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999432, "uuid": "aad33b8e-5d46-4d49-85f5-06b31bc5b72e", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999432, "uuid": "e0f1277e-4cdf-4519-9724-5b6c03b04654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999432, "uuid": "2a143812-330b-4eb8-8e0c-f3dcd4033fae", "value": "SecuriteInfo.com.Trojan.KillProc2.18435.7106.9925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdd7d27-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031053, "uuid": "0ae7f49f-b418-459a-874e-694bc9ade66e", "comment": "Malware payload", "value": "fc20f38f04ed4a1c38ae87131e44dd92", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031053, "uuid": "9b7f5ba2-6229-449c-b105-21a479ba503f", "comment": "Malware payload", "value": "abd66239457d171ca273f5ac34a1942039c2678208c79cdbb31a1c85b5c3cccb", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031053, "uuid": "f3b03f84-9e0f-4db9-9697-8ffb8dec8e49", "comment": "Malware payload", "value": "8d6fe52bc9197dc32a3adabd14775b082ee96555", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031053, "uuid": "3c4fbf7f-916c-41fc-905a-811372b82c85", "comment": "Malware payload", "value": "506d714ebe759497783d361b69bfe81ae79d118e3dd49877555d1000859ae561e15bbd429f745c6bac02e00e81d2aec3", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031053, "uuid": "3df37d25-473d-4c4f-832e-e92be7b43d2b", "value": "T147D23A731E83FCE05FBE1C42F15679801D8A3D5B83184E68FFC808A529A5612DF2E839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031053, "uuid": "308ce380-6f2d-4747-a010-ada02260abf5", "value": "768:sRkRTecHUs6zHJSiXEBu5pQZvO9xIQPAe7rI5:s+RTecHUZHVDAZW9x9PAefY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031053, "uuid": "ce79c81f-3bfe-4410-a648-175662f6fbc8", "value": 29356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031053, "uuid": "38c945c0-5385-44e9-9e50-fb3a04ecdf05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031053, "uuid": "9345ab93-1a7d-4053-add0-e93aa990fb6d", "value": "FRAK.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbeb07f-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030945, "uuid": "af915aad-fdc6-4386-af7d-a18bb54d32f5", "comment": "Malware payload", "value": "b5ada88f03d82651890eff1b1db55ade", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030945, "uuid": "2f349671-efb0-4d73-aa29-0fec5a889bbc", "comment": "Malware payload", "value": "ad58d7f5715630078ceacb966f3746072cfd7d5c429e8481b0120618e097445b", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030945, "uuid": "74d5c001-cf46-4aad-8e50-b3c9a1b42fb3", "comment": "Malware payload", "value": "33f24425c94a24fb48e9a3fd6e5c1cafa9b4cc24", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030945, "uuid": "f18b4617-9276-4274-9191-a39bcabe2f51", "comment": "Malware payload", "value": "b539eab93f4b4a098e86561871ea0b5ff2f9468e53c9261cd27f494802798c1880595737d0ecb4ebfac06dad680ed05e", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030945, "uuid": "caac0001-8cc5-407d-947c-9453c0a06d82", "value": "T1D1C353F99A171A9F401A0E28E50D43146CECDD6BE3EAD1F1DF0F4DB6AE5981408B1E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030945, "uuid": "7f11b740-b523-4a33-8c9c-146b7c1a3f78", "value": "3072:Ql2JwGaZukWFQC88X/FZDEznVQ2jomrMZ2cZbUXyRjBjJst8EBMV+vaYM:sHZvWyd8tEznrMZ2cFUiVBjGZaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030945, "uuid": "71ecea0c-afea-4290-b3b3-ad4abc4a4725", "value": 123564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030945, "uuid": "775190a2-e3b9-4ea4-9625-c422fad1282b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030945, "uuid": "3eae8c0c-ec94-413e-9076-82d6addb2f77", "value": "ARH.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040ddbb2-2a1e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662054392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054392, "uuid": "1006160a-5997-47e6-818d-4bcb8603fd0b", "comment": "Malware payload (Formbook)", "value": "f39c791df3b8eae6dadfa82217b22024", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054392, "uuid": "0697546a-29ed-4ecc-93ba-984a7b9afa87", "comment": "Malware payload (Formbook)", "value": "ad82fb36eaae2c616f3ca8c90095a784493a69af3d490161a728d7dd652fc28a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054392, "uuid": "91ba1cae-e3da-4d55-b7ba-18208c088269", "comment": "Malware payload (Formbook)", "value": "3afd5b37373cde6357966240117100b0642cf605", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054392, "uuid": "eb1b9a7d-4120-4777-9cf1-45a599c11a51", "comment": "Malware payload (Formbook)", "value": "26beb85af1a374338b27ea3501496cf8da411f202b75d43ddbbe539d5f7107688d2a1293556d769b285cf03dd933d7d7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054392, "uuid": "f321b1c1-f9bf-4bcf-bbb5-4127a4da7d66", "value": "T12A74F1548BC86FB5CBAC561BC0BA0A1E63B0579AD51B64CDEB23BC47AFEFD044107099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054392, "uuid": "684528bf-4892-4439-a657-9dca07b69340", "value": "6144:DCdkP4JYswEt66C6GneLBEGqXx/9FyoY4iwM417++7Jyy6VJLsrl:75EtSFYEGsZlbTlJyirl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054392, "uuid": "41fd5c5b-48ce-403c-a0d6-39dabc91ee4c", "value": 352423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054392, "uuid": "f22635ac-eba7-4c3e-a15e-a84ef309cfee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054392, "uuid": "829f7ec9-49d5-496a-8496-51a2ab62a224", "value": "STATEMENT OF ACCOUNTS -AUGUST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d9661f-29bd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662012781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012781, "uuid": "10c02a79-f145-457a-8c3b-a5c4514c025f", "comment": "Malware payload (AgentTesla)", "value": "77a3e62168de7e841f136781c0c4b521", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012781, "uuid": "19c345bf-e66f-450d-9d24-53b72d7b6ac6", "comment": "Malware payload (AgentTesla)", "value": "ad88e4f04caf933d6611f203982d08b641ee9260d7a483e147ecfffdfb8646fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012781, "uuid": "c277b751-dd4c-4b09-81d4-8a97c26f3a71", "comment": "Malware payload (AgentTesla)", "value": "b432d2228906dd227a287b6094e32440a70b892f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662012781, "uuid": "cf7ea01b-f583-400e-b7f8-9e9f0d1b2c75", "comment": "Malware payload (AgentTesla)", "value": "c7c66e68d9bced5fe8a3633e6b3a924647b1adacffe25ad0a3dd77438f732a7842ba256a7259384f65c655c3d1544611", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012781, "uuid": "dd0326c9-88be-4d1a-8071-d5f8e62173ba", "value": "T145F4F18E35A7840ADE7A01B8C4E613881A39BC663765DECFE843758A0DB07FD412DB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012781, "uuid": "02435f4f-b720-4bf0-9cd4-17e1bf32af75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012781, "uuid": "b9b9c0a1-8c27-4db6-b93d-2011fffbcd61", "value": "12288:vA1znLvHBiKgmjlqvlULezFXV3A8eQjznn2aB9jUxPhHch:IpYKjlqdULmlwbQ3nV9AxZ8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662012781, "uuid": "66b52475-5022-486b-85b6-14969dbd418a", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662012781, "uuid": "b71f9d03-ff39-4188-95d2-1d8d5e198002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662012781, "uuid": "74505b14-95d4-49f5-b17e-140941b6f196", "value": "LGri43t5b5MMet7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86cafc2-29da-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662025542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025542, "uuid": "e3477e5f-4177-408b-b251-8a4733652b2d", "comment": "Malware payload (Loki)", "value": "2d8f76cdd4e33f467071fa7d0e55ebf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025542, "uuid": "2417cb33-0556-4bd7-a02a-39791a27024c", "comment": "Malware payload (Loki)", "value": "aef5ce16db08093c00552fdedc519071f4f81007c21fe6cc93fc9f04f041830d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025542, "uuid": "8878d141-3ea3-4d4e-885d-a178808484b1", "comment": "Malware payload (Loki)", "value": "4df2f60e1b2d21b76da17ee07b9eca912c271b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025542, "uuid": "631c97b1-8909-461e-9879-1a65c5be8d38", "comment": "Malware payload (Loki)", "value": "5866a8c507a94287c7efeab548c86e176e636d36f0b1c9a52eb0ef905f3139497bbfdeeddfdefbab274ec7183d11ea8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025542, "uuid": "d1ecc29d-1922-4521-afb0-2422b208e980", "value": "T16E15014DB240B69FD417CE328AA06D20A6757D3B836BD343A48753BC598D69FCE061F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025542, "uuid": "6ef48294-5d4f-4a2e-8615-760bcdf4a5c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025542, "uuid": "b10bd339-37bb-460f-b6a3-c2a02db806ae", "value": "12288:LnGp6WF75e8ZF2ZSKScxvIluunFpFDPOELJCPtmZWgPwqoXY+mzoRtbvRT7kvn83:8/Z5zPpXc87VPOEL41EWXY+mzo3bvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025542, "uuid": "83562c59-b578-4297-a1f4-3c4dc1e5542d", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025542, "uuid": "58efd5b5-f1cc-40dd-a097-4dcf4fb3e610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025542, "uuid": "569745d6-387f-40a4-841b-14c5fb857aa4", "value": "PI & Bank info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f018eb4-29db-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662025714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025714, "uuid": "8f12a2f1-8297-4ef2-bc5b-0de3c5ba998e", "comment": "Malware payload (GuLoader)", "value": "e1206408c701775fa233bfa792d8e8ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025714, "uuid": "122c8e41-40de-4cc2-9c59-202eda799c69", "comment": "Malware payload (GuLoader)", "value": "af56eed6f7a6818663cf9c8597376f63cc197136dcc891f71b2cdebf9d2058d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025714, "uuid": "8312dca5-228d-4b6a-83d6-4dbac2b475b3", "comment": "Malware payload (GuLoader)", "value": "95d34d3a6f1a593bd472a41be1b2192ad9a93be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025714, "uuid": "ed4952ff-2578-4096-8520-bedaa3cdd383", "comment": "Malware payload (GuLoader)", "value": "e039699ab48957aa6f97398dd62938d5c4437a0eafa5ce3e5c26346dfc2a99f9e7237fb47add2e64a82d0004684c16b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025714, "uuid": "90a04326-fcbe-4f17-9bf2-09df2521dd8a", "value": "T1009407E2F64D862ECE162EB0B7A690F99FFDCD600911ED15236FF6D80936243E506235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025714, "uuid": "d0f75a49-8ff8-4f6a-ad30-ea9c008e8bc1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025714, "uuid": "7c150da9-27ae-4f27-a13b-fd2b3cea4090", "value": "6144:bQMm4CCoK0IbkR0J/WtEo8bFHzfBEn480O75:kMww8O+tElJzqH0O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025714, "uuid": "8ae3324b-5ef2-47e8-a869-920b50fbc7d2", "value": 431872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025714, "uuid": "a04f6ffe-64a7-46e5-b23e-27dea6ea118d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025714, "uuid": "7af1d30b-182e-47c9-8c68-c4d2991e3249", "value": "Offer for Silver Star Retail EAD PO 294 SO 101296 01 September 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcbb012-29ce-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662020344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020344, "uuid": "1bdda712-7dc7-472c-a0de-ffcc7e6c29be", "comment": "Malware payload (Formbook)", "value": "d01c2f4998fb15fb83c13ae2962dd454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020344, "uuid": "57febb61-9eef-444c-b232-fbd99659c4a7", "comment": "Malware payload (Formbook)", "value": "afcc0a9a1a0d65092e55206cd1a24cb297eee2b885c63addf5376427bb8d1351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020344, "uuid": "dae3a387-e1ad-4cd6-97f8-8c5a438a7d3a", "comment": "Malware payload (Formbook)", "value": "65e2a46330d496342503e3d08698b7ab1dea2464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662020344, "uuid": "4bd5ea72-05b5-42bd-a6ab-cf609cdb5974", "comment": "Malware payload (Formbook)", "value": "2dcca13e102bb1da8e124241f6ae478e0dc83a3db77f1c6026cc5de30bcc45c5f361a29569d2d013ad4a1277199bd375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020344, "uuid": "44d8977a-2c51-48cd-b194-c0146a3f3228", "value": "T17D15BF9CABA6C456DC2D0278D4A255F41622EC15F52AEE8FB5CBFEE93E363BC4045103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020344, "uuid": "612c48b9-b148-4a4b-9bf7-9393cbeb3556", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020344, "uuid": "fb5dbaf2-f2b3-495a-8459-909f8519cd29", "value": "12288:CfEWcBefnB1zoktYB6QZIOmpzAM6OquDDaFtiJoOHNjq7o2oS:6EvBWnBGUU1ZiA37gOFtiJoOtG7o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662020344, "uuid": "769560a2-f99e-465e-9aa4-7214e61c2d36", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662020344, "uuid": "969d6b17-4406-4fcf-8f53-33a8a2ef9911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662020344, "uuid": "ac351436-cbdb-4caf-9755-c0effefaf35f", "value": "New Inquiry Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e48573-2a1d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662054365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054365, "uuid": "892c0f27-8c77-47fe-8caa-da5f06704955", "comment": "Malware payload (Loki)", "value": "9c16365f4d0bcbaf6710bdbc70198868", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054365, "uuid": "d38f1125-e2f5-42c1-afa6-b5d2674130d8", "comment": "Malware payload (Loki)", "value": "b06c5d4bf21154c9236ca526d9f31100947f95dbdfb896d992a57b5e57ef5118", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054365, "uuid": "1082f87d-bf9b-41ee-b381-4c985041c397", "comment": "Malware payload (Loki)", "value": "faff1e9b6c7f5ea7d6bf8f1880c85fe0d7667266", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054365, "uuid": "271e3ae1-da45-4edf-a8c4-a80a2854979d", "comment": "Malware payload (Loki)", "value": "5736823c8a8153d0b0e904bd52fc15d52579d166e51b69d6daa8d75e5ccd048595e705c677dd13072685d39600bd44ce", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054365, "uuid": "56f7a053-74f9-4555-aa6e-7a61516a28ac", "value": "T1FCE4BF9163FC5327F2FF7F7985B30922867BBD47687AC36C1A08649C1962740CAA1763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054365, "uuid": "965e3476-7e04-479f-84c9-6cc9b5e6f238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054365, "uuid": "8ca0ec5d-0900-4ec5-95b4-a5de540ed699", "value": "12288:O1E73WoE/CYkZFoESBbY14sPR9LG1aMvAqrvYro44SDprK36:xlE/CYEEbQVRVgAqrCFrKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054365, "uuid": "02d73e5d-2fc3-4f72-b2ec-9b525f3942e7", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054365, "uuid": "7033fc09-cbe5-49ad-bf50-2b3984ca1391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054365, "uuid": "48de2512-f73d-4bce-842b-70a268f7c429", "value": "Confirmaci\u00f3n de env\u00edo DHL Express.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc4133e-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662036883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036883, "uuid": "74f761c6-0810-4b3a-84f8-3405d0d40321", "comment": "Malware payload (Formbook)", "value": "d18c3cf8d20038d8a9bc2c79afedaf3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036883, "uuid": "aa579144-d525-4eed-a6bf-79ce285b7c4a", "comment": "Malware payload (Formbook)", "value": "b1248c9a9d2892a23cd6927ccfad438e360f5977e47c38d424522e7d67d10816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036883, "uuid": "74d1d5f8-daa7-4bfd-b208-754040dfda15", "comment": "Malware payload (Formbook)", "value": "9e6eb31d6cf49c61701e1020b7b2d4632cd4a2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036883, "uuid": "512f54c6-686b-4eea-a7d3-f1758c17d7e6", "comment": "Malware payload (Formbook)", "value": "fc414778594a3c9ff730fd2878d00f65670f4b866e4b0bdab513e75e32ec169f74a54390f9fbb7f0f3f53d280f6e6023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036883, "uuid": "2349fcc4-e3c4-4f3e-a646-3258a0dd49d9", "value": "T1E9159EF6B2E19B33D0631A7DCD176369DD29EE111E10795D27E5288C8F78680382FA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036883, "uuid": "bc3ae19f-bfb3-4cf5-938d-9c8b71dbbabd", "value": "e44b1ce3d13e55963ede0f334a1c0840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036883, "uuid": "a69b0e50-80aa-4897-950c-2f086d729e95", "value": "24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036883, "uuid": "4d9778f3-2cd2-4c61-a8d9-cb680072fe86", "value": 958466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036883, "uuid": "cf924566-6a4b-4f5b-8acd-2337184ca3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036883, "uuid": "954606ed-cc74-4af8-8c80-0783d36441e6", "value": "design B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf1e667-298c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1661991860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991860, "uuid": "1ee8d5ea-6581-4e04-9a87-a305f817fba1", "comment": "Malware payload (Loki)", "value": "ef27f948191d40a2549d4c3bbdbcf2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991860, "uuid": "fa8bf94c-f5fd-47de-a8fe-e7b0b6ba19ee", "comment": "Malware payload (Loki)", "value": "b134249b75a8caee01c1bfa696bbe1b6ff5029322ebf2904a18107c3fce6bcd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991860, "uuid": "865cc1de-2ed0-4271-834e-1a6462e22a9f", "comment": "Malware payload (Loki)", "value": "03051fc970c92072b411735b1c1b4b5193a9df71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991860, "uuid": "b0902370-86a6-4387-bd33-4ec8d785020e", "comment": "Malware payload (Loki)", "value": "038ff1f6280455ddace8a70717765f7250694aa8a176f324ddcc39588e2ba9361422ca05c7ef46d7640fd64db8a42d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991860, "uuid": "b4ee4f50-d072-4095-b346-49e12ca01fca", "value": "T1B6D40119A1E44B24F9781B7461B4A20247797F059833E3AF8CC0F5F5AEEA753861BE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991860, "uuid": "f6b09571-c1dd-4b40-beca-f6017fba01d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991860, "uuid": "2ee6f477-e163-49a5-b3aa-a056c5b16331", "value": "12288:rSqg5SZF75eKlIwTOTLHMSMYujIYCgV9mip02L:/ZZ5wwMTIY4gY0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661991860, "uuid": "40031c1d-7adf-475a-9300-d90046e7fa2a", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661991860, "uuid": "d99434d2-5c98-46e6-abb1-826964d8936b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991860, "uuid": "ab711ea8-73de-4a29-9556-3bdabcd7ae69", "value": "PI_\u7f8e\u91d1\u532f\u738728.84 (USD 40,257+5% \u7a05\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b93db81-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014649, "uuid": "f07bd8c7-c163-4fdd-a54d-2150b5c46465", "comment": "Malware payload (Gafgyt)", "value": "120ff6183493a6b98bd5830155136f44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014649, "uuid": "7921049e-30dc-4888-8b93-21881bf6f026", "comment": "Malware payload (Gafgyt)", "value": "b15407eb9bfa1f5d26bacd448dd440e600d45344c81ce94bf330dd5bacd0f747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014649, "uuid": "0a7079c2-bfd2-4946-987b-e9695ee43c07", "comment": "Malware payload (Gafgyt)", "value": "e553a03dd7c0f2f7a81fb07a065eb43e581e0dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014649, "uuid": "c66c6995-7041-4749-b2ef-2b7f50511fe8", "comment": "Malware payload (Gafgyt)", "value": "fbead18c27fda7180a204b3730f91be850abee0032e8aedec399f3c5115cfcee31a314704a623fb8a3b995be63b29d30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014649, "uuid": "e0015794-eadb-449b-9789-a6234076f8be", "value": "T18CB3852A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014649, "uuid": "1b30acbc-e4a9-4e1a-aab8-06794b604fb3", "value": "1536:27ju1Thpq+XvYC2rKy3eYxPGEEeRYYIF8vEC7ZXA4PUmkiSFxfC7xbXe:RvYBPGEu/FFs64PUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014649, "uuid": "c683f4e9-f54d-4e3e-86b6-17749911170e", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014649, "uuid": "a9aeadff-dcba-43b0-b12e-03a8f3c124bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014649, "uuid": "144765a8-66a7-46be-ac30-a9ced83cf0d0", "value": "120ff6183493a6b98bd5830155136f44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c485fd-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662027088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027088, "uuid": "bb9bd6e4-5097-486f-90cc-1fbdc6d2864d", "comment": "Malware payload", "value": "d6b40d5d07e99e5ca43029cdd6b77928", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027088, "uuid": "5aa29d2c-b25a-4e0f-80cc-1481494eafc5", "comment": "Malware payload", "value": "b280e76e0e7d0f534533983c7034850a397127e60cfb5b1f293a7830ba3d0308", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027088, "uuid": "b38e6675-66bc-4d62-88ac-82721f96a88a", "comment": "Malware payload", "value": "e1cb9b3ab163839f56d38afb59d5fbbfd4e2772f", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027088, "uuid": "66f7044a-202e-4f0d-abfe-3b8bb6a3b0a7", "comment": "Malware payload", "value": "4d63453afe7df39c7be1944b66dd099b66aacf6a9d58fe468771a5461c28329ba83a46330a0fb5fe6b3cc73e372388aa", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027088, "uuid": "3ab495e6-5164-4d7f-98a8-eb2e480ad413", "value": "T1A6660082E0B716DC6BA5805FC07F4F2D6A0B2DAC9E78E9196565B2D235F33C31E83251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027088, "uuid": "2383ecc7-588e-4e97-b1bd-106b5b82be9c", "value": "196608:ePJPVDyf2LbeeF4VZQJgzZHmsjn08xzn8Khpqdc:8PRo2GS4Vu0ZHmsjpJn8K/qdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027088, "uuid": "43cdc1bb-de65-4517-a91e-866cc136fa76", "value": 7063246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027088, "uuid": "aee7c2f6-f377-4aac-9940-834b4c241616", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027088, "uuid": "0525943a-1c92-4485-88db-6bfb03f3baf9", "value": "new22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9898d60d-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030160, "uuid": "222c987b-384b-4ce7-bd8f-d69b60c755a2", "comment": "Malware payload", "value": "d901c8ccdffa72fdcf53c49f7e4ee1f1", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030160, "uuid": "f9bd2b61-9a09-43bb-b964-ed6683c2fd08", "comment": "Malware payload", "value": "b33541d0eb15a5d0ea37826f34c9725688f2361374e1a31fe101edaf22fb32c9", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030160, "uuid": "12221761-7053-4c60-908d-355bb80e0209", "comment": "Malware payload", "value": "069be7924d6b256f97be3f35fbd75322ecd3c6d3", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030160, "uuid": "a3c2e2e7-1731-4e13-a05a-c9bf16663a6c", "comment": "Malware payload", "value": "48137d7feea76eaadb8c27bf8198a4b3b1164a914818c0d81664bd3ee000e6e768b60837b1af696e49fc0c17b6a19bbf", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030160, "uuid": "05a11f5f-d278-48bc-8312-0ba8ad01486a", "value": "T1B56533ABC5CAA599E543E33C9AC33B194836DC06C276D4EF5AD683CCA7498831863D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030160, "uuid": "f2e004b7-d1be-435a-a2fd-a16ab5279db1", "value": "24576:psB6bQaseUjIVdDLYR9ajfP8UhWnZ2d6y2P7c/RVFMdFNjQxYPCif+OLZdlD:KB6N9Pgqfkp/y2PIyHeYPJfRFXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030160, "uuid": "aa0edd1a-19fb-4b0b-bada-36afc95039a7", "value": 1416784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030160, "uuid": "170e3d60-1bc9-46e8-9c10-7162b4ecd112", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030160, "uuid": "c76d3130-7881-447d-b137-f8e5fe8887ce", "value": "Profit Sharing Plan.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbfc0d3-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030145, "uuid": "5f98e8c0-aaa5-4a62-8039-7364ae128b94", "comment": "Malware payload", "value": "e14091ec731b04cbcec888da68cfa0dc", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030145, "uuid": "6712cbeb-b2d1-4203-9c65-7b55ddaa1c35", "comment": "Malware payload", "value": "b3f39054043551bcb78e4531580899b8343fc3c1e2dcfd46932ce576eea9019c", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030145, "uuid": "938c28ca-288c-4a9c-a619-f2bbc1a65b3a", "comment": "Malware payload", "value": "fc7ab82d92c9de210361ce70d5a3c499dd992c51", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030145, "uuid": "4d888156-84a5-4e84-b90b-33b7d4549954", "comment": "Malware payload", "value": "a46d5e44473c23ced7e87f01333b5406875c85015896cbf70ea2fa59862d6153855c80657df9a89a7767c49849cceea6", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030145, "uuid": "d67f5ae3-90c1-4012-87ff-89e510e22be2", "value": "T1F6A4232C26524C2BE18E7066B1BFB1D563E067D97B99818E5C5BE76C3F07014E6CA3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030145, "uuid": "cc833b99-9570-4ecb-a5fc-dab052abbe59", "value": "12288:e+W4MPYMHl56ijjINam5vh/ZFEPpj7TYZJcb:e+W4MHHZKR5pRG5sZJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030145, "uuid": "ce66d79f-eadb-4e7d-bfd0-eec8030da9cd", "value": 472268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030145, "uuid": "209fba89-233e-4fee-ab83-f18b03340ba9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030145, "uuid": "b671b2ee-ced2-41fd-9cb8-8edc381021f1", "value": "Annual Employee Bonus Plans.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eb3afe-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014618, "uuid": "ca5badec-8b69-4f7d-9f69-be9813a5ffb1", "comment": "Malware payload (Gafgyt)", "value": "3018fd97465ce891c2bcd9859806cb31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014618, "uuid": "efc9e305-3c33-4f7b-9a91-6b3e413c9673", "comment": "Malware payload (Gafgyt)", "value": "b5324f5d27cfbf193d406b12e99f01e0d0726425f06cbeacae6f5e54fb22aa7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014618, "uuid": "3fd10c78-c90e-4ac2-a239-5cc263f990ae", "comment": "Malware payload (Gafgyt)", "value": "720b3588fa60a1ebc60c588ab72250223189318f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014618, "uuid": "5ff12659-73aa-4631-8dd7-de47142781eb", "comment": "Malware payload (Gafgyt)", "value": "b30cd7164881cd0158cbe51cda7148b751777c23c54ea036695a8d1eda594c56f567a9e0faf1464f655d3e63b2528624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014618, "uuid": "784dee73-a1ca-480d-beae-91562f892e7d", "value": "T1FA833A43B72D0B43C49B6AF02DF727F08769F9A117A76580A10EBFC45772AB02512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014618, "uuid": "00cb3a50-8c05-4d4b-91f0-89db2d04722e", "value": "1536:lQm/PYM4bk/7Wv9Sc4Q3XFKAR9C28l8EmQ9VqXjtWf2Xe:lVJnyoc4Q3XNP8l8EmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014618, "uuid": "a1a5e9cc-358d-4cfd-8a43-d788848c07a8", "value": 84797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014618, "uuid": "74a7f407-b57a-408a-be3a-b2f5051a9f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014618, "uuid": "45185664-c1ff-42f6-a4c4-54ab7f9623fa", "value": "3018fd97465ce891c2bcd9859806cb31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80703092-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662046440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046440, "uuid": "72659113-eac0-44de-a48a-0d80f1645011", "comment": "Malware payload (Mirai)", "value": "584c5a464b88f2df4e8d52bca3f99e6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046440, "uuid": "6f520bcc-3cb9-4095-aa16-72f058544a57", "comment": "Malware payload (Mirai)", "value": "b5f7d34f148389915c213b9e29a84f711a316c962e4ff46f275afabb1d947e76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046440, "uuid": "0fe33c1d-019e-4c80-b58c-0c3198e2c273", "comment": "Malware payload (Mirai)", "value": "ec6ab3566b9a773a394e49e6cff9a858125b1c02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046440, "uuid": "81221c98-1dcf-40ae-8387-10e3be7eebbf", "comment": "Malware payload (Mirai)", "value": "ddcf75dada07f1dd9f190b2dbea0d389f0069d73651cab6fa03ecbef0408d5d5b80e6e235fbb92c5944819de503446a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046440, "uuid": "33889910-c7c5-4ad5-a3fd-4e7a375ec715", "value": "T12EA2D026E2A86F96DEBC4E109E91D2C13B590FD23B43C59379DA4F563C0A801B684DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046440, "uuid": "f67ba41b-27a4-4345-8c13-ba33a0af45b4", "value": "384:m/JywWc84Tp2YshxqlDMfHYXHY4iFst9+91ArQfM4uVcqgw05VxJU:mRxsSVsMDg+IFgs91n04uVcqgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046440, "uuid": "cdbef4ce-b18e-4dfe-b58a-68c3d905b158", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046440, "uuid": "8ac4a4f7-4dfc-4257-ac1a-331b3eff3119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046440, "uuid": "7575d0c2-ac5f-4210-8c90-3dd66abd85d3", "value": "584c5a464b88f2df4e8d52bca3f99e6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b7fdd2-2a17-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662051653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051653, "uuid": "4d80a249-1613-456d-8757-619a3a6a290a", "comment": "Malware payload (IcedID)", "value": "57f3c425a09aa015be2d6ea9e00fec52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051653, "uuid": "53fbccae-0cda-4f8c-99e4-01964810176e", "comment": "Malware payload (IcedID)", "value": "b6e6c2de1242dd497c8fe4b115ea61b7c72cefefa4d2a0a1537381743c370b4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051653, "uuid": "36fde0cd-4836-4451-8b7f-95ca60295d56", "comment": "Malware payload (IcedID)", "value": "165ab1475d20f639651e0dd8cb55773513516d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662051653, "uuid": "568e7ec6-707a-406a-9935-cd2e43d1d8e6", "comment": "Malware payload (IcedID)", "value": "4d266a08b60f6c548d1ac345780a57802a79db47a970ee3113754bda62b83d09156804297b53834b4d72c1327c24a936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051653, "uuid": "c65eca20-ac2d-4450-b202-0df71c247229", "value": "T10A7419DDF255B4BAC2666775C12F5909A23C28F2764CBC80D99A84D81E341B93263FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051653, "uuid": "fa21ab31-6e2f-46e2-9adb-d750dc876021", "value": "68cb9eca6e860ada0621fd925dc693e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051653, "uuid": "320aa549-1d31-4768-85fd-69438bfa1f9c", "value": "6144:dryu2FszVI0r750Vk6HQL5Y0jHwNKa/PY3RuJGsF:JyTmKIN5i4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662051653, "uuid": "9bd79182-1e30-4c7b-ba6a-cd5615731be0", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662051653, "uuid": "994f37cf-7730-4edd-a010-1f1e0aad70dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662051653, "uuid": "063b9886-e426-459d-bf44-9ebcbf363c07", "value": "painting.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671641ee-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetSupport)", "timestamp": 1662028359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028359, "uuid": "d4f824b4-e7d0-4834-a7ea-448721bcece3", "comment": "Malware payload (NetSupport)", "value": "cafb0d16c01a70ca1b5c154b6c743c87", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028359, "uuid": "5b8e8c80-81ab-4b9f-8393-ed55d5617358", "comment": "Malware payload (NetSupport)", "value": "b93c202e25852c133f27eaa6c9084ac0ef2d5f5c563487fd38b56134c7ad3f3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028359, "uuid": "71cbc561-537f-4dce-877d-b274ba885f9e", "comment": "Malware payload (NetSupport)", "value": "b4b2761441d1cc0ec59e054616d704115243d7d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028359, "uuid": "c34b2914-d58e-4342-b3ba-c3a1fe2f6c8e", "comment": "Malware payload (NetSupport)", "value": "4b27b808f95cd597ea7461773c4edbbb39d45f766cf6d645f20f4931e29c36f28779e427f574f7476d1802dee1bfd734", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028359, "uuid": "7e00e86d-90c0-490c-912c-d0d60b213967", "value": "T1675402D05392BC8261CF0E636BEDBAF6D628AD27B081334BE5F03B54659391B85D4E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028359, "uuid": "e7db0c79-018e-4bb5-b004-3bee3f52fdf6", "value": "3072:qrjVJySRCL1ddImO3NwSa0wQwRCijyQL7oebGpTLW+B57wtE:qASkdIn9lpQL7oebGRLQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028359, "uuid": "af729734-6824-4035-92a6-5dada5597e69", "value": 293494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028359, "uuid": "bfff0e44-5a2c-499b-af1a-dc98221685e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028359, "uuid": "52158528-4014-4026-821e-8865d465a299", "value": "cafb0d16c01a70ca1b5c154b6c743c87.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44bb0b9-2a37-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662065506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065506, "uuid": "4d9aa40b-a2b8-455e-8ae4-fca9264c2837", "comment": "Malware payload", "value": "3150914d37182afc3c75125554bf9460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065506, "uuid": "c5e0fa86-8138-4889-9fed-15a80668735c", "comment": "Malware payload", "value": "b9d52cdf2d446fcd7c1eb360935225fe9b3b673ad67edc9f7cddcbaf4c6d23d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065506, "uuid": "1bffaba4-1419-43b3-ab62-7940343be9a7", "comment": "Malware payload", "value": "66720e49817d123f20bed5d76e018fb07ef4a61b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065506, "uuid": "d58cc388-fa7a-4202-8552-50dc0582272f", "comment": "Malware payload", "value": "6759eb4d85b7ed45822c46e91d4572665ec4709b9d7414519f6f8f42e5c8f40e7498d442807f60e6e0a2585551b3ad2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065506, "uuid": "7eea2969-df0b-4965-8830-89eb83af729f", "value": "T1FDD4AE877BC45F51C13CBBB726A8965093B2D2C34951879368CD85D8BBE76C23C8C68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065506, "uuid": "4475d498-0b94-4c35-848a-bfc2c2a3a9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065506, "uuid": "ea6406bf-31a5-4d62-bdde-31f242a8c430", "value": "12288:tX3a2RbKAlpWE8yQBOdQ6L3tTJZPyIlEnu5N:tX3uuoE8xS31LbEu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662065506, "uuid": "8a05bcce-b345-4ee7-b767-3a902f1de882", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662065506, "uuid": "2404618e-cda4-448e-ad5e-c79600a04a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065506, "uuid": "205072c4-1dc3-4088-a7a5-77d27526f86e", "value": "LBT-50T-A-188 N -RO(PDF).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0d96ea-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662024015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024015, "uuid": "84c585ec-c1d9-4f19-bab5-389e70e4b0bb", "comment": "Malware payload (Smoke Loader)", "value": "669bfd62687954669c8e26c92743f0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024015, "uuid": "04fdd862-1713-4c3b-82d1-879bb840baa1", "comment": "Malware payload (Smoke Loader)", "value": "ba4a68ee31a36145da3762f43ce530068e4debc7e69c61ca647f015ec040c7fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024015, "uuid": "b6810802-7340-4788-8d08-e6d66f1f9175", "comment": "Malware payload (Smoke Loader)", "value": "a3d643dc70d5582d6fb8c3528d48356a76496ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024015, "uuid": "7b9ae6a5-5a8c-4b2a-bc99-ae76b0637cc6", "comment": "Malware payload (Smoke Loader)", "value": "13bfd6da121b84c34371fa5f303ce9c63c5809dfba57c93ac6b665ed169ab86a8dceacfbaa4af25bbdcb66c9b0f82147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024015, "uuid": "19ff5f87-4901-41df-8111-ce36dd40ddb7", "value": "T11A54D0123950FC71C45712B198B8CBA86B7EE5301A25158777AA2B6F2FF03D0773639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024015, "uuid": "44046dae-4234-44b3-adf3-8910870788f0", "value": "87441594d3de44f1a0456f0d6f52e874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024015, "uuid": "6c5b9ab8-7f90-4fdc-a7a8-339863e32f42", "value": "3072:xtc7XJgB3LkbPs2oAlkAveRMkHrVD4uvi4VgaU7O:x9LkbPnCRMCr2Qi4VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024015, "uuid": "e42d137f-b96c-4a4a-b243-4878021ff276", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024015, "uuid": "1feda1b0-04f1-4369-a665-f4d1e32e467e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024015, "uuid": "22e0aac6-5abe-4676-9d5a-1b8ef935647e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344dffd6-2a14-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662050178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050178, "uuid": "7307f1ef-1774-45f3-b8c8-ea530869a230", "comment": "Malware payload (IcedID)", "value": "381fb9edc6bd2660162ea4356f990187", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050178, "uuid": "05fbf7b3-d05b-4df7-83b5-d8675bacf30b", "comment": "Malware payload (IcedID)", "value": "baf111277da7766f7f5ab5645cdbb8bba09f2c3791450f862a5247f2a50c9a3a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050178, "uuid": "71427535-32c3-4df4-a800-d03e78fa839e", "comment": "Malware payload (IcedID)", "value": "c7becbf3c15816798f88f674ca35d1e412c08cfe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050178, "uuid": "d79449eb-97af-40b6-b993-9bbc2b37208a", "comment": "Malware payload (IcedID)", "value": "d9a46db5d7a659688cb6d64f752a67633668b75cc11ada1bbf2a7d333b86404742452c6ec9ffbc862c8ce7315aae9c88", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050178, "uuid": "644bfdbf-83eb-4c33-b956-fdc0df3d7ebc", "value": "T18CD3024531B2477AD4CFA5B3EE5B3FF4110392396E4DD46424A8A7628CE4F3A3623369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050178, "uuid": "bcf1be5c-ad80-4082-968a-797634f1620a", "value": "3072:6BNt8axWeGIGag7eaBF/SB0Dofh9CO69WGpISCVSesdjAKMI6IdTn:6B/9xwzaoeaf/wXjCOiWoISKSPPb6IdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050178, "uuid": "7de70e3a-96ea-46f7-94be-a8a7b3431362", "value": 141059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050178, "uuid": "596104df-65bb-47e3-9f71-c61a654ca2b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050178, "uuid": "4571e901-9860-4c8e-b4cb-6905d5ad9829", "value": "Stolen_ImagesEvidence_09-01-2022_16-33-59.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf63c42-2a02-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662042596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042596, "uuid": "2a206bc9-93cc-4517-8132-1e49407f3dcc", "comment": "Malware payload", "value": "fc3db0e5de94d14e0465dd214d14ed06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042596, "uuid": "511dc9b8-da70-4601-9c0f-85086acacb79", "comment": "Malware payload", "value": "bb927a56f525141da8714a372040ff40d10dfe42cd7758e95f29914b602f9672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042596, "uuid": "4b648027-6a64-485e-812a-8b7d89ffb5d0", "comment": "Malware payload", "value": "4984085667028d15aa235720bc628c27d75c3d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042596, "uuid": "550e3940-c507-4d56-a7ab-31c3ed01932c", "comment": "Malware payload", "value": "5b7190eeec30dc33d63aacc84f32a7b273e07b186cdb3a1857500c1b295d77a5d5d302868ac035db7ad5e80005a10233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042596, "uuid": "0564e022-bcd1-4497-af3f-c6498d7e8c89", "value": "T142A48C97F3B541BDC0AFC575CA52961BEBB1B84A1234E34B42D0CBA62F13B72661E314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042596, "uuid": "804d73cb-2491-411c-a600-b78d5e3ffdb5", "value": "6144:umVtjA9X1u1kjIo71pnAtuETnsMZ+aBekhihU4i0emAkp6ShZouLRW+WE+enzi:Z+3jN71h4HTDZ+QeiitizcLZouLR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042596, "uuid": "39a16ffb-a895-4bc4-88ef-eec1093ca253", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042596, "uuid": "f32a3ff6-d293-4c1d-a20c-4a3933ed637c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042596, "uuid": "4485676b-0a44-47e4-bd6d-bfeb77309aa9", "value": "fba0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd69d4d6-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031107, "uuid": "09322cc8-3811-4917-b2d5-da8804625968", "comment": "Malware payload", "value": "55c1330a76c4adebb6f7a6cd20546a63", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031107, "uuid": "cd91148d-16cc-4ac4-9333-309b7e4c25fa", "comment": "Malware payload", "value": "bc4c6e2474a909a87e28069445395b09b2a3e3c39f11a81bcffb7cc2632837ac", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031107, "uuid": "a14e5e7c-cf3c-4c2c-9ab6-52695f64fca4", "comment": "Malware payload", "value": "21651ceef870a551b30458047b104d2c31826fa1", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031107, "uuid": "f3fe2228-1544-4fca-9e81-4e5e0f3d678c", "comment": "Malware payload", "value": "3326f1ec5fa5c7f2786600953ca6f0a9f8a1ea504d50f10346a5c5a2461a21717f1340d4b9960beee23ecf7fa8006409", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031107, "uuid": "896e3331-d8b4-4a42-ac9d-e70bc8877c7c", "value": "T141130AB30253BD9F56220E85E40C2115DCA9BCA772D998ACBF4488E59FE8118DDF8DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031107, "uuid": "82bb7994-1e1e-4873-afb8-7af7c7c8ff03", "value": "768:7kxFOtu+TwKMGBJ0WvhRmG622kfgnt/XpXc3/:7kTCxTwBSvhwbZkfgt/XK3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031107, "uuid": "28a06321-d2b0-4c5b-8002-ffb776cf6dad", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031107, "uuid": "b5bd83d9-e842-481e-a606-703ecc159515", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031107, "uuid": "f4d37ca3-2114-4568-9e71-bba2b3cc7fa7", "value": "ZX2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531c2bab-29a6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662002985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002985, "uuid": "99270f98-fd21-4c8b-953e-9c356c8e739a", "comment": "Malware payload (Formbook)", "value": "c693031c71200463aa6c11a291dba3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002985, "uuid": "26e8562a-f212-42f6-9f8b-18998808485b", "comment": "Malware payload (Formbook)", "value": "bc50bd102cef75bd5e2e54618302f10459cd18f90fbbba15ffb4d7503e7e895a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002985, "uuid": "402f5fb2-2683-49f0-933a-04994121b823", "comment": "Malware payload (Formbook)", "value": "563eba3e248239dc707a487d9d7ed728b3b56938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662002985, "uuid": "d7f80f14-242c-4802-b626-68fa49d821c3", "comment": "Malware payload (Formbook)", "value": "40eecf4c3b5beaaf41f00a276a5986ea81890aa32f0c657233e691aa4164dc557ab9d17353f00a8dbb8692c8b3641764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002985, "uuid": "90795bfb-96ad-4960-aef3-4ff7f01470fa", "value": "T1C92512496698D7B6F4170B7011B0F25882BE7E22D671C6AC6ECFF2EC45B8B069217D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002985, "uuid": "20606fe9-1ece-4539-a13e-cd64db755d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002985, "uuid": "3f07cff0-0f30-462e-bc5c-31435add2a1d", "value": "12288:TF75eWgPwqoXY+mzoRtbvRT70qp6NOq4yyejOD5Du5OQ/CTMuWQxhvhR:TZ5BXY+mzo3bvelz4F9I9o7TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662002985, "uuid": "d3238b8b-36c7-4249-bd86-edbcd09bf67f", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662002985, "uuid": "2d9c7a5c-55c1-426e-a569-b380cd19f911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662002985, "uuid": "b9d72578-e5a4-4e4d-8d0e-015124583d59", "value": "SecuriteInfo.com.W32.AIDetectNet.01.923.21773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c82443-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662030046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030046, "uuid": "a2ea135a-67b4-42ff-bef4-83826c3ee412", "comment": "Malware payload (AveMariaRAT)", "value": "b0933a777dc3b92fb37dc1c39ca38d90", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030046, "uuid": "b6292d69-ef46-447d-863d-c8956d7368f7", "comment": "Malware payload (AveMariaRAT)", "value": "bceead492301dfe1e95c5c3427d85467b71882b89ce718eda239bbead3c4ea0b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030046, "uuid": "c27ef18d-0b53-4d6e-92b5-d3a37da4a32a", "comment": "Malware payload (AveMariaRAT)", "value": "e0e92a533825275ccd55ccdda1e71b7ee0ab07a1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030046, "uuid": "bd1bfc57-ee38-41a8-89a9-020aa874f1da", "comment": "Malware payload (AveMariaRAT)", "value": "54faffb193ad7def3c0a95a6b5a0ebd660de5c89346aa2072546f7d0bdf98a694425075c7f6c333cd742e1500be277c8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030046, "uuid": "62941e25-1312-4007-9d12-ed37993dfcf1", "value": "T19705124EE1846B17F04A0B7851F0F31683BE7F1BA1B2E7984CC8A2F425DD33A9556A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030046, "uuid": "3790adab-da6f-44e2-a78e-ff3f738e00f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030046, "uuid": "511d0901-96f8-4ef3-883c-70869467d2b4", "value": "24576:kZ5/XY+mzo3bvF7tOxC39Ej1YMTCcmLjr:e5flmzM54xki1Ccwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030046, "uuid": "b52b8666-b773-4dc4-992c-48a56ac10ccd", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030046, "uuid": "4f1ab2fd-b914-4c88-a115-e1edd6c445b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030046, "uuid": "996cdf1a-8c0a-44ec-8d29-d5c914b86431", "value": "Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28000db8-29cc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Adwind)", "timestamp": 1662019233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019233, "uuid": "4c9db1b8-53d0-4cfe-9b9e-4a942d1b580d", "comment": "Malware payload (Adwind)", "value": "8829d5c0bc2ef5d128f209a0f1f6ec0d", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019233, "uuid": "21fe17bc-517a-4c70-8472-f92c41f89892", "comment": "Malware payload (Adwind)", "value": "bd5280577126c31d44461b4f3fa343e9237a4075a6522b89836613d235387c14", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019233, "uuid": "fbeb7b9d-dbe1-4940-9d43-485361e8dd07", "comment": "Malware payload (Adwind)", "value": "058cc3034fb82a32fc5b55b036f16e38e7269170", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019233, "uuid": "d4d7836f-8327-49e6-8dc1-8a45c4c032d0", "comment": "Malware payload (Adwind)", "value": "978950b9e25a0134f60be75da8f365a0b06544218597a3ad7f70c1dd287b10009a9bc3eeb02998abd0cf43f203565e53", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019233, "uuid": "3a291ee2-a727-4c8e-ae0a-bfe2fdfd31a1", "value": "T1A61501628AC82FB4DF98451990FE171E53F05B89801A64CEE7237D07FFAFD44920B999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019233, "uuid": "028f430d-f380-47bd-8126-dc0be99c705d", "value": "12288:NX4hRZQoHl/eXhauMpfxGzP7OlKwXencrFlUFaidZjcM4rT7MD9q6ObRKdIqY35R:QRZrqajNA7ORXNfg9dZSrddoMuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662019233, "uuid": "3066ee08-3f9f-44ac-abc8-19db5a9c977e", "value": 878694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662019233, "uuid": "eced56d8-a15d-43d1-a385-e025d938093f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019233, "uuid": "4723eaac-ad6d-4614-9d3e-e9108727838e", "value": "Outstanding invoice-Pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6b0301-2a02-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662042595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042595, "uuid": "53393a9f-d1d5-4529-8da2-564d5539de65", "comment": "Malware payload (Gozi)", "value": "0686a050a50379c181e670b91710ac9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042595, "uuid": "4032cc9e-1662-4535-9734-3558c6a789c5", "comment": "Malware payload (Gozi)", "value": "bdd23ce244610c8860a0a8aa44aa4f89b47e36b035d520959c4d94cdf65ef1b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042595, "uuid": "cc871581-e78f-4425-aec8-a2152f2d4b89", "comment": "Malware payload (Gozi)", "value": "8d0e3b9fef89d2b658ec7285012097ba899266e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042595, "uuid": "cc4ac954-b52d-4466-b1d7-63f5405909db", "comment": "Malware payload (Gozi)", "value": "5f17b86bbdc2431248091f0f5af2ab4158e74df59996e4a6631eb40e1df1b64f434c6ef0460ec898300250c38ec6cb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042595, "uuid": "32bb1441-fcaa-4a0e-b103-06677aaac0c0", "value": "T1F5344B9AA3E51599DD6BC6B5C953D227EBF374092B24C30F53B0CAA66F17722B11C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042595, "uuid": "cd011204-b19d-4889-a88d-e8798ad1c2d6", "value": "3072:m5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vFBB78C752cjne5e:m+nZ1o+NJWbn2CMFIzSTRDR1vFR5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042595, "uuid": "f01e46ae-455d-4912-acbd-46521506971b", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042595, "uuid": "975c311f-11a8-4f94-b4a7-1c5af03991d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042595, "uuid": "9751162f-abd0-4845-abdf-a6e03100c1e2", "value": "f5b0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c10e69d-29bf-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662013845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013845, "uuid": "3d51abe6-a508-4f5f-a3a0-d8639c8f8eea", "comment": "Malware payload (RedLineStealer)", "value": "39e5725ee5133630cbc625e4e0cca494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013845, "uuid": "1056adb8-110d-4b78-8f6f-cddf50ba6a6d", "comment": "Malware payload (RedLineStealer)", "value": "bf3a1b2e79a4c242512126a1d7ec6caff97f2c3b53745f0ea7820a5fe190e114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013845, "uuid": "d6d1c5dc-9546-4619-a08b-f824f50e6c26", "comment": "Malware payload (RedLineStealer)", "value": "de42e150203bb5360b4795c12fe4be507e38cc57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013845, "uuid": "6a8332e4-4380-485d-8ffd-f5a2aa1e0a1a", "comment": "Malware payload (RedLineStealer)", "value": "50f04afecc69f1bec18ee3734e0acf6358ce7fda16294ebe5ce973f828f3834b5e091ffbf8a7fe32b2be3747e5abccbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013845, "uuid": "f4b59be6-109b-4ebd-bab8-7d733930de68", "value": "T197E4D10EFAA6CE12E1A41B33C2E196544335EF0AD123DB4B75C953B55D433AB8C87B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013845, "uuid": "1500c745-c441-40f1-8b72-358fbf53ecf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013845, "uuid": "1db859a2-1a7c-4326-8eb7-7778b6560a28", "value": "12288:/1qTG2bYQ9YyWNBPg82C5F75eTG06facUWZYcqno0LDq2fxrsBi5zT3Wv3:6lY/D482C5Z5RzaiYto0L6iFGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013845, "uuid": "d3f7a62d-a90c-46aa-864a-a0453de3c2b2", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013845, "uuid": "7e6d3966-2174-4176-88c3-01deb2c362be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013845, "uuid": "25a91e55-38f8-483b-88b7-f85fd5d27604", "value": "SecuriteInfo.com.Variant.Lazy.239269.8927.902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23333baa-29cc-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662019225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019225, "uuid": "d779ca05-b1a7-4332-aa7b-9075cedff291", "comment": "Malware payload (RedLineStealer)", "value": "e504fa8e9d6d7787c86c873797c21587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019225, "uuid": "4940ae9a-54eb-488c-807b-0ec1785547b0", "comment": "Malware payload (RedLineStealer)", "value": "bf9714f60c2b4b43cc0383b3155d9c737271916032051df041fed54d34f7c765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019225, "uuid": "651befd2-416e-4243-b696-62f3e4ab1bfc", "comment": "Malware payload (RedLineStealer)", "value": "ac0634851669fa7acb7a18e1525fcc5034602db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019225, "uuid": "5fb8302b-a231-4488-b532-ed46059ea344", "comment": "Malware payload (RedLineStealer)", "value": "6bfab1687accf64c79886f64e42df8051cfe7bf3522cc99b56981974fc9f10baabad42c5b40e32254d92946bb0391772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019225, "uuid": "6f61daf9-c973-4984-b0b8-4199d8edfbbc", "value": "T13F66339B4B396373E0405E713949DAA2C2DCAFEEB4A4434917A0D20A97C1BECF51D7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019225, "uuid": "7431ccb2-52f2-499d-b2ac-3d932861ebbf", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019225, "uuid": "86bbbf1f-e853-4b18-bf39-54830680b372", "value": "98304:y2Q62Cxm/pORE3t5DuflT26DHyFvCUZu50S/9/Ja2ImQKkw3iBKvrnZ7b09kyFx3:yByxQeE3AlT2OTb9/NIiJ3vjnZXKLJMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662019225, "uuid": "4e9f57dd-864c-465f-99d7-16a1d0f9956c", "value": 6538235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662019225, "uuid": "069cab98-3dcf-4b2d-bc88-7e9635c9baae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019225, "uuid": "0a6172f8-3b05-407a-a3b1-ec066b5762be", "value": "BF9714F60C2B4B43CC0383B3155D9C737271916032051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0032827c-2a1e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662054385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054385, "uuid": "ea9f7697-60ee-4f6c-a70b-8a92fa4ae27d", "comment": "Malware payload (AgentTesla)", "value": "c920bcf7062ce7ecd4bc9d77a86d8781", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054385, "uuid": "94dbcd89-a5e7-4a46-b9cb-325e09a48dcc", "comment": "Malware payload (AgentTesla)", "value": "bf9f34c708b359c54b3c386f8ab7be3a215100b0380c40bf700db02232c7b6a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054385, "uuid": "7fd365fa-2b86-4f55-9fc4-05f71418917f", "comment": "Malware payload (AgentTesla)", "value": "861e39cced683d1a7f85bf9be03a87d65cd23a97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054385, "uuid": "1d8e100b-6688-4cb6-b99c-03bd84f5ab24", "comment": "Malware payload (AgentTesla)", "value": "f2b8c7749e13512976ed4ac7fcfb7c984c4b6170e8988dc9e3b7a8fc340cac43a20ace1964bc07c9c723cbab447de446", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054385, "uuid": "411c1be9-2e61-4df7-bb46-b0e55b6fe344", "value": "T10435122E4A994B11F4543AF401B0F15083FDAE295474CB868DF8B3F428F9B5BDE06A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054385, "uuid": "a9bce668-aaa2-4cbd-bf04-b2f37f523156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054385, "uuid": "407111df-028a-4604-a46a-39e704b71261", "value": "24576:BEcAZ5Rx8EfjoXY+mzo3bvicee/Ss2ZW+G:u5R2E6lmzMq12i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054385, "uuid": "a239a872-85cd-4afc-b7bf-7c471d5fb8d0", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054385, "uuid": "2b2a7821-a8ba-466a-86ee-ac573288ff18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054385, "uuid": "1b0917d4-7141-456f-bc10-6a23c7a07c63", "value": "BBVA11094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c20a65f-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032179, "uuid": "3b670ba3-0613-4de6-9ee0-093ff33bc6c8", "comment": "Malware payload (Mirai)", "value": "ea8bff4d01029c8b15dbcea4c2575192", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032179, "uuid": "aea4d347-c7cb-41a4-9cb4-661699b176b7", "comment": "Malware payload (Mirai)", "value": "bfb263b54f3bd550e02932ffcfd4401ae8671ae477973c4168f8b7b01697e240", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032179, "uuid": "4ef643b3-2532-4730-94be-73d9a9cc6d98", "comment": "Malware payload (Mirai)", "value": "7638bc7e7feaea2d3c6d243505defd71f88e9d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032179, "uuid": "23ae56af-b85d-41a5-b1fe-d360be9dff63", "comment": "Malware payload (Mirai)", "value": "58e7fb17c0f450ae0a3d66022b115be2210bd2399cac9ab57f91da807b115f3f8d4a2ed147b4bea18b6023f0f2058e93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032179, "uuid": "eff65c25-b993-439f-ae72-73a62409d90b", "value": "T1D433299BF4069D3DF94BE6BA94170D09BA3123C051830B2727BBFDE36C321695E52D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032179, "uuid": "37621144-ac6f-4286-be6b-711bc21ceb5f", "value": "768:UZeIVUhZQ0a7zKhox8NiSDFfDLUuf878vdZT7FN4fXa7QIoIVuxIpV:W3zKhouL9f872PFN4fK7QSuxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032179, "uuid": "032f77f4-247d-4fb0-9686-48252a66962e", "value": 55012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032179, "uuid": "78310886-17ee-46a4-a4ea-0813aab2f7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032179, "uuid": "e7a1ba89-db69-45ac-a067-da2805dddd3a", "value": "ea8bff4d01029c8b15dbcea4c2575192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914cdfe2-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1662043891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043891, "uuid": "f8b10814-44ee-45a5-90dd-f6030ef07592", "comment": "Malware payload (NanoCore)", "value": "39f910f7a8ae96d079f760b5c1d6f6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043891, "uuid": "adde22ba-150e-4819-95c2-c0a148e66ee0", "comment": "Malware payload (NanoCore)", "value": "c04139b7041abe85106f3929b1976eece59567258838b96379b2dbd54bb0bfdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043891, "uuid": "ab1105a7-1d9b-4ef0-aa87-fc3b3097e3aa", "comment": "Malware payload (NanoCore)", "value": "f297bd5dac681214305b12afa58ca6f7d51c7c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043891, "uuid": "dd9d00d4-6200-43b0-a2f8-250d1fed94b9", "comment": "Malware payload (NanoCore)", "value": "d763aa0d968cb1bafd88fde8feca170ce3117a2d3d417d8852377731da6980a5145d856990f1915871f50fb3bc4b9de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043891, "uuid": "cb0d84ff-f720-4483-adbe-987b52ad18be", "value": "T12B15128FD1C8AF16F4AD073A52F2F70242B97E0A51B2D7985DC9F3F024F931A515AA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043891, "uuid": "ad371893-45ef-40ee-9495-4c4f813440ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043891, "uuid": "313e685e-9974-4324-be12-53936f91a860", "value": "24576:ZZ5jXY+mzo3bv6CrQu8QyinvRSOg2BrtQt:D5jlmzMi+QNQ3SO5yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043891, "uuid": "25d6089f-9341-4a05-a430-1cde11dfcacf", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043891, "uuid": "524a611e-afa1-4f19-9f1e-254b378756a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043891, "uuid": "1f015e17-1558-4d69-8474-865a7515080f", "value": "39f910f7a8ae96d079f760b5c1d6f6b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00273925-2994-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1661995115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995115, "uuid": "580a7375-e70d-4bb3-b480-162dd4d93819", "comment": "Malware payload (Formbook)", "value": "ca3e239cc7e8c7237580439f38e26490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995115, "uuid": "ec0322a9-7b93-4e6e-a6d2-4e69bfd10329", "comment": "Malware payload (Formbook)", "value": "c0c33a073d10f2539d6a13c5bde340744b659aad48575af23f65b67b1dfc454f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995115, "uuid": "b16ae6e1-65c8-4690-adc0-6eef02e8d21a", "comment": "Malware payload (Formbook)", "value": "82414796559b32f2abc1509ea7b814a4b30296b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995115, "uuid": "d2aa5934-e134-43ff-ae27-063075d52d1b", "comment": "Malware payload (Formbook)", "value": "79837f66b87b2403a95bfa8e8ca6eab958dae242cfbd49389a67d31b398d619096f0b0b4679e4331bd509b14140fe0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995115, "uuid": "8b262b30-239e-4a0d-8a04-0a3c222e0aaf", "value": "T166F4E00DFEA7CE12E2A51B33C5E1A2044335AB099067DB4F36CD63B519433AB8D8774A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995115, "uuid": "452b24bf-fe17-4d3a-8549-a19a058ea51e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995115, "uuid": "29b1ce18-e9ea-4f5b-8607-9bf0200dc7ee", "value": "12288:7gUOCreBu7ZpfhkQF75eNGcU5DG355rb5oAx5JXpzp6m8T75k+m03fZlewjdoqHH:dABu7PfhhZ5vceg9bGAxDpN6t9k+PHeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995115, "uuid": "82e7a3e1-96f0-4626-a2d7-f8cabe4d2860", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995115, "uuid": "7197a945-4c8c-4001-b173-53a57a4c295b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995115, "uuid": "e2059519-4338-4096-ada8-900d7b1be49d", "value": "Inquiry#8899006720220831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54275285-29f9-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662038635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038635, "uuid": "a401b7c4-f2a6-407e-9df3-5f7db76032c5", "comment": "Malware payload (SnakeKeylogger)", "value": "23d9a34690d5da6e4c2d370572638fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038635, "uuid": "c01cc943-44c1-4e7e-979d-4989626dca7f", "comment": "Malware payload (SnakeKeylogger)", "value": "c18fa2c004bcb50d1d52013a1b96af882e0dec4f4a2b8372015cb624b3951ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038635, "uuid": "61ff6af2-74df-4066-bbca-46c1382009a8", "comment": "Malware payload (SnakeKeylogger)", "value": "1eda7310155728f6c6734731bc43c891b8edc6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662038635, "uuid": "2ea55ff7-594e-4067-ac17-955e07be6639", "comment": "Malware payload (SnakeKeylogger)", "value": "8b6b9908c043b86a856e990adc7d769710339d79940183265abb0eb18d6899b8f8a28646c21f026599036f0c8e8e4b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038635, "uuid": "776c5769-1aeb-433d-8826-d2882c610cd4", "value": "T13E041831EF76D08CC938AAF8EB35A38ACD471F10687E9ADD235435AD0536972A7CC491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038635, "uuid": "6c7667f0-f23e-463d-81d2-7d77f6e6ec76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038635, "uuid": "08bf5aea-acb1-449a-9131-05c12c236394", "value": "384:gwFZL9AmT7fE24Mz2/s+Xd32Da6s2aaaSmU7juQGMmxvaFv:vV7fczk+XQDa63v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662038635, "uuid": "870a30e2-d042-4c27-9b61-17efcf43bb3d", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662038635, "uuid": "0324663f-9b4c-452a-9517-bb289b49610a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662038635, "uuid": "5383c864-a4a7-41cf-8bc6-42e26389e528", "value": "VQ88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76058f83-29de-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662027095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027095, "uuid": "f1fa4c62-006b-4a4e-946e-319d1e73dba3", "comment": "Malware payload", "value": "c49cc5a5108a8d00ba44c31f00f42d23", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027095, "uuid": "a93aa2a0-c548-4455-aa30-f053e84671dd", "comment": "Malware payload", "value": "c20f54b34b352d8b0c72a95447d7cb011ece5a561d504b32fb5be34ed45fde49", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027095, "uuid": "7a5a76eb-ea5c-4d69-b47e-435a494b8c89", "comment": "Malware payload", "value": "4c159fa0cef832bb618cdfdf17800b1b68ba975e", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027095, "uuid": "3c0210f2-4c40-4281-bfd3-89d6edba5520", "comment": "Malware payload", "value": "bb704518395e8b5ff66dd2ebcfb332b2375d7cd00c16f55e366ae91e13f2df2ff6511918d6f9b97130ec554b6bb4fb6e", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027095, "uuid": "f388b3ed-a248-4188-852a-ae8008e8208c", "value": "T1496633188D13AECACC44063A5D6F0F603BEE8659D50877578338D43FACE7FA43A6A951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027095, "uuid": "ee56175f-b58a-4333-a427-bc352913e934", "value": "196608:PgNlL/d/dNsymA4ZrNmHMsfJgUsbiFsOncRryotc7x2:Md/0yJ4ZrI3f+2sOcQG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027095, "uuid": "b5451c61-981f-4d6e-b72c-42a58e4af670", "value": 7063246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027095, "uuid": "d0efc49f-2206-4990-abf0-c79263cc5fc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027095, "uuid": "201390a0-0d41-4530-a1f3-51a99ff532c7", "value": "new22_out.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d1cb6c-29e4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662029502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029502, "uuid": "d51d8fa4-2865-4fb5-801c-b1585dd999a4", "comment": "Malware payload", "value": "0ad59c21e1867471db8c63ab8f28bf68", "object_relation": "md5", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "Google chrome", "colour": "#63FD49", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029502, "uuid": "92856aba-d30e-4572-859a-56cd3b36646d", "comment": "Malware payload", "value": "c24122706430a211b1eeca2646fbbc888367d459fad36b7382b01a2ceb9f6543", "object_relation": "sha256", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "Google chrome", "colour": "#63FD49", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029502, "uuid": "a5c17985-3bd6-42b5-bb82-6c928d4b6e85", "comment": "Malware payload", "value": "db951ab093060cd5326e65e0107c53115c94ceb9", "object_relation": "sha1", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "Google chrome", "colour": "#63FD49", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029502, "uuid": "c0e7d123-31fe-4e9b-b14e-7513fca7473a", "comment": "Malware payload", "value": "6a231792a3a8ef4c52685b2bd1562b7afe68c71faaf49b21d785f83b21d4647b7dc94bf107034c6c591e94181d799199", "object_relation": "sha3-384", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "Google chrome", "colour": "#63FD49", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029502, "uuid": "43d1c394-2a13-46e4-af68-9460b6f8d369", "value": "T12E14125B9DCF44EEC647403EE61A64427B28946DFF9EA00308A40E1F90795578B8B9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029502, "uuid": "d14d49db-bee3-428d-b161-12ddf4075797", "value": "3072:R8Sjz6MKhhH2sMarshT8+aYWif9OiHiQ+JkF1bLHt/g74l4Dfu8KMPtli8I1QO8i:uCmMAh5MZXaY91bHiKnHBctH2l1d8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029502, "uuid": "c9178432-857d-4a46-af94-232168db55f3", "value": 203236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029502, "uuid": "4cc32f40-9937-4e8f-ab8f-467d8e771bfe", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029502, "uuid": "9ea6d669-338d-4d1c-b07d-b0ab2bfb53e5", "value": "mmnbenehknklpbendgmgngeaignppnbe 2.2.5.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1035700a-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662018335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018335, "uuid": "5b22ccb1-e79f-4982-8e88-8a11572ac3fa", "comment": "Malware payload (RedLineStealer)", "value": "af77113f5a7fedb831d216c65ca3d656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018335, "uuid": "54bc78e5-cba8-40ba-8e88-2bfb4bfd79b0", "comment": "Malware payload (RedLineStealer)", "value": "c245783f49aa0024f494ded09826adcc74890a3b68def9cede61325c986e7666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018335, "uuid": "79b092e8-6d2f-429d-90ea-21f7a1097700", "comment": "Malware payload (RedLineStealer)", "value": "5da5c6815037a8bc6b769664b1a0f966bea97450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018335, "uuid": "ce45a04d-4df8-415e-a137-f5def97f35ff", "comment": "Malware payload (RedLineStealer)", "value": "f541d050ba52d3ae5f92b9c2fa70dac550dccfbd3c1954bbf40aacab6f78e3e44054dd54912f6b437f7146984de52e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018335, "uuid": "5ffb2e76-a558-4bf2-8030-c489469c4f7e", "value": "T16A157D10E742D06FFDA214F39A3E556AB6289F70070524CB77C8AE5E77762C22E31627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018335, "uuid": "8fd7a1ac-466c-4e6d-82dc-e9629d3e5714", "value": "48543d588438d9c198c03feed0b52f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018335, "uuid": "56a69e4a-000b-4cb8-bdd6-346ce5da3492", "value": "12288:cRTqIuwbIYlFDi4jDJnaIOQlIWGXvF9UdWDIzYB0qyFgwFNsOpnh+4OHV4cOJcPo:VsUW8rsAFlwYBFyFdn7O1NwsaM91ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018335, "uuid": "4e9ff0c1-06f1-4b25-92a5-51a5521b9b54", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018335, "uuid": "d3dc4b96-0f8a-460d-8d0b-ec437b9af6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018335, "uuid": "0588be4b-bfd4-4ac2-94f7-4085db205773", "value": "af77113f5a7fedb831d216c65ca3d656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e8dc7-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662027794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027794, "uuid": "bfd03a3a-8c71-46e0-ad5c-4ffbd6d29a85", "comment": "Malware payload (AgentTesla)", "value": "76d63487711a1fb8f489dff34ab9370a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027794, "uuid": "faa673c7-c551-4d8b-979d-c43b45d76de5", "comment": "Malware payload (AgentTesla)", "value": "c2ac2c5ef21e352a33a35d7fb7986b7b349f2eac3df0f02476c11be739fd1608", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027794, "uuid": "429cb8d4-4c43-43ac-8504-4d790c5298ad", "comment": "Malware payload (AgentTesla)", "value": "c35dddedb5f1f935932bc5b53d692efc70120119", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027794, "uuid": "c56939bf-10ec-4def-9ac9-c50e72c99e81", "comment": "Malware payload (AgentTesla)", "value": "c26a7e914c6cd4b8d4a09b7e6aeeaeeebd9457563f38744ea8237ea04a4fc411fef551112047c26d029a788a47350d23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027794, "uuid": "424a3cb0-f9d0-4df4-a556-37cc6b0d916d", "value": "T1E6E49E8377503A96C16CB7B30276A91053BDDCCB854AE20525CEB96A27772F05DACB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027794, "uuid": "0c954955-7307-4c90-a27a-a2231df5a88a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027794, "uuid": "f4d47386-6a4e-4ddd-a3ae-d472a325051d", "value": "6144:RKjW8FyJlvkLVTRNVubcKYXH++pWE8t2TIs/e6H09sAqAGP9vAbhk/v/VrmWfRF2:RT2RbKAlpWE8cTLeb9hcv001mWf72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027794, "uuid": "e55bd0e4-c3d0-4c85-9e23-f19aff71f3e4", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027794, "uuid": "3183e721-4986-49fb-916e-fd82b7bfe611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027794, "uuid": "c63f4262-4255-4f40-8092-5351f0b4d852", "value": "MAERSK_AWD_098376543567389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c95100-29d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662023500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023500, "uuid": "dd94cd2b-dfc4-4f94-a5ff-0df8031aecba", "comment": "Malware payload (AgentTesla)", "value": "92110e9ee978f716ea2427645c63e5c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023500, "uuid": "33c90da9-fe1b-4e49-8371-65f09a2eff80", "comment": "Malware payload (AgentTesla)", "value": "c2bdf620af86889b4a416d4cf6ad2e35d9cce5191398c9dd5f7a751c62599741", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023500, "uuid": "38ac0141-4cd4-4dc7-9dc9-d830fef6e3cd", "comment": "Malware payload (AgentTesla)", "value": "402ac8c69820c08ec12a5f498447b8291fed70b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023500, "uuid": "5e1e0030-cf08-46e5-8f7b-7483adbe787b", "comment": "Malware payload (AgentTesla)", "value": "efad0a40c94b0d7b18a472cb203b2e2340bba296bc0c0ac5d175118931ef7a9d0cf09c454abcf8d982cc534d5a4ce150", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023500, "uuid": "85755e27-bf6f-46b0-858d-a0fe4fe0f3ea", "value": "T1A9630212EFB00E4549CD1B981C8F9E756648B39EDEF15A3EF1823ADF906D39927B0060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023500, "uuid": "bf7a9699-bca8-43ee-95cc-12fbf284a4c4", "value": "1536:nggCMjM0saBb9ulQyU94ZpdOgV3DwKd0+XQsUv+0WMj9Ihjzb8:FgubolQy7JOgV9dPXLUWMUj/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023500, "uuid": "df80cac2-5bd9-44a0-984d-aea85cc5a113", "value": 70262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023500, "uuid": "e6cfdf37-9587-4cab-8c21-7410631fa520", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023500, "uuid": "8014e0f5-3326-4656-90b4-1308abbedc2f", "value": "Products lists and Specifications_xls.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec29880-29c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014440, "uuid": "87b740cd-aabf-466e-a6c5-f8111e8aa91f", "comment": "Malware payload (Gafgyt)", "value": "f0454164f14c45c1087c924470fd3e5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014440, "uuid": "42560795-eaf6-4d26-97f5-4ac8995a5ed0", "comment": "Malware payload (Gafgyt)", "value": "c2f157a9cd678ab191627345d5d97c1a4a9ff23e7f7a0eea3f103f9e4ab06477", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014440, "uuid": "20dfd0bf-a123-42b9-9eb6-301fee97c1eb", "comment": "Malware payload (Gafgyt)", "value": "52dafdd68a49c7577fbd379269a319a926e3783f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014440, "uuid": "2d24054e-51d8-4d5e-ab0b-12dae5213495", "comment": "Malware payload (Gafgyt)", "value": "14952b78a67a19aa3a02667802f3c82b133622148b5e2260cb58b12372231837428ed23fb7e3f90a919607dad10c71c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014440, "uuid": "c4ad939a-e41d-477d-afc3-cdb9b3bf673e", "value": "T15E733947AD658FB7C056AAB525A359300B13F8215F0F2B89713CAAF8470F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014440, "uuid": "c5607d92-dabe-4d4d-95c3-70416c27afac", "value": "1536:Mwy558fBKepVIISJgtxqENpcC+S0oJismj9VqYLe8f26e:fYifIexSJgJcVS0oYsmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014440, "uuid": "522958fc-5b08-43e6-85a2-b0e2f76d28ea", "value": 77750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014440, "uuid": "e70709a1-8081-4c87-82c1-f809ebed78e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014440, "uuid": "26e30357-879e-48fe-b9d7-aedcbcf566fb", "value": "f0454164f14c45c1087c924470fd3e5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4719a3-29a3-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662001609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662001609, "uuid": "9ab87d9e-3884-4b2f-b954-e1bd50e81799", "comment": "Malware payload (AgentTesla)", "value": "8f49458473128860c28b837e790e4c86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662001609, "uuid": "6d749745-dd90-48e5-99bf-537450d94d17", "comment": "Malware payload (AgentTesla)", "value": "c386efbc5c84476093425ae36ca7f59cc724cb8589591c4741eea19e4a5e90e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662001609, "uuid": "72de523d-75b8-45e3-8eb3-5a81ef3be6cb", "comment": "Malware payload (AgentTesla)", "value": "f4335b25fa617343261af5cdd4237588a24fc9c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662001609, "uuid": "600c74a5-3589-43de-b188-03cb277695be", "comment": "Malware payload (AgentTesla)", "value": "b950b82ee5b27b61e1bd777ec3b3a57e9f3d41fcd7686aa6f0d683ae545b10a9539bf99f02c71a2a7728d95bcad4ca98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662001609, "uuid": "2483365c-3099-416f-8fc3-96d2c9689009", "value": "T1F3E401B937BA5F19DA7847F64870408153B5A12BB697E70F9EC270CE6D72F696300A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662001609, "uuid": "5ef8e7df-3d5f-499f-8c9d-e06f7e2d2aee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662001609, "uuid": "497a230d-f25e-4f36-9ebd-ca16e5d0fd85", "value": "12288:85j+N7u3XDG2n8A4Xhaun4/wTGIRgwm3c123O4Z7s11:S6NgG2n8AmYwm3cU3O4Z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662001609, "uuid": "7ce3fca2-a150-4434-a395-bf195f1a3409", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662001609, "uuid": "901218dc-78a3-4a8c-b585-b33201b5e7de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662001609, "uuid": "ba809924-114e-4408-bd41-76d214a8a270", "value": "BALANCE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f335a885-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662044056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662044056, "uuid": "6e559a59-9232-41c2-9ecc-6e060890e8ec", "comment": "Malware payload (AgentTesla)", "value": "720549e7133f6f372c15ea610febd85c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662044056, "uuid": "3003478d-5206-486d-8e91-c9174a63d58b", "comment": "Malware payload (AgentTesla)", "value": "c4566d765a8aa0f28acfed9141b570166f9bd759350d54ddb0480bf12387332e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662044056, "uuid": "f8462491-6f38-45a7-bb35-99c78eef3208", "comment": "Malware payload (AgentTesla)", "value": "a7af0f625376505b921e7172e7b1111c9b310f46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662044056, "uuid": "733cd7ff-e5a6-4f24-b850-0b23d3c40e0d", "comment": "Malware payload (AgentTesla)", "value": "57e27388bb7f84cfece5e1c482d04a4d110d0654a9de7f81c0909b0d1ec60b7e73ddd1db793c656beee420a4f3e7a6ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662044056, "uuid": "9b835b8e-d64c-48ce-823a-49ce17faf6e9", "value": "T1BAF419ED76A075DED427D4729AA86C78FB91B47B870B82179027129DEA0D8C7CF500B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662044056, "uuid": "c7afd52f-5336-449d-88ce-0ed810059342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662044056, "uuid": "242140da-7889-4d39-ae9f-edcd5c2617d3", "value": "12288:p+2iN2P9wPrg1Gq1mwiyw8JjLFeeh7C2DFIZ+OXqTSwj1mNV3bqwb9mW+N9suEQQ:p+18x1GS4ywiZee1C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662044056, "uuid": "2aebdf8c-c028-4f9f-996e-47c43d36fa8b", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662044056, "uuid": "361c1d94-55b6-41a7-bdae-f94d76b0ac1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662044056, "uuid": "28c49500-fa85-4960-82de-4eec17440f27", "value": "Change Bank 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f7ac9e-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014452, "uuid": "3d3c7411-f34d-4a19-97d9-91ac13e72a23", "comment": "Malware payload (Gafgyt)", "value": "ce6823dd33cc10e007cf2e2b76b17f1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014452, "uuid": "b5139bd1-eef7-4ad3-8d64-4a08be8912ba", "comment": "Malware payload (Gafgyt)", "value": "c6425ca0080a56d292851a12e7b376a3e113b80a679159de9cff62e5e0bd93fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014452, "uuid": "8459cbbb-ef86-4250-883f-cb2af42dc121", "comment": "Malware payload (Gafgyt)", "value": "216e5fb9554f2f0ea6a18513c5bc24f536eb0ab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014452, "uuid": "7538e5cc-b67c-4c35-8cb0-87dbbdf08f96", "comment": "Malware payload (Gafgyt)", "value": "e355651889dae87e6834cd409e8c151b547061f451736da74cba59b14cc317885fd2e05da35e788bec3e56e09b0e9874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014452, "uuid": "25a45e2a-1ae4-4a45-b443-e49122fe1ca5", "value": "T113931A41F9408B27C2D227BAE79F439D37366A5497D733026A257EB42BC27DC2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014452, "uuid": "66598b53-4c09-48d6-99d8-f893e72e7d47", "value": "1536:cQkE9VQPAWV83kb8Cw2HxD2jw50rOLEvTpPzRxQMDoicKmbNNA+mCVrQAFW9OXkz:hQR83rGh5OTpPNSKuY+mCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014452, "uuid": "575dc6e7-fb12-4d89-a687-0da0aa638d70", "value": 97531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014452, "uuid": "d2b0c01f-47e5-4eb7-9a3d-8d8fb1cc5a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014452, "uuid": "5ba03852-d34d-43c8-a42a-b53c21eb5567", "value": "ce6823dd33cc10e007cf2e2b76b17f1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271686d5-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (StormKitty)", "timestamp": 1662018373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018373, "uuid": "54ec28a6-b4bb-424f-b32d-c97ab562e84b", "comment": "Malware payload (StormKitty)", "value": "9ff132c364661e1139e8064c536ca67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018373, "uuid": "b16b687d-ac37-45fe-9bcc-0eed83452a7b", "comment": "Malware payload (StormKitty)", "value": "c68294e867c285f5ec14441b9af0ac662a3b71822ee9432d82e6dd07e41778a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018373, "uuid": "bec5cb07-6ff5-4696-a7b3-346b69f0a760", "comment": "Malware payload (StormKitty)", "value": "e5c18362018b99ae688bdecd77c333c3088673a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018373, "uuid": "6812e2ce-4382-4243-a3f2-fc738e0eda46", "comment": "Malware payload (StormKitty)", "value": "285f371e55c4470ccef0bf110b0115fd280254890963455ce25df94bd6061d7a0bd0bee411c8e6a1dac3782992a446f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018373, "uuid": "2c924eb3-8d53-46f6-bc88-6267513316f1", "value": "T150B29E42CB544A23FD76053A197B19194368F93FDE62EB6E2484650F8D97742C872F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018373, "uuid": "37961742-2f87-4423-9275-eb4378572d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018373, "uuid": "84a562fa-fc92-4dfd-951e-166a95af89f2", "value": "384:hDBL3eKUFxi7RRLRIILxEUaNePqRpimmtIEQ675TKn8Svod2JzFlXYmnZzjcNrb1:hDBLaxi7RRNvLxOzRphL6lu8SvoYym0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018373, "uuid": "856f1566-f561-4d62-9e3d-bb419cfacef0", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018373, "uuid": "080bf143-f9eb-4f72-be54-a589843c828f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018373, "uuid": "fdc72b43-465e-491c-85c7-d59f9b367854", "value": "doc20220901 0200222 -0222.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397afdfe-29e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662029141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029141, "uuid": "94b4bfbe-84d4-4b6c-a35e-988c0ae027a5", "comment": "Malware payload (Loki)", "value": "66368359439e5ebaf858e0640595fa49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029141, "uuid": "77f61e00-d566-4634-93ea-ef3ff5ee92fe", "comment": "Malware payload (Loki)", "value": "c701da1f643ef9d3ec0b162eb5771c0315bab8e529313c42b314c149aefa0147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029141, "uuid": "cd66eb83-ee6f-4972-9064-ff9ee5e17b96", "comment": "Malware payload (Loki)", "value": "daf2ee9f622b69de8cf16b2f490d362767b60466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029141, "uuid": "d22f5619-1a24-49f8-8985-36fff59f65b1", "comment": "Malware payload (Loki)", "value": "524578eb7909961d08f9daa19ce2f819e6378796d8c873fafefedfa52fa1082b52e5d4790e7027611ece484114f14a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029141, "uuid": "4b7497b8-fe98-4567-a313-4756412f416c", "value": "T11005129F9284AB13F4980B3966F0E70643BD7F1550B2D3999EC9F3F425E836A8457B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029141, "uuid": "142693dd-51a9-493b-bb29-7c92f075ccc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029141, "uuid": "51cb8595-4945-450e-a921-31397133635d", "value": "12288:eF75eRgPwqoXY+mzoRtbvRT7JAJ4UvE8pfofeANe2CDXkCq:eZ5kXY+mzo3bvjk4u5ofcL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029141, "uuid": "16aa8e45-ddee-4f3a-9509-cf3502b11257", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029141, "uuid": "adeaf815-abe5-4ebd-a3ad-820ad2339c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029141, "uuid": "46e7fe14-669d-496c-8f6b-c8291b9b3c52", "value": "PO 45015198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f75523-29ad-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662005890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005890, "uuid": "0e19b901-9880-453d-af52-2c3ee1f34c31", "comment": "Malware payload (Smoke Loader)", "value": "bd6f0117e0ae2241fc54488bf9f9bec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005890, "uuid": "87c8ba20-f000-469a-9b10-14a627a2424d", "comment": "Malware payload (Smoke Loader)", "value": "c71fa5e879e3dce871883eb601fe5352ca2c202a094597797cb59236d4cbecb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005890, "uuid": "3161f080-3c7f-461a-a70c-971c1a44ebff", "comment": "Malware payload (Smoke Loader)", "value": "f65af45d909eec0cf3288923f545548f0c5c5d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005890, "uuid": "69ff7b92-855c-409d-b4e1-3d40f9f263f0", "comment": "Malware payload (Smoke Loader)", "value": "1d11b919326d61ca1dd3136716675d8793fc1ac82b1a5e96952cbbd0793b6d71b6d5b9ddf5db76b8ccde923b14859005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005890, "uuid": "2f27221e-1c96-45bc-b4cb-5314b86cea8d", "value": "T17254E002B693C7F2C43A54B0B720CF906ABF543C1574458B2B79262E6FAC6E19E7531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005890, "uuid": "e977fb70-b8c1-4541-8085-a77759a421e4", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005890, "uuid": "0f27ce26-83df-4324-b563-9b9b47ac67e7", "value": "3072:WXkFzD/RdG/LLm8C3Pn52Xm0H5jHQbDgm5h4da5wN9xJojU:+f/LLm1n10H5HQbDt5hvONOjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662005890, "uuid": "5ce67109-38ba-414c-bbe7-2faa7717bcbd", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662005890, "uuid": "afb0dcf2-54f1-4d1a-b636-3f00d2b71e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005890, "uuid": "d081dd84-aba4-4521-b0e6-332ecf712251", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1f8805-29e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1662029738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029738, "uuid": "92f39650-8da2-45d9-a611-59b8c41acf34", "comment": "Malware payload (njrat)", "value": "3473171358e6b2e29c07bfa6a0e47dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029738, "uuid": "c50fc409-6d4f-4bec-bb64-08c812759169", "comment": "Malware payload (njrat)", "value": "c74dc5b50da4617ae80df6ad6cc714c690370cbac439f1f3b568f9a40de2571c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029738, "uuid": "f9d53365-12dc-4f95-b0e6-9a9269643679", "comment": "Malware payload (njrat)", "value": "499ccd0bb365bee3f1dffb8a0da30a6607b9990f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029738, "uuid": "4f8586f8-193a-4053-84b8-f0d16c29a94e", "comment": "Malware payload (njrat)", "value": "121ff8a503bb9dc8f5e88b8d130131730460f44aa6d597886bf8570cf10b4c18dd162a2e19c8c033e2dc0af8868c263f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029738, "uuid": "9637718a-534a-440d-b15b-1bb5fb8c28fc", "value": "T1A3032A4D7FE18168C5FD067B05B2D41207BAE04B6E23DA1E8EF564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029738, "uuid": "df2a62e9-99ad-41ac-9210-27b6b78ae567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029738, "uuid": "1c8f2d2f-3fb3-4275-acd4-bd19f276ed8f", "value": "384:tNaIiutjtD+P3V+y0bnu7ytflgs+SiVrAF+rMRTyN/0L+EcoinblneHQM3epzXAP:vVmV10bnu7ytCVSyrM+rMRa8Nuy1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029738, "uuid": "bde8dc7d-009b-42d9-a649-e3c6e675a96b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029738, "uuid": "516224b7-0fbf-41f5-b110-2dffe8625635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029738, "uuid": "fb6e4b31-b81d-4210-9b0c-e6f7d40d09ff", "value": "3473171358e6b2e29c07bfa6a0e47dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acd8516-29b7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662010219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010219, "uuid": "cbdc44a1-52f7-49f1-9539-492ea09c26d2", "comment": "Malware payload (Formbook)", "value": "1a7ba8cf45d895d4a8462487751be977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010219, "uuid": "fb569e2a-95b2-4bb7-b7ca-6d2e07cff0b8", "comment": "Malware payload (Formbook)", "value": "c78af223c110c4d0654f0e160ff56dfdb80a3db702cef393ab572edbdc6353e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010219, "uuid": "bba6ada1-6183-4247-a39e-d3075428bb0a", "comment": "Malware payload (Formbook)", "value": "3b1c7a742606f163123f8cb3cabbe66455c09f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662010219, "uuid": "482761cc-91c4-43e5-aedb-c80eb7757f13", "comment": "Malware payload (Formbook)", "value": "d9396c4f970f8825ddb3d43954583f195a1ea61e9890d47893d9d6dd2a7f5b910dda6dc2218858c6c0664341ad4e687b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010219, "uuid": "1f90105f-6006-403d-8483-5953ccb1b4d2", "value": "T12B350245D58883E6FC2607B01572F52492BA7E29D1B1C2DCAFCFB2E846B77426217E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010219, "uuid": "b6b16d56-1d95-4d09-a5fe-6584219cfb2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010219, "uuid": "26536d85-7040-4d60-840a-8c4cfa9bbccb", "value": "24576:mZ50XY+mzo3bv+3tReyoqIJcnoQxgresKow1tY:A5ilmzMstRJPk09xgar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662010219, "uuid": "190e0ca9-c038-4dec-b855-1651ab87cf25", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662010219, "uuid": "15a94728-6fca-460b-9fc4-fba6389291e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662010219, "uuid": "cf62ae5b-22f3-4dde-913c-a1b7b9d2cf54", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18921.17220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43823b8-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662022153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022153, "uuid": "0546d075-30af-4957-8cd2-0e3bd55a7316", "comment": "Malware payload (ModiLoader)", "value": "8b6bad66eeadb1f51632c3b33debca11", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022153, "uuid": "9fc026aa-b319-4e85-bd03-e1853c238677", "comment": "Malware payload (ModiLoader)", "value": "c95ce15e9a397c481d3bb6359db2ef85a9da957a50334fc959b34b4c02e10b0d", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022153, "uuid": "a5dec56a-e785-4787-b15a-a3f80432458f", "comment": "Malware payload (ModiLoader)", "value": "058afa3bad33cdf3bcc477f83a472f80a086d2e3", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022153, "uuid": "7d80f2c3-e50d-46e8-bb8a-0834290a87e0", "comment": "Malware payload (ModiLoader)", "value": "a9589a11453b63f751689b4179257dcc6bf652552949200ff9f75285df5d4e1e1331a4cdadb47ac3fe5b26e5f88025fd", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022153, "uuid": "708a5439-f39e-4976-9d1a-97367359e342", "value": "T1E9A423F4B0A144B00E671CE83B55BDA11A728FF8B5898EB772D2FD8D017415A86C97EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022153, "uuid": "b8d112c5-4804-4684-9ab2-ece78da67c75", "value": "12288:sXyu5ccOKx5K7n6MCwhAyahFBfyojUlM9O5v:si+cYx5tMCwhtY/fjYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022153, "uuid": "c5a4c806-0f4e-4345-b4bb-40d5cd864964", "value": 479937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022153, "uuid": "54c56e97-d10d-472f-b2b2-0e7377eee67c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022153, "uuid": "2ad4b96b-c924-41df-9895-493001ea8193", "value": "overdue invoice is attached.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ce64a8-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030179, "uuid": "ec49e66e-f1f3-468b-90a6-ea08fef37477", "comment": "Malware payload", "value": "3994626f17999bae99a37c4f70f87f04", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030179, "uuid": "b894f59b-0dfe-4b47-89c0-cc44dc7f1d45", "comment": "Malware payload", "value": "c9b4893bdb85d67c13826814ef0cf392648089f416aed40078907054624fba72", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030179, "uuid": "62d69ed8-a6b9-493c-9d53-4a1a5ca121e3", "comment": "Malware payload", "value": "c982dbd09152c191c3356f74f60a1df8abf37666", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030179, "uuid": "fa15c431-cea6-4cd8-a935-d9d7d67d8b03", "comment": "Malware payload", "value": "2d91d4a6a70720c3557f033db8a96ff8836325f2bdb30b86299bcc40e5a1f163b0c985788aac0a3dceee426d86ad553d", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030179, "uuid": "60ae5326-1d12-44fe-8569-7d06f9e7affd", "value": "T1AF31E100B9E24E00D1B28DB61CBAE61958B97C026E33CB5D47C0E3ED21B0510F539F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030179, "uuid": "13897540-9709-4577-81ba-799df591d423", "value": "24:86YmJzl6TTDw9q8o0B2ARjVuWAbMlJ6+/2FXmT4I0:8WlWf+BoJUjjA4J6oMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030179, "uuid": "227ac1e9-8584-484c-9fa4-de28f1c699a3", "value": 1789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030179, "uuid": "e89b71b5-bfec-49e1-b857-ef88fba59eef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030179, "uuid": "29699f07-2f58-4382-ba26-9e330355354a", "value": "Password txt lnk3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d991e7-298f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1661993213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993213, "uuid": "3a4ce122-c46b-429a-8a24-f7bcb64c4f07", "comment": "Malware payload (Loki)", "value": "f8ceb79fb897deb95fb255ff2f1bfa5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993213, "uuid": "b781c2d5-59b1-4f3e-94d8-36f8d8e76339", "comment": "Malware payload (Loki)", "value": "c9d71c4f126625a9918a04b55dac0706e489212e357b4e1daaca31e7fb293922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993213, "uuid": "0cf85067-656b-4cfb-9bf8-15fbb7fd96f5", "comment": "Malware payload (Loki)", "value": "178fbea58f99ecf9e9eaf29c094c54966ecf3b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661993213, "uuid": "83d34c19-cfd5-4dde-804c-b917d390e5d0", "comment": "Malware payload (Loki)", "value": "3d676e7a63d15d250637d6cd635779d795d0b1b5de2c4efd481f8c5208fa46f5c7bad4b4f23046c4e01cbfca26c6196c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993213, "uuid": "22c3c877-1989-4145-9c12-1e861a4e7fd5", "value": "T1FCF4BED422989A19D53D4FF98073838247BB61052F1EE77DFEF110ED1A22B0596C1AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993213, "uuid": "42dd5e33-cb50-42c1-94ae-c7f525b2dddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993213, "uuid": "ab930fdb-7cfe-449f-b772-f33a7c23ec87", "value": "12288:gzxwb8oNdUu3XDG2wKgZoFXmrpY0EjoAPo1QJcNCEYt2rZWVErC0oRaVV54i:2a8oNdDG2RmmbjKNCH2rZIEO0co+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661993213, "uuid": "34e93d83-e317-45b2-b260-2b3271c317cd", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661993213, "uuid": "aceeff0b-99c8-4125-b287-ace8768e7913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661993213, "uuid": "9cfb6ce4-0ce4-454c-bdf8-cf690b35c32b", "value": "PO_2485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3c9456-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032231, "uuid": "29ed4e46-6333-45ed-b689-dcee5bb208f3", "comment": "Malware payload (Mirai)", "value": "a6be0489c1e519ef18aa27f088bebcc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032231, "uuid": "9befbac2-38fe-4edd-910c-5d13313f04fa", "comment": "Malware payload (Mirai)", "value": "ca514b3c848f0209b9599e07a9afcd23075c9c3a90571953daea63124dcad254", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032231, "uuid": "565ec52d-a46e-4430-b0a3-6189e5dfff5e", "comment": "Malware payload (Mirai)", "value": "8829fd830554cb3a32d000677e73b3ed9a75cac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032231, "uuid": "f4abe319-a627-4af2-9f1a-12bfaf8e1df1", "comment": "Malware payload (Mirai)", "value": "4aa222da70de5a7302f2e40eb3949d5f3e5006e84bdb1d8a01a04af998f918da6a8cf695834b8bf87ce3fc95bf4d7f99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032231, "uuid": "e4188f0f-397d-473b-a21f-58283ccab16d", "value": "T16463B51A7E528FBCF799823147B78E229A4833C637E1C285E19CE6015D7074E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032231, "uuid": "5692ff2e-4c1f-41a2-8f7f-cfe44b738f2f", "value": "1536:p2/6WPcQg3ovEArWMoB2a4VduJI/K/+gH1:pnWIYv/Y42JI/K/+I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032231, "uuid": "daae0a91-c6fa-4410-948e-98e45311f42f", "value": 72984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032231, "uuid": "a8145b22-7584-4f10-8f77-22db8e33bdc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032231, "uuid": "88606ed4-62ac-4bfb-8816-04f5ec65ec89", "value": "a6be0489c1e519ef18aa27f088bebcc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ba7d30-2a01-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662042151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042151, "uuid": "8ec858f0-0eb6-448a-b72e-40d3d62f8d4f", "comment": "Malware payload (AgentTesla)", "value": "0e8542a6ff7e420a5415d522d022ca27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042151, "uuid": "6d45cdbc-b441-4c8c-9be8-a2256b1f743c", "comment": "Malware payload (AgentTesla)", "value": "cbf0113591a8274c6a76d8e2ad138d2befaa139f7a6138a5ee4857696e698948", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042151, "uuid": "43b5bbca-6032-4c4e-ab95-ad919c1d8aed", "comment": "Malware payload (AgentTesla)", "value": "c216ae95558535720d8da231a643fbe7db5ed911", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042151, "uuid": "c5d1d361-30e0-463e-98dc-404e5122c11a", "comment": "Malware payload (AgentTesla)", "value": "1ec29a2b96e1e1d1d1bbef3cf15c769cc68e1cb9c0a7ff7343e4193cf9c22b272f489d555f989316bbbf54ddaf7d594a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042151, "uuid": "5392186b-5669-49dd-94eb-a204d0f7409c", "value": "T149E47CAC759836FEC857C9719DA81DB4AA9224B7174F124B895315BCCECC987EF080B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042151, "uuid": "f913260c-0eaa-40e0-9a8c-3745c3b44fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042151, "uuid": "a0e5447d-9b32-40b9-bf13-e6405015dfcf", "value": "12288:ucDW3b6JSLLTTHBfzSJkbwVWTf47c2lylSx14PvEy8GCKvMg9+Wms5S7p6pFLX:ucDQ62LTTHBq7ATf47ce4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042151, "uuid": "65f83866-fec9-4135-a2ed-4a402b890ba7", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042151, "uuid": "7d151545-4959-4137-b280-4c483da77408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042151, "uuid": "1a207557-0542-4ec7-872e-9b94c1905207", "value": "quotation request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494143a0-29d0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662021007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021007, "uuid": "6dc8e54f-b4b5-402f-829e-647d646d20f5", "comment": "Malware payload (RedLineStealer)", "value": "e084d6de7aab35227c316954a84b6487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021007, "uuid": "bb74b866-6856-4e5d-bab5-dc36c4fcfb06", "comment": "Malware payload (RedLineStealer)", "value": "ccd060144933d510a122012c1ebb0dc47d92b515a36e31e86f2534e3391564ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021007, "uuid": "ad02725e-fd0b-4af2-9c4f-b415d2201722", "comment": "Malware payload (RedLineStealer)", "value": "3f3c860afb628056214d803fa9ee89876a88adb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662021007, "uuid": "bce521e7-0a51-4423-83d1-8e1ea9ec588e", "comment": "Malware payload (RedLineStealer)", "value": "35fabe2c891acf334eb6f6aac86f335bfc0e53c28aad9118aeb0714dace456ecd152364802754b7fe97819e6d2af0c56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021007, "uuid": "de3290e3-de53-42df-aa52-0bcba266c692", "value": "T1AC36123722954051E4E988398627FED431F71B7A4F81A8FB66F6B9C617321D0E372683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021007, "uuid": "23b386d6-f6c0-4ed1-955f-322814282d90", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021007, "uuid": "f7c569fb-da66-4da2-bdf1-865445fc1dc9", "value": "98304:+leiScntrHlera2r3KACtXb3rc4Oio49TNPjHyruxVp3arNxZpmxVQsTtgSE3su:+EE1lOaO4pzrpOio4tNPjH7Vp3GXp8Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662021007, "uuid": "1ee8075b-9c2f-47e6-8d04-feeaae3e1772", "value": 5244768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662021007, "uuid": "59ed047c-5b36-4aa7-9d90-8c4f7eac8bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662021007, "uuid": "ed5d1a78-6f20-448e-ae86-5fe0be1b9456", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dfb0a5-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031152, "uuid": "93f6ad67-c544-4db7-9a78-7ea891a0c530", "comment": "Malware payload", "value": "134be25db30f57e02f108f4749aad602", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031152, "uuid": "1becc9fa-222e-49e3-aebb-bb40ab805c77", "comment": "Malware payload", "value": "cce9fd00a92efdc72be4990149ba1dd42cfd01977e7da0eaff098b7b9b82186a", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031152, "uuid": "0eb934ef-bb47-46ee-a6a6-018505c9a924", "comment": "Malware payload", "value": "1f760c6416d3480b252a2ab25e41f06f8429e526", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031152, "uuid": "a40df252-fa15-46ad-9c42-64421ec50ad3", "comment": "Malware payload", "value": "6c50c5af0a4343f133da27cb8e37273510933fa11d6288f60a51fa232f399793eefcd0213db8621dead4824315422126", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031152, "uuid": "9d23226e-8a15-4b3d-988e-b465d6a5308a", "value": "T13323E1B1D79598EF89AD5C54D05983C4CD1068E3A82CE1AA39C134BAC79CC8AC77E8F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031152, "uuid": "9c4a54a4-ecc1-4752-b6a4-f21f615b0716", "value": "768:Yb6gYoaWVaZem9PbuLo9phN9GJGUIilO0GEVQPCzXOlDtzNoiPtP3uaxb:xSaRkmaoBNoJfnheCLExhFIaxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031152, "uuid": "d198eaa7-87cd-4f5e-95f6-14ffbaf0ac17", "value": 49836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031152, "uuid": "704f491b-b9a8-49ef-a4c7-7f255056ce73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031152, "uuid": "d2b1c4fb-a578-46bc-8305-b34436f22cf5", "value": "L1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae8b7dd-29db-11ed-93bb-42010a9c0043", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662025627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025627, "uuid": "69e1a4aa-749d-4bba-88eb-0f4be31e8839", "comment": "Malware payload (ErbiumStealer)", "value": "510a37df4f363a938e32cae45d661c9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025627, "uuid": "36d6bbdb-a4c4-4b96-8b5a-316d09e4ed74", "comment": "Malware payload (ErbiumStealer)", "value": "cd83d5f6eec9731fbc6c1ce5eee962f82bcf881a63af1f478e6a097760f758df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025627, "uuid": "f6e40a04-bbce-408a-ab4b-df7faf5d1575", "comment": "Malware payload (ErbiumStealer)", "value": "0976c8d6bd898c06faf90a6b99097ca6f66cca0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662025627, "uuid": "a576b4cc-f45b-47db-9e47-b512988ff4b0", "comment": "Malware payload (ErbiumStealer)", "value": "2d73e2d294d09dc99ff2a0b3db00a7689a80e8eff1047526fa8156a9f8fd67a2db0cd311832a38608e00bd6cd98235ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025627, "uuid": "ad15b92b-836c-43b2-b814-ef80e6ae0ba3", "value": "T14CD57D22E5539135DAC525B4D23EAFF37D388E201BB890FB96E4087975351D2733AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025627, "uuid": "58c5dbf0-271b-4ccf-9bfd-aa6c4eabf5fe", "value": "fce537f90e196225b462ce4019d18db4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025627, "uuid": "184e35f8-ea5f-40ae-ab98-ea947dd48572", "value": "49152:9pXpwjUIAHSwmgpQpjec5otolkavwcs8LmYQMD:9p7IAywmQQpi+kCwcs8Lmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662025627, "uuid": "ca79307c-18d3-4cb4-ba4d-b7187383d8d9", "value": 2805760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662025627, "uuid": "304cba5c-e94d-41df-b75e-a00d0114b831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662025627, "uuid": "5cff9591-16e8-4450-a137-49f437c3a744", "value": "510a37df4f363a938e32cae45d661c9d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c638410-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1662030032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030032, "uuid": "ab868aab-ab78-4a2d-a108-b57b16b09dce", "comment": "Malware payload (BumbleBee)", "value": "1d0f13665c86358fa7ac3c9f6ea11aab", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030032, "uuid": "b910e9a2-5d67-4e70-9b29-e730786861a4", "comment": "Malware payload (BumbleBee)", "value": "cdac9fcc6ae12f37231ab1be5515275f1c301f7e10a542059ad0fb82174b30b3", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030032, "uuid": "7928616d-0bbf-487c-a42f-7c0149c38b65", "comment": "Malware payload (BumbleBee)", "value": "85755e92d2a690eb47e12ef98034c6e7aeef467c", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030032, "uuid": "577384cd-a9a8-4449-80f8-788f8bf6f0d3", "comment": "Malware payload (BumbleBee)", "value": "8e724e076a83a07ba7008cefd183273e2ee81cea43a816e8f85956153f9c67190eb082ad6611591a0085ac43128279ce", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030032, "uuid": "a99e43bc-5515-4120-88e8-525f395222f8", "value": "T18511CC2802E51259D231CB3B542AE7549B71FC04E9164F3E42D49295DC60A04FD69F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030032, "uuid": "d4d613d0-c4d2-4383-aa68-5f8b8215119f", "value": "24:8ODkDkbThO25XgyCXbXUl6+//Hl+o0agDZDzabqaESiBm:8G1cwl0oiZzaeaESiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030032, "uuid": "52817c8d-a0dd-494b-ae03-32aa89a3bbdf", "value": 1044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030032, "uuid": "09b05213-ea0b-424a-9fa9-56774be6d150", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030032, "uuid": "e07e60c2-841e-489a-986d-bd116dd2ec18", "value": "request.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aed7a6-29c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662018027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018027, "uuid": "ae4a96ae-b820-430a-b13d-930698cb6089", "comment": "Malware payload (RedLineStealer)", "value": "4805c092dc064668d391be0e533854f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018027, "uuid": "51b3969a-f9b2-4e26-9662-9a69e377c617", "comment": "Malware payload (RedLineStealer)", "value": "ce54ef80e1fae6878e8a78d8ffbbc9bf22b7d0c2a647ccfc55eecfe695019568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018027, "uuid": "ff10ac7d-2cd9-4e82-9647-de239002f9e3", "comment": "Malware payload (RedLineStealer)", "value": "c6db3740bae3c601358ff934e38b70bbf4e964e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018027, "uuid": "a0b0e585-54c2-4860-9d74-3c3b0a2fbae2", "comment": "Malware payload (RedLineStealer)", "value": "5a6476707ba8a447cb26b742dbb8e093935b23206e6aea0adc468bfb994a887f0d3b1ed026bd47ebec35360491e7d950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018027, "uuid": "1bd09279-a79f-4eb0-98ad-b2597c58f5ff", "value": "T14784F212B582F076C86EDDB06414CF94AFBB493116600A933BBD269E4F7C2E1967634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018027, "uuid": "a920bb03-03c2-44f1-8898-83a90d7c2ebd", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018027, "uuid": "69113c53-5ba5-4281-9873-b45dc98895ec", "value": "6144:+dnLDKiQiTowyEB58pR/hEZ1cED3InxRlGMJ9wb58xtLe:+dnHKom/c1dD3InV3wWXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018027, "uuid": "0b1bb3c3-ff4a-4b94-8887-2bbb06fb596d", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018027, "uuid": "bbaa0793-589a-4bdb-9225-94a7f5f651d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018027, "uuid": "06238539-f11d-465c-abbd-b36df87360e5", "value": "4805c092dc064668d391be0e533854f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355db3c9-2a2f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662061776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061776, "uuid": "e8c030c4-9db6-48ef-91fe-29382582ca2f", "comment": "Malware payload", "value": "237f5effb74b535bd343b46bb9286de2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061776, "uuid": "efa8cbd5-40f7-4e11-9296-3f6e8aa33579", "comment": "Malware payload", "value": "cf5390e92bf3c359a6939470ff20007edd5ca5d3f1e6a6b39fb7d9719af5cd6f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061776, "uuid": "e67ff65b-15d3-416f-b859-c87e3d0f08cf", "comment": "Malware payload", "value": "fecce75c8bb551929b2fc3c63b7e420a78424173", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662061776, "uuid": "7ea92c35-10a2-43dc-86d5-b0c29214c559", "comment": "Malware payload", "value": "3ffde22ed6d60e471c0ed2be4aea38d2874436fb955fa0a96309cca0eff17666917afe88dddf95c932e9c11e5cfb09c1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061776, "uuid": "b005f1ec-7056-4bf7-a66d-8a82fa4b117c", "value": "T1E72533D9B71CAB4C072DBE7938380ADF990068FDDD520B7CE2F559460A78DA1E23641E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061776, "uuid": "05534f44-8e95-4f6d-87b2-c1a54081a373", "value": "24576:OG0iToWrpOECe942FIaBwuoL+aaMGpTZUjFVW:OGTYEL42FIaWxzGpTa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662061776, "uuid": "27e14362-97ba-47a4-8730-7a887cee890c", "value": 999140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662061776, "uuid": "98ad6051-9199-4e87-b61f-0abbbbf97254", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662061776, "uuid": "5afe13aa-608c-4074-9dff-80c87e973b21", "value": "Payment copy_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c4b4b9-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014507, "uuid": "a9e67b7b-7b4b-4e15-842f-8e3239933394", "comment": "Malware payload (Gafgyt)", "value": "171f8bda98cf789296918d9ef4835fca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014507, "uuid": "12335f5e-714f-439c-8b48-28997575f832", "comment": "Malware payload (Gafgyt)", "value": "cf995f82b5c8ec23b397f8cc1ecf483910588c5db1cf7868f61ace26e548e43f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014507, "uuid": "7a7f5fab-66cb-4984-b238-38f518f69446", "comment": "Malware payload (Gafgyt)", "value": "5104ef748f31021896008ce17e5b8cf90e493848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014507, "uuid": "48fc6384-92e5-43e4-a19c-d2d591cc443f", "comment": "Malware payload (Gafgyt)", "value": "0b4357cfe93fbf5b0f1919aa1e92be6790e4b0264fa24a16ef4fa77d929c31a09f3f5e38e9c432be6c473c174f363969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014507, "uuid": "e127f74a-f9b7-447d-bd5d-d86d4dec7904", "value": "T1FF93F892B800DFA7F40ED77A08D34725B670FBA24E531672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014507, "uuid": "b5c0d7f8-622c-40e2-9471-0cb62d3de482", "value": "1536:QKxXqX58NlGUGYgFQmjHdJANn9zofeQyBUgrn2mz7k4xTmQ9VqXjewf2Le:TkX0luYWTo9ofeQyBUeTz7bmQ9VqXywp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014507, "uuid": "0be3dcb8-8616-43e7-bbd8-2d1ea2f7b80d", "value": 91084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014507, "uuid": "b445d021-aeb5-4d27-b51e-28fb8ee18f8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014507, "uuid": "8f31d28f-97cb-4aae-8be5-77d0d3eb8d23", "value": "171f8bda98cf789296918d9ef4835fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc01494-2a15-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662050781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050781, "uuid": "ab826510-2ee9-47f1-b3e8-53d9e8f4639c", "comment": "Malware payload", "value": "b5198cab4acc3cb048cf979be203daa5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050781, "uuid": "91a4e622-de1a-443c-bac2-853f5e2c3ec1", "comment": "Malware payload", "value": "cfdd5bbbd99f368553442dca5757e9cc13a72d69a0cf1d24904830b6ac767d15", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050781, "uuid": "d939a4f7-85a8-4b79-8210-0641c046480c", "comment": "Malware payload", "value": "2a398fbe8d7f4629daba54b5d9253f694f04780d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050781, "uuid": "f281ea9e-2cba-4aac-a096-419436078cbc", "comment": "Malware payload", "value": "ec1381791b7ca30e5e7c10ac65a26b356d30bfb8499bd2badb46ff366e491adcd5300049a062db592bf99f7b5871e043", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050781, "uuid": "d69e7ac5-88d5-4cca-a778-5508fe6c2359", "value": "T1AA252304EE581F97CB960239261BC63C6783FD5D931FC0B76BE2348A397CB71189664A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050781, "uuid": "3a711a6c-bc27-4592-800a-b2208a7c66d7", "value": "24576:zMu/lUHGguNaUgjg+NkTgThiNkKBnv/EX0Aw+6pSg87r:NKmg6RsOEX0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050781, "uuid": "8b70b83d-c24b-481b-bbb5-7d9008aa0f28", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050781, "uuid": "3e361443-1583-4fd0-bf7d-660f5b5ca82d", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050781, "uuid": "13ef3f86-800d-415e-ae52-8910ab3248d6", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.26287.16108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e90ccab-29e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662029177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029177, "uuid": "1a094f17-a0e3-4b9b-bb20-9248b7f5fdc3", "comment": "Malware payload (AgentTesla)", "value": "f11be409e9b458d2022b551806b47761", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029177, "uuid": "2ee2a7fd-ff9b-438d-ad95-20333ded4c01", "comment": "Malware payload (AgentTesla)", "value": "d04822e02b006fb67760cbe073339fc0b22bc03306a4657024f47417a62203c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029177, "uuid": "7d09c355-2faa-42b7-99d6-1c839ffa7a96", "comment": "Malware payload (AgentTesla)", "value": "c35aca7019e42220952afd7ec8ec9797dbe32b0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029177, "uuid": "921d50e7-ecff-4db5-9ef3-0e459dfc6f2b", "comment": "Malware payload (AgentTesla)", "value": "ca59fbd67923845cbebc2aff87451797f6f6876b8154c3567f450c67e42fb732042cd76d2fbe07d8ddc009be8920f346", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029177, "uuid": "96d5824c-a125-45fd-bd0c-d56719329fcf", "value": "T101E4AE9717E49B30C37C33BA2154B920A3E5E0C78661DBC7694980EA7BB77913EF9502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029177, "uuid": "22075dcc-da28-42a6-85a4-c95a94a5906e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029177, "uuid": "9ef40784-1c6a-42d3-a2b4-345a7add7319", "value": "12288:EyT4y6f0NAnD4mPyo22ZzTSf1q6B0sQuc9GR:rTuf0NGPPO2NT61q6PQucS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029177, "uuid": "e4fb7847-19f4-4762-8dfd-d98e241dc15b", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029177, "uuid": "877a00d8-cfcd-48d2-a125-30abd542f6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029177, "uuid": "9e7f88f2-ca41-48fe-a86d-7deeae9ad42a", "value": "9CCAA2AIIB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11791003-29cb-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662018766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018766, "uuid": "11ecdfd9-68bd-4a84-aed6-b77e7020606f", "comment": "Malware payload (GuLoader)", "value": "def209476ce24286c6f6c6ba68046ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018766, "uuid": "8f22badd-04b3-437c-9d51-acfc6de3bf1c", "comment": "Malware payload (GuLoader)", "value": "d066429d176bcdeb0e9a06135a4169fc5a8174b2e7cb09b62a6da035c19eeec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018766, "uuid": "5e8370ec-74a6-41ed-a17a-ff1ed0adcb7d", "comment": "Malware payload (GuLoader)", "value": "6e72553ad6af45014485d58332e0a47a5bee4b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018766, "uuid": "6f565c41-2102-49d9-a58f-702d36b0f028", "comment": "Malware payload (GuLoader)", "value": "6d18732acb18345f925dcc139cf60ddeeac5b1a377f46cacde3900076364d783567fb29d0931ac3429bea1035018602a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018766, "uuid": "7b2c6ca5-dbde-4211-bae5-5e60d194de63", "value": "T12EA4F1067791D2F3DE7C4672A85759921F21BC3ED6C14A9B72E0B31E34F32624A0B62D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018766, "uuid": "ba9fd8e8-72d5-4576-a978-0534da66106e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018766, "uuid": "1e67c1dd-36ad-4977-a850-6e58ebb76920", "value": "12288:Egkji5yv8hnarsMpLrZtEJnL6ua7Y+gkJPWnM:2jisv8hnar9JrXEJnLI0gaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018766, "uuid": "83c2696f-3593-4e40-a6a9-8efd505fc814", "value": 485064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018766, "uuid": "023e472c-685a-48ff-9625-301e48506b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018766, "uuid": "6e3c5d22-4938-4b73-9685-ab8b02d8386f", "value": "Factura de pendiente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5a1638-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014756, "uuid": "0d38a512-ce9d-48ed-b360-531334688408", "comment": "Malware payload (Mirai)", "value": "8e016d958baa2d2996a5008d01a7f099", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014756, "uuid": "35f6776e-0f6a-48f0-a008-70888b059477", "comment": "Malware payload (Mirai)", "value": "d0ce8c5828614a79db7a0e493aab869c55ab4bb7356a1ea29d9c8a2f3a8a3be5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014756, "uuid": "741fd276-81e8-4982-9f84-a1e7696d1ecb", "comment": "Malware payload (Mirai)", "value": "35dc1e0530af6bb84c2289954e2b97d5fa1b34d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014756, "uuid": "40d8e4e4-8343-4458-8355-abc395dec225", "comment": "Malware payload (Mirai)", "value": "a2d8d4a9907303620ba444f07b2ec3a924e6b214deaeb1683bccd8043cb3420dde762ba38fdb2a40f4e3809030949d46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014756, "uuid": "28ae4bd3-a0f9-44f4-918b-8781b4462532", "value": "T112F33A56EA408B03C4C61775BADF4249332397A4E7EB73069924BFB43F8279E4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014756, "uuid": "84c8fc57-0633-44c0-820b-b410d2b8179b", "value": "3072:iKIE9MAHbptFeDE9xlkr0MdGL8J3KHpH5Qnug1WbsZC70hivo9cPVF3+alhFy8QP:iKIEaA7ptFeDE9xlkr0MdGL8J3KHpH5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014756, "uuid": "47d5e21c-355c-408e-b61d-208c4f679be8", "value": 159524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014756, "uuid": "012a91d0-ca73-4750-acc7-e4635d45222f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014756, "uuid": "ea13f251-ae43-477f-ac41-302af7131290", "value": "supercat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d143e88-2a3e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662068312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068312, "uuid": "c81e0256-38db-45d0-938a-bf5d6474b9a5", "comment": "Malware payload (Mirai)", "value": "73fcc50d7b2a4f19171346a798a232ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068312, "uuid": "cee60913-2453-4f4a-bd24-82c57088a45f", "comment": "Malware payload (Mirai)", "value": "d1ba3f671ba77f839910012cbd60ae4dea81a38a585be5c4fa6c1019888fc2db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068312, "uuid": "4b5db27c-f16c-44fc-977b-52c5f7f07be3", "comment": "Malware payload (Mirai)", "value": "bf8ddbb9c7b0ad66463e78110dbc426ced83b2a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068312, "uuid": "77456324-de6e-4e72-af83-d06351656468", "comment": "Malware payload (Mirai)", "value": "19553ea4eeb2f8fc81a55177b77151e3c81c71eeae83885169e35e7dbfcbdd71f470f643ddd63719e0894f17fbc6978d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068312, "uuid": "ade6555d-69d7-4b6e-9f72-6fc7d63d5c73", "value": "T16E82D07B1FA2312FD45844BEA3050EE4E61DDE0C676D824DCB5CDA49E2931EA617C1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068312, "uuid": "75ba05e7-63e9-4a64-8c76-b03d237832a0", "value": "384:MdjuoDNsGONkia2R6NXxtg+RfSQoCGJhCO70mxzkWE:7DGbYR6NXRfLZHfG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662068312, "uuid": "c0ea048b-fa82-42d1-b0d4-17201d3dd03b", "value": 19052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662068312, "uuid": "fb9cf0fa-61b3-4e61-b4d3-36a2615f3c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068312, "uuid": "db0d95dd-c65b-4912-83e0-3c5e18afaaea", "value": "steamamd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad7455c-29c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662015990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015990, "uuid": "eda7c32d-e605-45b4-a735-12e1e1a983fb", "comment": "Malware payload (Formbook)", "value": "682aca216b530c3a36184d33aca5eff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015990, "uuid": "c70fe3d2-c6c9-4599-9df8-3062446c07fd", "comment": "Malware payload (Formbook)", "value": "d1bb2951d655bd250df5eab810403bf4ca4f37f7bf38a641c74cfc1908464dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015990, "uuid": "d7d81938-11b6-4d7e-93b4-9e15ee5d7298", "comment": "Malware payload (Formbook)", "value": "817d600cf7f4bcd396f56c8c9612e822d5f1f670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015990, "uuid": "a3401700-634a-4bd3-a818-9c9dc0b0aa63", "comment": "Malware payload (Formbook)", "value": "bb35ee4e9defd75a3c148a1821f629311db9848357c0b4f56a554b6898689ea10e43b0b86f2fcb16143de6ef2df0635c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015990, "uuid": "803a5738-f3d5-429e-a5c6-986cef4af6c0", "value": "T1E0E4E08E2DA75402CDBD04F8D4E9578C1A24E8723716EECFE883B5861EA53FD802D657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015990, "uuid": "3d6d27bd-64e7-440f-8681-1a47b21d9b76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015990, "uuid": "015942f7-39c8-4433-9f17-30aa6db700ac", "value": "12288:1c1zqJbQFsnNYG1NM/ClEsmTlEOf6nYnwBho5mtLoch:+SbQmnNRNcClE3bCYwDemhDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662015990, "uuid": "41895d36-3f78-4aff-9a23-ecd1ddecae1e", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662015990, "uuid": "dea815a0-6d51-4dca-ad46-6b4ef344ddff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015990, "uuid": "144f901b-4fb5-4845-8263-0940e886c2ec", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d94ee97-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032208, "uuid": "f66c8e2a-9e3b-488f-ad87-7d62d65fb8cd", "comment": "Malware payload (Mirai)", "value": "ce30376aff90d03017fb1dbe7502bcd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032208, "uuid": "4155efaf-a778-45db-89ff-3c06660eec43", "comment": "Malware payload (Mirai)", "value": "d213e639d525cf42a54ae437f6f427b97b5d8fdb3f87b6bcab891cfb94f9e3e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032208, "uuid": "e20f931d-15cd-4883-a9fb-4f0ff3641dea", "comment": "Malware payload (Mirai)", "value": "658a4520f1ed71ff1d2be3bc98e81c99a4acfec3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032208, "uuid": "68038b48-dc2e-4df4-a31f-b7a1be970760", "comment": "Malware payload (Mirai)", "value": "c2030ee59a895d5114a1b40ebffac2611ff122a7ee96773a22d1f5609e626caf07c05f100616261635802ae4bc9d7401", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032208, "uuid": "472d5cfe-5375-4636-9033-b30474c070e3", "value": "T1E0C35D46FA818B17C0D5177AB6EF42493322A7A4A3DB730699145FB43F8279F0E27D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032208, "uuid": "c90b9323-a985-46fd-bd6f-0f802c443cdf", "value": "3072:WCWQ4hW9PpXzzGvKkDBZ28XNFRgGDSNOXM/93RJt1:/WQ4hW9PpXzzGvbBZ28XbRpSNaM/93R1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032208, "uuid": "04580720-a215-4ea9-bfb4-439d639e72c9", "value": 129973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032208, "uuid": "d3ca1752-3933-4b6a-8755-d80b4c246986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032208, "uuid": "4d5e64b0-8480-46a7-aca2-90f999faf7e5", "value": "ce30376aff90d03017fb1dbe7502bcd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225b904b-29af-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662006769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006769, "uuid": "751910ad-299d-49cb-ac38-5f1f6b1d926e", "comment": "Malware payload (AgentTesla)", "value": "4667b7f64cd72c54cb482ed2fbfed77f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006769, "uuid": "f22379e3-eed4-4ee4-8fe9-0cc5b4885783", "comment": "Malware payload (AgentTesla)", "value": "d3375b1c9a3274dd9659e6b0f436391e497c8965d81b29788faa5988705dfec8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006769, "uuid": "5ce0b75f-524c-4982-ad1b-0f9c5860e876", "comment": "Malware payload (AgentTesla)", "value": "b847a4369267bdfdb9dec3432e6a07f484f63528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006769, "uuid": "823fab4f-4821-4578-812f-ebee691a6120", "comment": "Malware payload (AgentTesla)", "value": "1172b14844a3fce7619df05bd5ae37184fb0ed1018f69654c4c92b2724f244a30d6c4403c16f21fe82cd843fc93c23aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006769, "uuid": "4d789912-fe7a-4eb8-b069-e3124313a248", "value": "T1F635E18C3640B3EFD8178D3285A06C64E5757C37932BC283A59B62EC995CB97CF161A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006769, "uuid": "769f3778-d91f-47ff-81bc-7fbf496b3dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006769, "uuid": "7c56d99b-6322-42fa-8bf2-9619524cd12a", "value": "24576:1gZ5DMsJyLGLrhqhIWUhOWwS8csXXY+mzo3bv:1S5RJkUdqhCgcOlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006769, "uuid": "58eb279c-1698-4b9e-b514-1adaa7e9fa3e", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006769, "uuid": "ca378ead-09b6-44dc-998b-365cead152ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006769, "uuid": "2efe7688-e1eb-4664-8024-c92b818de456", "value": "SecuriteInfo.com.W32.AIDetectNet.01.326.18375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d9f346-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662036891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036891, "uuid": "b95eb2d0-342a-49b1-b3c9-8f6e1f88ff28", "comment": "Malware payload (AgentTesla)", "value": "bddfbf09f645b28c02157ede3a26903d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036891, "uuid": "3742e14e-1359-4983-aabc-7946d9bf9cb5", "comment": "Malware payload (AgentTesla)", "value": "d3576f23e5d592194d03e821619c3092302fc22cef85303c0b337c1d1d5bc48b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036891, "uuid": "194ef0a6-086f-489e-8f6d-c9adf2be8ded", "comment": "Malware payload (AgentTesla)", "value": "19f8a1e28476640821ed69e6f0a33c4f1d4223f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036891, "uuid": "94936086-5e15-40fa-8bc9-0c423d140260", "comment": "Malware payload (AgentTesla)", "value": "8b6374cbee9cb6e3956ceae5b72a0638cd9dcdfd9e84f8eae697b9b91894c71b94953eb6dd9208a33dada143d7428037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036891, "uuid": "d21b1576-1ca9-4e2c-9da1-c3cdb4ac56a0", "value": "T12A15224FD584AB27F4490B7916B1FB1283BE3F0E91B2D38C4DC4E3B426E93668516B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036891, "uuid": "99c4108b-2487-4363-b08e-750c511af680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036891, "uuid": "b7c21c70-504b-4634-80d5-411e1ce6ff50", "value": "24576:CZ5Cwl5tjQMAVOGuOFveeEH9Rz3xXY+mzo3bv:E5Cwl5tcMguQvAFlmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036891, "uuid": "17d130fb-83f6-418d-aa94-335332f954d7", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036891, "uuid": "64733baf-7388-4eb8-801c-6657dee291b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036891, "uuid": "0e1f48e1-7ef5-45e5-b06d-a09add7660e7", "value": "Order-E%50 procurement_AHA INT B6-Folic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6385dcaa-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030930, "uuid": "6facb127-cf26-465f-82d3-be8c461566c2", "comment": "Malware payload", "value": "497520373cb9ec088b5e862961037afa", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030930, "uuid": "a547c103-8456-4983-a6d9-1302c9aaa2ce", "comment": "Malware payload", "value": "d364932b7ead6c489ca5521ab2116aa20405de552e6d64cf9449485eb0f06982", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030930, "uuid": "0f8507e1-ed8a-4154-864b-ed0225acd0bc", "comment": "Malware payload", "value": "96e1f5d0e63cbf9c1e02a2bf99d95fa3b5e0e91e", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030930, "uuid": "76b2f2ac-9e50-4e28-89c1-ec85694ba56c", "comment": "Malware payload", "value": "3be503f2c95983f5d56e229b0f40ea1028e526c72a9adce5f7dffab3732a56acad7b1639f5c4767a0e6706db2e64b1d3", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030930, "uuid": "f71590d5-ef1c-495b-be92-f4330d252e68", "value": "T186748A10246E400D7C269D9F2ADBB6A28C8BF7F1E145773DCB345202926D935EC9B3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030930, "uuid": "43ad7085-f315-46e6-9fb3-ec4191fab370", "value": "3072:4V4XVoO+N4FoJYo3jgaPyrN+1nGFigP+Vard6qfCl2ofHqs9rMNOeTbM8W8LXO5G:/0teH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030930, "uuid": "bf726c23-d9cb-410c-bdc2-478f9bbac7f1", "value": 363506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030930, "uuid": "4826f950-c204-4849-a9ef-76fece42cca8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030930, "uuid": "f35aa63a-702a-471d-b551-f332fd1c9c01", "value": "F3runpe.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5927903c-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030912, "uuid": "43f88596-d6c4-4e7c-be7b-754ad8b13f13", "comment": "Malware payload", "value": "54f4e7680522e3e8b6a90246c2f95db5", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030912, "uuid": "28c49f59-1bcf-412e-b0f2-f72f03fc1bf3", "comment": "Malware payload", "value": "d3aa396166cf4fc7140274d78bde2ea9b0eb3c8377dee376f300b403eacc0f76", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030912, "uuid": "e03488c5-022e-403f-b89e-1e67e03e6f54", "comment": "Malware payload", "value": "7630f9fa444b26cdc0c8c53f9331821da189f539", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030912, "uuid": "ae0bf0c4-0b09-44d4-8ba3-64e9d4e938ce", "comment": "Malware payload", "value": "d6a5e950c47ee8dca955cf5f8df00d52178040c08315b879f8dd2c83b09c28053f1d967142d8555374e61835a373c4c8", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030912, "uuid": "fedd8d06-d894-49f8-b133-a0c5108a575d", "value": "T1E7A46CFA1203FDDF5B6B0D44F40C2605ECACB8A7B2D455A8BF450AD64AEA5548C78CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030912, "uuid": "06aff497-4daa-4360-9a7c-b4d29d304a37", "value": "12288:Lq+pNkEUHMC01XSCbCzuCldrqOA93p3/AK9:Lq+v0CWpdrDkp3/AK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030912, "uuid": "db7fc3e8-97e4-4d44-8ab9-52c6c2392e41", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030912, "uuid": "ead3b164-5e47-4e7f-97dd-848df5488712", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030912, "uuid": "d2bdbe3c-b85f-42ac-ae5e-7df8efd973f6", "value": "Q1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8488800-2a0d-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662047500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047500, "uuid": "a4c26178-8ea7-4c93-9e57-fe660ad07ccb", "comment": "Malware payload (RedLineStealer)", "value": "09a3f4f73610deafc0ebb0a0d1630de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047500, "uuid": "ed443f57-81d1-4f24-a633-75a3f3cb1e74", "comment": "Malware payload (RedLineStealer)", "value": "d3e129d7d38d514584d7c468f749c2ccec3e321e731af52b88704d083b2abf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047500, "uuid": "b30755c6-d890-4856-a7de-a53c964d6640", "comment": "Malware payload (RedLineStealer)", "value": "bd2e7392d489a9c0740e275d185f404113f11b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662047500, "uuid": "33f73659-5c42-4722-9aad-f129bedbf6df", "comment": "Malware payload (RedLineStealer)", "value": "752ae19f6fd43b669ceccda779b148c7ed4bbe059ede7dd46a1b94d3db8c75cd571b529ed2b411574584ecea3961fca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047500, "uuid": "5e5b6ad7-0af6-45d1-a772-bb06ec597270", "value": "T156A49E01B673C0B2D6778E3198A9971E657965140B2349EBBBE019B42FB43C12AF0F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047500, "uuid": "813325dd-582c-405d-97fd-f018831de9fe", "value": "e3b8a27053e73ab9de508e2b8d74566b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047500, "uuid": "0cdd1f5d-22e3-42a9-b3c9-26f1213f9226", "value": "12288:h58j/AQxpe0ZfyFu9NPjAQS/ZHHQe+c9ENSVkUuXcDE:huj/AQxpeINLYa4QSKBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662047500, "uuid": "3a71bfd9-2e03-4c16-b928-589224ad83ee", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662047500, "uuid": "1063badf-328a-4d4c-83b9-cb5464dcca09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662047500, "uuid": "b245c74d-4492-45ac-a301-3403e770ad7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b613af-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031017, "uuid": "1f33f2c5-708d-4392-a51f-5fa586ff362d", "comment": "Malware payload", "value": "de1e2efdb723cae930bdddbdd3c3090e", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031017, "uuid": "6bc6a6b2-7fd2-403b-95e7-f8a0ff4f6251", "comment": "Malware payload", "value": "d49796e7679da11e42358e3ee8a5751869fdec12437c8a3a54bef450687b9f53", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031017, "uuid": "7ef8484b-bc71-4763-bbcb-e7cbcf809904", "comment": "Malware payload", "value": "6f3736b475eb35e875028ac74d645f772b1ef2f4", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031017, "uuid": "4c21a2f7-b3b8-41de-8b26-4a8cb8597f02", "comment": "Malware payload", "value": "e8da578a9da325d4ef638b0c2704bc550986044e7544e11bdc1da1fe3932fd0c8068ef2e7e7c20690c69c8816dd0bf33", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031017, "uuid": "659ed9e6-d5c4-413c-affe-3255edecdb10", "value": "T12A42F8372507FEE46FBE3D4098043A911D9CBA67478845ADFFC906B56CEA014EF07864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031017, "uuid": "74850767-4005-46d7-9ca9-4bbef1a51ace", "value": "192:IuQACQ8JKHAUnExADZaumd3s2sFMy2fRWEsYEdwUOsbKlnSZu+m:jyUsADsjsFjgb/ggSZu+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031017, "uuid": "8bffe406-e4b2-42bb-b858-c7ea69dbc2c7", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031017, "uuid": "632a20c8-0fcc-4f11-8e04-b597a7df7966", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031017, "uuid": "7d573244-c7f2-4fdc-bcbe-7985ea9d312d", "value": "estrellasdll.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a3f52a-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662018698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018698, "uuid": "3db3f0f6-64d5-4965-888a-5a54d994d32a", "comment": "Malware payload (AveMariaRAT)", "value": "ef8b4d10a6afc84031cc25e3eb045ae3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018698, "uuid": "8400b9dd-17e7-4e3e-83ee-9d7d8c43cbfc", "comment": "Malware payload (AveMariaRAT)", "value": "d633f2894fbd0cc7e2068d67c3bf6d74057ac65bf13c4a58d85cf17c587d7adc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018698, "uuid": "6e5aabac-e0e6-4fa0-85d2-586e94a5bfde", "comment": "Malware payload (AveMariaRAT)", "value": "9007932180be8024eba35b3dad90d3e09119b6a5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018698, "uuid": "70e72e9b-d54d-4294-9f94-82775e6968c2", "comment": "Malware payload (AveMariaRAT)", "value": "d41741173d44584d749dd2a8a2cdb68cd831a1ec5f7066b443644e0bb52ddc70fedfe7ca375d1aa2ad2fb0acba515b01", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018698, "uuid": "c0600b69-1394-4037-b470-5efeaeee465f", "value": "T16431C90CE5F6885AADD275F761865DE177B260230809EACC005431918C197FDABB632F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018698, "uuid": "f64430dd-9128-40cb-97dd-36894f5db398", "value": "48:9fUM399D99Q+YM/RBY3H3zk74RRRRRRRRRRRRRRRRRRRRRRRRRRRRv1vM:j399D99Q+TrODkkRRRRRRRRRRRRRRRRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018698, "uuid": "00a36e1e-e46c-45c3-bc75-47bd6f558b42", "value": 1763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018698, "uuid": "27221514-5cd8-49c2-8418-ee20e72904ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018698, "uuid": "e9a982ae-678d-49e6-893c-62975dfdcb19", "value": "ORDER00388737838.PDF.XXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b15709-2992-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1661994674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994674, "uuid": "ab17c4e9-2b76-4040-b0a6-7bbc7595d468", "comment": "Malware payload (Mirai)", "value": "bd14828783c7389a5fa147710b5ee3e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994674, "uuid": "cd158abd-d68c-4f68-a761-b87afa9ef6c5", "comment": "Malware payload (Mirai)", "value": "d670f964ba7e0b8eef6feb7e1f47668714daf634a874cd8693647c64eadba92a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994674, "uuid": "d1e7f4b8-3932-40f4-8b7e-e18167a87f13", "comment": "Malware payload (Mirai)", "value": "f359b120e2f900dfd9a360aca84a85b140bb7c21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994674, "uuid": "707122d2-f1e2-498d-b28e-2812b5346d63", "comment": "Malware payload (Mirai)", "value": "d1c054c83e69abeafbcf98f571f481ff5eda5657abc0798d9a4f635af071913ba8ee87615ba6f644cd51f1b714c1d9d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994674, "uuid": "ac9d3f8c-51f4-4f0d-98fb-9c10b7b1a094", "value": "T19DB3B60E2E214FBDF76C873447B78E32A799239633E1C645D66CEA001F6424D645F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994674, "uuid": "3f703e10-553e-4286-867c-493253f69479", "value": "1536:I6rE4EEUZWUa/U7WqVIH6/XcZ84XB02JxxLEPOmfgjkNCFGfiAP/UIAeFRq8S0k2:IXO84RhIOhFGfiAXUILqpr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661994674, "uuid": "93e31430-33f2-45c5-8bd8-e5be31a1edfe", "value": 109596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661994674, "uuid": "9178fc94-c900-466a-9eac-c54e18542eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994674, "uuid": "bec102f3-9137-4e26-ac95-d5939395c883", "value": "bd14828783c7389a5fa147710b5ee3e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbf3777-2992-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1661994277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994277, "uuid": "9a61b7db-6f1e-446a-8346-ffff028d81c4", "comment": "Malware payload (Formbook)", "value": "b12fcd21d27fce13cd81451a97eed020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994277, "uuid": "903bdde4-71ef-4a5e-a18b-a9e220f0e393", "comment": "Malware payload (Formbook)", "value": "d70a322e4156ed07ce6d026a7d638e94841a377568fe5840ddfd8c4b773e1444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994277, "uuid": "3dfcc38a-6fd8-43fd-b151-1d59b3645ca6", "comment": "Malware payload (Formbook)", "value": "a2f7bccdb28e4d775482eab714d8af4a7951cbfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994277, "uuid": "448c61e9-38b3-421c-ac8e-33e22e3d2116", "comment": "Malware payload (Formbook)", "value": "fa85576cc7c68eb100959dcaa667ba38f85b33a2a9d434a233a7bc093d49859b1c749797813bc300047b2501e54a467e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994277, "uuid": "f5ed8601-2af5-4bac-aebe-5ed792aa4f49", "value": "T126441215F7E0D1B2EA944B3255522C370BB0AB41FE8E791A913CF1940C7BBCD2A74E66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994277, "uuid": "062103ab-b4ed-4087-93ff-73d3fb5fa8b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994277, "uuid": "e5036abe-82e2-42a7-934f-ae891c1f726f", "value": "6144:2VWJbK9aBvvs8DKukjCComtDETTY+lhLD2hahBZqES7:DJu9aBvU8nmtDeLgahbqES7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661994277, "uuid": "3a73151e-4e62-4805-8b7a-a76c861cf02e", "value": 264256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661994277, "uuid": "f16014eb-fa8c-4201-be9d-06bb1309587e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994277, "uuid": "3db56261-3dfb-4b25-95f9-314a22c45b4c", "value": "00001691WireInstructionReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9fc06a-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662046412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046412, "uuid": "1bf14e79-fcba-42c9-a4cd-69c0f1ad35b0", "comment": "Malware payload (Mirai)", "value": "4850592fe9da5cda8d3b0c4d3895e89e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046412, "uuid": "34ac3bcb-2523-4d47-8a18-e9c6e98fa1b5", "comment": "Malware payload (Mirai)", "value": "d741ac084c5d6e9c52d44954c7f609adcf2cbf850cd958450a43f9149f238b24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046412, "uuid": "db660829-185f-4ea0-baa3-90e62a2db0a7", "comment": "Malware payload (Mirai)", "value": "68f9c8550b37e8c9cf901124e85ab3439dbebc3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046412, "uuid": "fc70a084-8c4e-4223-98bf-c53d99b6b795", "comment": "Malware payload (Mirai)", "value": "fcbb282c97fc8f14f0c8bf1700da74ad938c898e134bce7345e4b3f0e91ffc287402bc48bfa78ceb1b342e6e47e9a6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046412, "uuid": "fea6a9a3-8df2-4770-a021-e04bdc2c684d", "value": "T154336C36E029DED0C6960134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046412, "uuid": "0cf4e68b-368f-41c0-9858-72894924dff0", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Jm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBYm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046412, "uuid": "731fab85-bae0-4d82-9411-72a37732125a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046412, "uuid": "2c885755-dcbc-4713-8aae-947f5007d275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046412, "uuid": "8dabcbc0-6d60-4a0d-9bbc-f58b9e374202", "value": "4850592fe9da5cda8d3b0c4d3895e89e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e8e1b6-2a0b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662046421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046421, "uuid": "3a5abee9-305e-4475-bd68-02aeef74b5f7", "comment": "Malware payload (Mirai)", "value": "f84c109fed43ba638db11c15bf7df3aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046421, "uuid": "7669a79b-4860-45ae-9de9-3e399abfeae3", "comment": "Malware payload (Mirai)", "value": "d76719d371481842f541e0f80d5e0ee7e705cae04132311936ccf1c06df294bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046421, "uuid": "b9aaea2d-712c-4b5a-9bf9-ef207f7caf37", "comment": "Malware payload (Mirai)", "value": "0c1645d47b7e046350b97c2b9b1248df7da69b98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046421, "uuid": "a8766428-c82a-4a5f-8eb6-bf469d50017d", "comment": "Malware payload (Mirai)", "value": "9ba190c607a67d6eba8fd7c2e575d61beaf5265aaabb77e12c9aacd0eed4980363180c1533833af145c0f7556cf5a08e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046421, "uuid": "8d3a48d9-459b-4d67-9a4d-43bdcb173077", "value": "T16EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046421, "uuid": "66bddb12-efcf-495c-9a17-8d2394b7bab1", "value": "1536:cu27gBY9FSSpj3z5Qxw6YaWWgg1Y/LWy:d9sSyzz36YaWWgg1Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046421, "uuid": "6d3bb27f-351d-41c0-b273-905c95831967", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046421, "uuid": "42d4bef9-0201-4fe9-b966-d5420a32924a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046421, "uuid": "b5297574-2013-4b20-890b-434de03b0786", "value": "f84c109fed43ba638db11c15bf7df3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627d6731-29ea-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662032216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032216, "uuid": "430484b1-4924-4692-999a-b321b4546581", "comment": "Malware payload (Mirai)", "value": "2e6debfd4f10f1b9fa3fbef162aa5238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032216, "uuid": "38ac00cf-9434-4a74-bb16-4329e00b2da1", "comment": "Malware payload (Mirai)", "value": "d7c0bb38112d976b7325a4a760b847ea139e3585264298603f4f20e4062e54e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032216, "uuid": "77129697-8537-4ece-8909-aa630cfce6b0", "comment": "Malware payload (Mirai)", "value": "22d643a78327c1320986e43f3c2f78598f9b1b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662032216, "uuid": "805ba04d-e755-4af4-999b-01874173e00a", "comment": "Malware payload (Mirai)", "value": "a840e2b9169fe92f38a364dc8bc87a6e41157a8d38faf71005282fe0a849ad9730daeb16532131788cccdfc7561ee678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032216, "uuid": "d06e698f-0665-4ec2-804b-5fb751cceae5", "value": "T17F334C02711C0F1BC5935670252F5BE09BBFAAD021E4BA46695F8B778A39E371086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032216, "uuid": "d1e99cb6-9e97-4501-b7b9-ed33aa6a6a9a", "value": "768:qFydFzoBgRDjZSofcC6sC1QBAXqtrL6rfWJzsvK/scqyTt9bvo7gIe0D9ax:BdFxdssC1iAahZJzsiHb0gILax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662032216, "uuid": "38096df1-fc7a-46cb-b1f2-d3b6f43acce2", "value": 53072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662032216, "uuid": "f8476ded-bad4-4f0b-b679-9a391887ae0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662032216, "uuid": "8ed31289-e1da-4c05-beee-212304080346", "value": "2e6debfd4f10f1b9fa3fbef162aa5238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9951e76-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031181, "uuid": "aacb4794-4837-4b1c-b636-71f3a1079bfa", "comment": "Malware payload", "value": "087ff5e5bb8231409b29dace115681f2", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031181, "uuid": "c785e536-4deb-462d-a0a3-8b7e6a008c23", "comment": "Malware payload", "value": "d7de3f42b9a3fa29a7467162fc30d2fad866cea1655934485f58b9e362275ba7", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031181, "uuid": "138173d7-4ecf-4c6c-adf7-b5f579609bee", "comment": "Malware payload", "value": "eb79d443b7749140764c07ba3906e27f601c9c12", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031181, "uuid": "f2cf48b2-2333-4aee-9911-3b0b9f118c15", "comment": "Malware payload", "value": "fb2e1b910f7c36b570caaadcd298ab8e21af83fd34d64e1a5dd6104afd38fa2c4b2a1b21028d28eb2359a417c167c3c0", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031181, "uuid": "acafa13c-2594-40e1-b1ad-4f8f676fae75", "value": "T11A53C26C65AA730BE933CE89A9CC78E2DC4DA222D54965E610D40E32474392FDAD70F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031181, "uuid": "00b54a9d-b77c-4609-abe7-94d7450f4aa7", "value": "768:tGjj83kr4N7bNUn1oJW88SwUmXgF7wj3OstN9UMWpSzZv6J4g2OV+OxM:4b1oJW881/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031181, "uuid": "76481587-14d0-4c27-857d-2fefe6dd918a", "value": 62862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031181, "uuid": "fc768220-ab5a-49ce-94d1-94f3e3c01014", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031181, "uuid": "88984a29-0c6e-4995-9a2d-dd09291c6dce", "value": "PeF3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1f3ee9-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022171, "uuid": "4be73d65-85e0-4043-b13e-09beb313b726", "comment": "Malware payload (Formbook)", "value": "0c1f55dd995022a96f927bec27f6a5f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022171, "uuid": "224e0adc-3ac5-485f-9426-fd9a676d2bc8", "comment": "Malware payload (Formbook)", "value": "d88075acd7ce8bad9b10fdcd1df7587034edf4199260aad5f004b396da8208cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022171, "uuid": "d0e56ea0-4c58-4777-aa17-64c3e7873e7a", "comment": "Malware payload (Formbook)", "value": "b479c3b705a9c35062d0a2424b07b7ae957b947f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022171, "uuid": "ba715a91-c674-4b51-bbe8-1dbb83d19d6e", "comment": "Malware payload (Formbook)", "value": "43761ebaea216aba347c352242dee8e2bf5338a2ff496ddcae8941fafa3dcd66cff616f33b6f3a806db04cad2bb3d893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022171, "uuid": "e62d44d3-124d-469a-a593-75961741cd70", "value": "T12B55D0F3F2E0C633D07315B9DF6763D59A2EBE702904684A67E52A8C8F683817439257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022171, "uuid": "9dae6d9d-db72-4f02-bd4e-8be1ec0e4dd9", "value": "b59a93e1962c73110b54e7c7bf9fb7f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022171, "uuid": "ad06e019-32ba-4d58-a6f3-8f75efa8026d", "value": "24576:Pj5irHrsMl799xtkku4nzSrpN40JIyLrFHDvk6UdnrMqJje8il0:Pdev799xtkku4nzSrpmWb1jfUdngqE8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022171, "uuid": "9738118c-e252-4472-9846-92b64fc8c174", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022171, "uuid": "6e358622-0455-4b6b-962c-999892d29852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022171, "uuid": "18269046-bf0b-4b7b-8074-8a5d089ba2b4", "value": "U prilogu Dospjeli racun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2493576-2994-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1661995440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995440, "uuid": "1e221ebb-fd94-466d-be1c-4f1eff17361c", "comment": "Malware payload (RecordBreaker)", "value": "38899b3bf42c61bc0f7e189cd7d0ba07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995440, "uuid": "2496afe1-91e9-4076-a3cc-3bc9fa7a565f", "comment": "Malware payload (RecordBreaker)", "value": "d8f4a974a2d65cc7e7e93a456896efbe804dad011c3e8ba8a3be71834e269105", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995440, "uuid": "10709070-c503-4a37-afbf-5057fa30d098", "comment": "Malware payload (RecordBreaker)", "value": "1945d8cee7295d01d186167f0485ed960407152b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995440, "uuid": "39fce2ec-04c8-4309-8c4e-bc72d83bdfc2", "comment": "Malware payload (RecordBreaker)", "value": "00e70c05167f719528f7b0d82ce903003194f9b0937306efa9b51b92ce25f6acb2cfe87c5f4062ef926bf839bfc0b4f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995440, "uuid": "de9f3559-7ab5-4a0e-bcf1-15d8c2b05f43", "value": "T11A353B39EB4625F4D6135771819EEB7B9B047A288022AE3FFF4BDA0CB4331167C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995440, "uuid": "7338b828-9f0b-4caa-abcd-42b50ea39dbd", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995440, "uuid": "7bc4176b-12aa-4113-a124-a33d41320edf", "value": "24576:6D2n9SfxzNspPYLYG+1FO1TfMwudQcGzU881:s2Kxz6KX81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995440, "uuid": "b5b415b5-8f6f-4fb8-952e-59b453a6617d", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995440, "uuid": "bc358001-6ed6-422a-98c7-14daa51271b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995440, "uuid": "ec2dcb49-1c62-49f1-babf-8d30c70146ae", "value": "38899b3bf42c61bc0f7e189cd7d0ba07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53101de4-29a8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662003844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003844, "uuid": "44a3cd35-b960-443e-ac73-c9f096ba7f21", "comment": "Malware payload", "value": "c4d5719aaf55007efc6c55ffb950db59", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003844, "uuid": "3945a5da-27ba-47c7-884f-d0e90441f6b1", "comment": "Malware payload", "value": "d91db72387809da2ed0b3c48bb8b2729e31d0bc3901f195eb331b2cdf1bdf11e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003844, "uuid": "ce2d08b4-40e2-4a3f-8a7d-ac18bfd23bed", "comment": "Malware payload", "value": "6f1bc1746fb499f2a2f2a4ddd64309b5c2da1758", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003844, "uuid": "ba6f57e2-c1f1-4d01-a75d-d68c8eabd96a", "comment": "Malware payload", "value": "1e34aa9dd75b4068dcfafdaf909a72abebe6afa29d047568567cc696d9d2de5bed74ea8b273fd98203510f490c4addf1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003844, "uuid": "498891fd-28a2-43d0-9136-0068f51d3bc0", "value": "T17316F143F358A52FD477D1360AB70736A1974C0A8A43D7573A18B26C6EBBAC05F85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003844, "uuid": "2dae6200-0b93-4087-acc7-4810bed33ba3", "value": "98304:/cVtd8n4x6QAP3ftPq3tE2LV62nGxbsTQ9We2ePdl7fAWv:OyFQa+c+GhMWVH37V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662003844, "uuid": "ce6ffafc-396e-4887-a8cb-a736a2cebe05", "value": 4042294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662003844, "uuid": "a9a5d7b0-e036-49b1-91b0-bacb2eaa3ed6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003844, "uuid": "bfcd5291-1440-4fab-8475-15e1b3375d6e", "value": "d91db72387809da2ed0b3c48bb8b2729e31d0bc3901f195eb331b2cdf1bdf11e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba1fe12-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1662014596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014596, "uuid": "f7da6b45-b29f-4585-8656-ac520e167ede", "comment": "Malware payload (Gafgyt)", "value": "528610de3d2923d9ae300c1f541259d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014596, "uuid": "a3c8b269-1979-464c-a2c0-7dd287a3ab4d", "comment": "Malware payload (Gafgyt)", "value": "d9739695b8dfef8d8fe455a3af8d0495cff5a20a8e1bbb52a44f0231265b7e36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014596, "uuid": "cf8855d5-2ed3-4fd4-9817-350e6ea0e642", "comment": "Malware payload (Gafgyt)", "value": "85efe02c8d4b262f1230c2c81bc53786dc2c426e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014596, "uuid": "9dd328be-725b-43ff-9c35-14f514c976dc", "comment": "Malware payload (Gafgyt)", "value": "8f7f95fcbd52ca06b210d5d9fb7913d360ebcbd121e879ff14586b9b25488d02f898c331ba7da6ae697f5d5828525d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014596, "uuid": "f539c4d9-2ef0-4e75-b8a8-a932fa4e190c", "value": "T10A931A41F9408B27C2D227BAE79F435D37366A5497DB33026A257EB42BC27DC2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014596, "uuid": "0dc1c73a-65d7-48ac-9e0a-de4e139dcc27", "value": "1536:cQkE9VQPAWV83kb8Cw2HxD2jw50rOLEvapPzRxQMDoicKmbNNA+mCVrQAFW9OXkz:hQR83rGh5OapPNSKuY+mCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014596, "uuid": "cafb911e-005d-497b-84fb-c7a03bc15a75", "value": 97531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014596, "uuid": "3b8f6612-4d6d-408a-80cd-551fa9eca2f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014596, "uuid": "ea9ff223-e38a-4044-86b7-f43ff0fd1861", "value": "528610de3d2923d9ae300c1f541259d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657aa6df-29d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662024061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024061, "uuid": "2812bae0-e348-4bcc-b15a-90cb8e93d9d2", "comment": "Malware payload (SnakeKeylogger)", "value": "9e8dbd1c443852f9c5fdf769ea473444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024061, "uuid": "0d4343a4-780c-4361-b4ce-6d0a77f79c91", "comment": "Malware payload (SnakeKeylogger)", "value": "d98539d1fb32fb5aafb2c0e70069888e89984da0adeb9ae2cdecbd36f254dca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024061, "uuid": "9b092a0a-c829-44c9-abed-1cae8f9c9c12", "comment": "Malware payload (SnakeKeylogger)", "value": "6ba2ad763ff58576fe87618e9ecec4daf7abedab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662024061, "uuid": "4bed954b-8c8e-4287-9e29-4d1dd6cd3153", "comment": "Malware payload (SnakeKeylogger)", "value": "7a2ced3ca4912dd40802d7c7a2671c6397f0e05fb4ed6b444e2b14019ab277b28c25657290f7df2600b067a0da788e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024061, "uuid": "af61cb37-68c0-4a2b-9b32-665ee9e7939a", "value": "T1D6441231876CA732DFBC3775A2B0894903E3AEEA3094CD49DF54F9C904A7BA41913987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024061, "uuid": "90bdf726-88e0-40ab-a21b-7db85b0ce3fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024061, "uuid": "0c459456-f71e-46c6-8cf9-43ea108c31db", "value": "6144:eDBkuri/tJaJbgbeRF4pC3cnTmrlFD3x7t0JsNZx0:e1kwMARgyRwC3cTsrD3tOJsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662024061, "uuid": "e24435ca-9227-4a2b-982e-f1f61222dc7b", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662024061, "uuid": "8994ab0c-d518-4783-b8c0-aa23f6a39daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662024061, "uuid": "f4ea8623-e4d3-4d56-b465-cfb4c058d507", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db601623-29ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662034137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034137, "uuid": "87b0b30d-44bb-4f46-af01-7115b1fbd04b", "comment": "Malware payload", "value": "3d259612349db403736940496aee1145", "object_relation": "md5", "Tag": [ { "name": "Bageopskrifts Sinistrogyrate Bageopskrift", "colour": "#1F017C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034137, "uuid": "772dccba-ff36-43be-bfc0-d05b0bc98f11", "comment": "Malware payload", "value": "d9944c8cc5404e0d4a3323ef088db3a94c42bd4e077d59ab2a9a4e1a0b366743", "object_relation": "sha256", "Tag": [ { "name": "Bageopskrifts Sinistrogyrate Bageopskrift", "colour": "#1F017C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034137, "uuid": "fe3c3a9c-b481-4100-94c6-3f68f391d99b", "comment": "Malware payload", "value": "0b841b32183c8e24fa8234868327a9b8445cbcc9", "object_relation": "sha1", "Tag": [ { "name": "Bageopskrifts Sinistrogyrate Bageopskrift", "colour": "#1F017C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034137, "uuid": "b671dcc7-ffca-4a4a-b99c-d8fcb562cffa", "comment": "Malware payload", "value": "35886e4f8220211dd41ad2422593743ddf25b9206ac7ccd2def9d145dd7f9a0c5d016a8a65cee7d0e2257cdfa1a0cc68", "object_relation": "sha3-384", "Tag": [ { "name": "Bageopskrifts Sinistrogyrate Bageopskrift", "colour": "#1F017C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034137, "uuid": "cd252ebe-46a7-4e29-bf1b-740f119b169e", "value": "T1F21512E4BB50DA5BC9499B3148B1EF325B26BE50EF92C703B294771D3C335A16D3A182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034137, "uuid": "05e19ce0-1505-459d-8d79-f48cd6a6857d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034137, "uuid": "c0010cb1-f7ba-46f7-8230-82bed75d4859", "value": "24576:GNLKuvsGMscLYDEJ9fqSSzjwzGWtV6wD4Aae8AkwxjonxU:GNLKuvsGMOEnqSSzkz5tgI4i8Akwxo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662034137, "uuid": "b552b54e-6cdb-40c5-aa5d-6928a61858db", "value": 882536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662034137, "uuid": "46301941-8c5c-48e8-a8bb-b3f19f0c8cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034137, "uuid": "a6f00fc1-c192-4f3d-8c82-123509471aa7", "value": "d9944c8cc5404e0d4a3323ef088db3a94c42bd4e077d59ab2a9a4e1a0b366743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbdf059-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030970, "uuid": "b74ff1e0-118f-4e59-9823-2d2884e21a5d", "comment": "Malware payload", "value": "05a748e408f4ca556ec45a7d0618bedf", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030970, "uuid": "1d7c354b-67a4-4c9b-a5ed-bfc063d17f78", "comment": "Malware payload", "value": "dac58c46495ec8e0188a30e5db85759628711009254c942e613d3e94bad2395c", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030970, "uuid": "4602f267-e732-4e54-81c3-499f5ddbb4cb", "comment": "Malware payload", "value": "0dcce7de69f0074f1c23acf385c3cf509f68769b", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030970, "uuid": "2859f5f4-a67c-4bd0-8239-10c1eb6dbd44", "comment": "Malware payload", "value": "a451838aa62cb6c12cd9c1d82d4eeeee92519cfdbb2f7cbaa0ef2f9d0921dbc8f9295a557087b2cf6f16d0f3d30d966f", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030970, "uuid": "dd054f8a-4e5d-4dcf-96ed-2d97735fc98a", "value": "T1F4B3032529EF509D73A3AF952FD8F8FF889AF673150E30BA20520B468722D84DD52735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030970, "uuid": "8f7a4767-33f5-4aa4-af99-02a03948ccf2", "value": "1536:e2/GIIRB5A8rcyoARXGvxKrVwaaViX932UCla0gQLeknIB0Aew/pCaTf35a:HFY6mN32pgXknIB0of35a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030970, "uuid": "4f0468b6-2f00-4955-a95b-463b6a256f7c", "value": 110594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030970, "uuid": "8256c96e-7d16-49e8-8b6a-7d03a8c49de0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030970, "uuid": "9a208950-c0a3-489d-ac44-c6a55e62b5b4", "value": "treboldll.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bf68bf-29c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662016272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016272, "uuid": "0ff139a8-9b25-4ce7-8eee-ee3ded6df32e", "comment": "Malware payload (Formbook)", "value": "71bd802c915e6b340677d6249dec1b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016272, "uuid": "ec78299f-a794-4985-9962-5b17ec063aa2", "comment": "Malware payload (Formbook)", "value": "db43d92fb68d224b483a10ca9ef9e0da10f9073f9a17eb5e532cf8a20a449625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016272, "uuid": "758b4a6e-0109-4d0e-8e91-fad1aa44589a", "comment": "Malware payload (Formbook)", "value": "d2f67bd16c37e369fb2a38be397341d01f7d3447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662016272, "uuid": "fb112674-47de-4242-a801-fd0e7882b445", "comment": "Malware payload (Formbook)", "value": "4ceec1a75bf2475b64e4eb49bb1d95fa7120a8845024b23ef13a557324d3ad2d24578558a0f6ab74dfe0cc641a81ce40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016272, "uuid": "1132f206-ed83-4813-aaa3-4c3a73358647", "value": "T16AE4120137A45759EDFA03F1156A9C836B3A7E266D40DB1E1CD132DE9932F0EAB01B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016272, "uuid": "bda57536-4701-4e7f-b2fb-d2ca14d860bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016272, "uuid": "b4b47c5e-a48a-4d41-8ab9-8355514b07bc", "value": "12288:a/IGFu3XDG2baNwjsxlimMtIacMo37hRiK6X9rSeo14rAiWi2sHV:a/I7G2VWlzMO70eeo0oaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662016272, "uuid": "61a0d8b6-5ce8-44f9-972d-583094f2f9b0", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662016272, "uuid": "1e782fea-f5e3-446c-9073-b76c86cb5e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662016272, "uuid": "7c1982d8-6e3e-43b6-929a-1e0a778d18cd", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40114c19-2995-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1661995652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995652, "uuid": "96292639-e664-4cfa-b78d-5fbfd985aea1", "comment": "Malware payload (RemcosRAT)", "value": "8107c398fdb0ec7e7d1be8e1c7a60b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995652, "uuid": "ef37b180-dc2b-46a5-b64a-b4df4b31d546", "comment": "Malware payload (RemcosRAT)", "value": "dbfb5d7022f16ed18eb10396d773e233c57cd74a451b2c482b47d7e2c9724da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995652, "uuid": "ca0cd359-551c-4eec-9006-03917d1afd98", "comment": "Malware payload (RemcosRAT)", "value": "01a2512484c760567beb8437eb402a7c73cd0e05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995652, "uuid": "3120132d-f402-486f-9bce-dcf2c931a149", "comment": "Malware payload (RemcosRAT)", "value": "7e479ff092844da280b30845a1765ea10ca4ad27046da4a1bee2c9ff224804bed05bc84973b901e2ff75da876bcaeaf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995652, "uuid": "b40b9135-3390-4142-908b-8a25a7e721b8", "value": "T13125F1E6EA948B44DC2D0BB550314C504377BE66B9BAF24D8DCA70E93E73B934221D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995652, "uuid": "3863ac56-f0b6-4e79-b29d-46e04b936b97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995652, "uuid": "e6f72bb6-5642-498d-be38-75d1680b04fd", "value": "24576:EjNCG282soSK+rFKjtzWahOBJZZUuQWEzgqGxx:EPdNU+r8jtyahUJsuQWai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995652, "uuid": "ed36ec07-bec6-40c3-b57c-02a462015feb", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995652, "uuid": "578395f1-5843-4fd4-b379-b0f2dae0dc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995652, "uuid": "d7822646-74ee-4d9e-b05e-69bb17750d42", "value": "UAE HESDES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7782bdd-29b3-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662008737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008737, "uuid": "2517a027-064b-4393-8040-a63efdf30045", "comment": "Malware payload (RemcosRAT)", "value": "570b65981600304e61e2d58e0b9753aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008737, "uuid": "3ad359a6-6ffe-4169-a492-a774c3883bb7", "comment": "Malware payload (RemcosRAT)", "value": "dcc4acd6953b6ad8ca3ee37aec0617bef8ab148649397963848b2b0237d46549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008737, "uuid": "baa7fbf9-e632-45d9-a3e9-0ac55a2e9d99", "comment": "Malware payload (RemcosRAT)", "value": "898004e9820c938484b9548acb12e895d131bb68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662008737, "uuid": "3e488a97-d3d3-4c53-b76e-d7a9a2fabdf5", "comment": "Malware payload (RemcosRAT)", "value": "15c42259ff3589355fe91cd92124e0b51ccfaf1d3f244f4fa47a7a9275002c73e3ed050a7d312febfe811506a38194e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008737, "uuid": "ced55ed2-c086-46b3-ad00-691f780659e8", "value": "T1EC4512D5D8808684EC2D2F3620772D28436B7EBABDB5A55DA94D70B42BB32E31133D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008737, "uuid": "de52dc3e-5298-448e-9dc6-f0b1e29f6290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008737, "uuid": "5bb8f250-09fc-4f8b-8b9a-c60511a3f977", "value": "24576:AQHEZ6AbYNJeEvCTRdXHX1amKMVEgp7Q0UVgTI4/z1a4KT+a:AQaYNJeEvCddXX1ZKMVUVyzM4KT+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662008737, "uuid": "be7d5aa5-18f4-4f3a-8508-aba07c02b082", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662008737, "uuid": "e3dbf364-c645-467e-837c-c61b1eda9367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662008737, "uuid": "7ea2fca8-63c4-4713-81c2-fc533b730c89", "value": "HODVEDWES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec75efb-2a14-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662050195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050195, "uuid": "fc767474-6750-4793-9a9e-6845ef57b6bf", "comment": "Malware payload (IcedID)", "value": "01634940adc87bdfe64c8a3ee86dad5c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050195, "uuid": "6d901cbc-93b0-4419-b218-442585da1e3a", "comment": "Malware payload (IcedID)", "value": "dcf8b1e16e8f73752f96b8b3acc66670c595819aa23687c53dc0e314358d47b8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050195, "uuid": "61f92ea8-450a-427a-b2d8-cc132c979b70", "comment": "Malware payload (IcedID)", "value": "8e8b46330a9bf558159fab12dfcacbb5df353940", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050195, "uuid": "da2a88ac-1fcd-4947-9e6f-a6ebda755c83", "comment": "Malware payload (IcedID)", "value": "f1bed19e70e0573ad265e58e43376148e61ef0434b484dc8e6ab85a7f89b92f0b9e60f9dde864a488d562ce46665f7af", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Stolen ImagesEvidence", "colour": "#F2A376", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050195, "uuid": "922e72ca-552c-4420-a7ba-bc9b4dbf7a70", "value": "T1F48509D8F245B47AC2665775C12F5909737C28F2674CBC40D6AA88D81E392B93263FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050195, "uuid": "372f15c2-3480-48ee-a8ad-5ee5902e253a", "value": "6144:Hryu2FszVI4r750Vk6HQL5Y0jHwNKa/PY3RuJGs:LyTmKUN5i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050195, "uuid": "0c338318-1fbe-4b0f-b130-965caf1ed849", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050195, "uuid": "7a07559c-944d-4c44-808d-21531e7a8c14", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050195, "uuid": "70ce5417-f869-48fd-a849-adae4a1834cb", "value": "Stolen_Images_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae6b779-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1661999428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999428, "uuid": "1f63165a-49ee-4786-9410-152535eba6ee", "comment": "Malware payload", "value": "eb40566097e07590d458a5dc254c24e6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999428, "uuid": "eb81604b-715f-4708-bfc4-fd77bd1382f3", "comment": "Malware payload", "value": "dd11f6bc61b6451aa645e0f1b9efc09411433bb94a1dc6503e97bf85c196c340", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999428, "uuid": "ce0d90e0-5f39-4408-b0b6-f7a1739c0ada", "comment": "Malware payload", "value": "31596d6df0ec6560a258118f0f93b2080dba1c13", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999428, "uuid": "91c4dd7e-ec15-495f-9827-c0a4cb64329d", "comment": "Malware payload", "value": "1d03802076f28da1129b356e07ec34233638c0c2737dd902e077e1fe1a87c43121c14e24ac00c5e54b3f479b5163af25", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999428, "uuid": "1efba399-8a49-4ffe-b742-73a861530aaf", "value": "T119141393B2E21651C4222DF3A62EA4EC62B7CC18D45BABD7616C3D4C3DFC66705BE091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999428, "uuid": "cb643add-bde0-4e1f-8776-a836435c2228", "value": "3072:GH5nRfmPDnmP2cGSGJJ1UmsWNH7QYORbhuC1RIxoBpfuQtXJNuqh/0qK:Gbm7mP2ceJ1UmsAQ9R1XcofFtXJNuqhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999428, "uuid": "267118b3-ecb3-42fb-a612-a0d9d0eff343", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999428, "uuid": "3c05120f-6879-4031-8955-cbc798d0ae7d", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999428, "uuid": "1a049fe6-db42-4a2e-8137-d24d4bf83fe0", "value": "SecuriteInfo.com.Trojan.GenericKD.61631214.23247.19255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d18a433-29cd-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662019833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019833, "uuid": "1c81a0ce-7fbf-4185-a820-c35e2be86d3b", "comment": "Malware payload (RecordBreaker)", "value": "ed6ee35b77da029551a53cf7c6d7138b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019833, "uuid": "8a64a6bc-c512-48ba-a667-26b8c87850b5", "comment": "Malware payload (RecordBreaker)", "value": "dd7b143bf47b7459dbf284eebd7325890b240a2b038cc4a5b88f3894ff696866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019833, "uuid": "3d100cc7-793a-4c15-a915-ffdda51c3f21", "comment": "Malware payload (RecordBreaker)", "value": "27d652aa0c8be5e5d92989d08a2d8207fb7a4ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019833, "uuid": "f043828a-e511-40fd-a8be-9eeea4ad0517", "comment": "Malware payload (RecordBreaker)", "value": "5a0646b71996d9fcc34f28644abe22c701ca7aebc7d06f2fdbf8afd9293834eb2a0f60d9bcaacceae05d08f608b02b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019833, "uuid": "ea2ba01a-253c-471e-984a-de3ad53d86d2", "value": "T17154E122BA93CC33CC9515B15465CBE5AA7B84312570458B3B991A6F6FB03F286F630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019833, "uuid": "3a01d632-522b-4447-80aa-d9edf62eb900", "value": "262f3c2f00544276f1579684f75c5bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019833, "uuid": "0543e874-3e78-469d-8d9f-7eb0914ac72d", "value": "3072:s3X5NppnN+P0L3m49r2oBS3mVkxNtkVl4Qcc:qXL24m2SNtkr44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662019833, "uuid": "a049cfe7-fe4f-483f-94bb-4d4cc7502040", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662019833, "uuid": "b3c4f415-aa12-4046-98d7-e24b3eff1c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019833, "uuid": "80857a59-d27d-4cf9-b0be-a4c9e9fd84b6", "value": "ed6ee35b77da029551a53cf7c6d7138b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b13b4b9-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662018541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018541, "uuid": "5eb88a6a-a456-4902-859d-c7a3ffdf4af8", "comment": "Malware payload (AgentTesla)", "value": "713c95ef019e1854d2ed543b80dbb946", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018541, "uuid": "a5150cf7-193f-45f9-aa06-f400ced80bbb", "comment": "Malware payload (AgentTesla)", "value": "ddcdff7e5f923002c49305ebc0ff06002fbc372fadb2dbefcbeaa792a5bdfd4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018541, "uuid": "ba30311f-579d-44c6-b16b-3c6b61bcbd75", "comment": "Malware payload (AgentTesla)", "value": "19cb5918029ad9e1c4938f3bef405c1509c89293", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018541, "uuid": "f1f38ad5-b288-4ee2-afb9-34d366a27b02", "comment": "Malware payload (AgentTesla)", "value": "64334c3160906ea64b5f48fdcacf5555a5f57c3c8ddf52e78700d7138a83579d780612f7a556534ff9b272c1705ead71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018541, "uuid": "04ef7ed4-d3f7-4d47-acb5-b3c46e57f6e2", "value": "T104C423C9AE51C09CC25F2989D5DF6A754CFD529B86F6A64C0B29380FF9360009F1E9B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018541, "uuid": "56b71382-f8fe-4c2a-9f04-a5c09f3939ad", "value": "12288:ziqDr16hp0BCivTd278tqkSSPZ7cbebN94toMuYEL/4/w86v25Y:JapGNB2IfhwbeJWubLg4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018541, "uuid": "7d58902c-cb9d-4994-aaa2-22a4d988ab12", "value": 549677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018541, "uuid": "a0ae5a6d-3a06-4cbf-811d-ea420958c643", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018541, "uuid": "9e791c7b-6024-4899-a33d-7c796787a258", "value": "PAYMENT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a9c06b-29fb-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662039735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039735, "uuid": "723de415-0dff-4e33-9788-b2b098c8b2e3", "comment": "Malware payload", "value": "7805bb0231503f15913fb1022fd921c7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039735, "uuid": "3c372a35-0303-4f75-8146-5185e9d363f0", "comment": "Malware payload", "value": "dfc15574c55cbf007c3d2a24b41fefa1739d42764266e53bd5c8c5b3362cd7cb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039735, "uuid": "6004a2a3-0c36-4b4e-96c9-3fc4721fc130", "comment": "Malware payload", "value": "17f04031147f21dfa8d7b454b7f68b16141ac37e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039735, "uuid": "0ba454c7-f935-4f2d-8cc3-c4d2481ef36a", "comment": "Malware payload", "value": "ded7780850b3c59444148caac3223542c8cd4f71bb7a44bf3bb85b75317df10c56c6d75870074ff0a12703a31ce1a566", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039735, "uuid": "af525ef6-6116-4960-b699-99834935122a", "value": "T117E2D1D8FD6A6466CE9D053D4C5605F9F518D50CC7829BABAA0C477C6F808F23B4760D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039735, "uuid": "578d0afd-cc9d-4732-95b7-ab4e61955766", "value": "384:Br3rq8aQrlYS+CvkQBaPbTPpGLmTnooMaEUtUoJE6uUVPDu+M3Bf2KnnlCPu5MIW:WcSCv5Kb9vBdyuOlfPVETFR7Iyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039735, "uuid": "14437d3d-dc5b-412c-886c-c53b1eb7a99a", "value": 31973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039735, "uuid": "58830989-4d8a-45da-95e2-25b75b626287", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039735, "uuid": "a4e43190-1060-471e-af9a-cf8573fcffca", "value": "SecuriteInfo.com.Trojan.GenericKD.61630511.29151.29414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d012b4-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662022126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022126, "uuid": "484c1f99-d518-46d9-8238-1457d0c11b76", "comment": "Malware payload (ModiLoader)", "value": "63ed091e955d9b00b0898f4a546a3517", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022126, "uuid": "de0897dd-4d58-4cee-a390-1d0a169d33c9", "comment": "Malware payload (ModiLoader)", "value": "dfcf24e1425763688f25cfaeeccbcbc810c1075cba002da4e7fbde3f990ef4ab", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022126, "uuid": "690b990c-df25-42d8-9cbd-a858e01d89fb", "comment": "Malware payload (ModiLoader)", "value": "aed65ab618e7d0a3ad266e1f28dda0de71e6f144", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022126, "uuid": "9ede7293-7a8b-43df-8087-f3627e490419", "comment": "Malware payload (ModiLoader)", "value": "c4e8ffe12ad38a4ab91a7dff2de26e7089bb09ca82ee6e6867ecc678620dafc409441e391f8c147e8a691606b64152fa", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022126, "uuid": "9d450be9-2bf9-4577-832a-0df9a624f125", "value": "T17CA423F470A544B00E5B1CA83B55FDA15B728FFCB58A9E777282FD8D003411A86C97E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022126, "uuid": "7685f116-00d9-4ce0-9abc-fafd1dbcebdd", "value": "12288:LXyu5ccOKx5K7n6MCwhAyahFBfyojUlM9O5D:Li+cYx5tMCwhtY/fjYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022126, "uuid": "8a5848de-50c9-49e4-97cc-e73eccd0f504", "value": 479909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022126, "uuid": "62c1d05e-12b0-49fd-b56c-5b2a29902898", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022126, "uuid": "2ee4d361-6751-45c4-8709-0e92d3c31754", "value": "Dospjela faktura_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3221c4e7-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662039866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039866, "uuid": "a2e0e319-f716-49d8-a2d3-2cf9ea483d8c", "comment": "Malware payload (Mirai)", "value": "c3a83d3399980958121730ee2d9778bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039866, "uuid": "65a4808b-2bb4-4579-9e81-e52473bb51ca", "comment": "Malware payload (Mirai)", "value": "e11e9c8d58761546bedb14f3bb4055d1bb249344ab43cc3fd30e3869c280590a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039866, "uuid": "8f63f692-aaaf-4f0b-b639-979f3bbeaf14", "comment": "Malware payload (Mirai)", "value": "157aa17dce4fdef71b98187d1a6fc9ed491fd1ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039866, "uuid": "d1895a94-2326-4522-aac2-0eb05aaafdc7", "comment": "Malware payload (Mirai)", "value": "43b444a430b2fd47ef4099dec0f36d6e4760bc102de7cee56e3e764fbe391e88354beb2037d968b8348b878330920e50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039866, "uuid": "73c1a0a3-5709-4afa-93f2-bf3698569b88", "value": "T15E23F1834FCA6EBE4AF0467674044FC61E650B7863FB24DB1F10CC98AAF11A76A71583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039866, "uuid": "b213e0e0-8f1c-4858-a3b2-69758bbacb3e", "value": "768:FV4Drnc5HCtgha1rQ686hg+t/l8bmxR3XMe9q3UELOYQmNfCReqaHvp0baTQ5Kv3:FVwrnsuvxYixRqLrVBC40apv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039866, "uuid": "d2ae8f94-4b55-4a77-b8e5-c3059239f4ac", "value": 48796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039866, "uuid": "be5c0c33-008b-44db-93dc-df05cfed81d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039866, "uuid": "7e139fcb-9354-40d2-b9ad-60d794d8f5c2", "value": "yakov.arm7-20220901-1344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae77c0c7-2a05-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662043940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043940, "uuid": "9902dfc2-1f88-4a05-aaba-29aed3c74282", "comment": "Malware payload", "value": "2656fa3d17a678720eb969cfbcf63c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043940, "uuid": "e1c12d4f-2572-436b-bff1-e58cf70292ce", "comment": "Malware payload", "value": "e12c2ab58d771a1eb57337d581b1ef19bc19395d374d9bed98edc75defeb2d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043940, "uuid": "18db2c6b-c9c0-455c-bd58-f722ca9013c8", "comment": "Malware payload", "value": "f3046997e0a3b15f6fe9d1d74a501493eca1afa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662043940, "uuid": "4f4955fb-a70f-4400-9ad8-22381a9f3250", "comment": "Malware payload", "value": "669d158a077fc8c5f104d898cd73411320510f75b84988699ade62011939d4be5d584fc44af43c57b8be71ab5c93ec3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043940, "uuid": "466c333a-2095-4299-bd58-b5cb3dbbabf4", "value": "T17856BF14360EED41DB3D4DB7BD0602091C9E45C34BDB1AD276B73B70B7A65C82AFAA18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043940, "uuid": "4347e084-7d5f-4f90-845e-060952185047", "value": "e3b8a27053e73ab9de508e2b8d74566b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043940, "uuid": "45dc7302-ef17-452b-ab94-1d4a362d1986", "value": "98304:oP2Bv/TtqlX66G95koNHgk7fAsCxrOgH1VivW3z:DHTGK6GootgkjAsgrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662043940, "uuid": "bd4811b3-219f-4f5a-91b2-4e597e2a73a8", "value": 6054912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662043940, "uuid": "9e6663fe-44d2-46d5-9fa4-68525c2a9462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662043940, "uuid": "f01ac044-795d-41bf-8328-4b83dd6d845f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aee47a1-29c2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662015024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015024, "uuid": "4a71ca6c-0064-4154-a61a-3b0f73685f42", "comment": "Malware payload (RedLineStealer)", "value": "ce9ab303e1b71ed515ca34f2e7d9c84c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015024, "uuid": "708a2819-1433-44cf-b1af-3fe2e49e1380", "comment": "Malware payload (RedLineStealer)", "value": "e1384145bb48dce3e44a1888ae8ae919cc5c783f5b63cf2bc22098a5a2aab0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015024, "uuid": "21a39774-1704-433a-9740-ae23e7bff2fb", "comment": "Malware payload (RedLineStealer)", "value": "88cea1167d267dab112d4b7d88b7f060d5860cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015024, "uuid": "1dd2bf8e-6f87-4ec2-9378-3a02af72cc24", "comment": "Malware payload (RedLineStealer)", "value": "619427ed9eef2b19922b1ca572ec660d0fefbd78682b4ccd50408857f191cda044351dcad192d97fd79dcd4c2db2b1bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015024, "uuid": "94ea3522-0df3-4e16-a9f4-f37f39f423f1", "value": "T1498402127AB2E0B3C052917414659BD26AFB983015B124DB7B6DD77E8FB03E04A7721B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015024, "uuid": "3f6725b3-b4e8-404c-9ab7-261005f0b4a6", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015024, "uuid": "46650b1f-a69b-4920-9ff9-5ee8906b6c88", "value": "6144:4xL5c1EOrlC/rkYzV4YlDFoIVH4mFWFpHws:4xtc1EOyZvlDFoIV8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662015024, "uuid": "11290687-248b-456d-a201-dee2bd66f29c", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662015024, "uuid": "3ac02f70-ad75-4a8c-b8f9-9e06973e072f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015024, "uuid": "1e30d0e2-9d29-472f-8e0f-947a950d06f1", "value": "ce9ab303e1b71ed515ca34f2e7d9c84c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d489ef-298a-11ed-93bb-42010a9c0043", "comment": "Malware payload (TeamBot)", "timestamp": 1661991207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991207, "uuid": "e567f96f-9225-4a7b-8c99-43ad1648b7af", "comment": "Malware payload (TeamBot)", "value": "0d6e707e00a5b9d3c30e07e8d524e721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991207, "uuid": "2789dc31-31f1-4bba-a757-8026cd373ebe", "comment": "Malware payload (TeamBot)", "value": "e29f853b4ea37792dbf9764876e2b9ca78647e6830d47ab848ae647e730ab252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991207, "uuid": "8e2a23ad-db58-49df-99ca-1f1b58de4297", "comment": "Malware payload (TeamBot)", "value": "e54a0f1541a4a22bd626f4bc38797ad1d929eefa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661991207, "uuid": "3cfe2164-95bc-45ce-b528-9dfc0d46f40b", "comment": "Malware payload (TeamBot)", "value": "dda72435cce70ded1e82e83a799849d743189ca6096f5b6aaa55a2b0f04bab7b4b822a827efd3fb1d65ff313c94d7ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991207, "uuid": "e3c33d4a-a078-44e9-8815-9fe03b3fe0fe", "value": "T14D54D0127A43C472C87914B07876EB906B7FA43016B88547277936BE5F707E29E7A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991207, "uuid": "4a6c7945-5a7c-4b24-a4f1-3711a2252976", "value": "29ba846fbef78bfbbe4e58b038f10444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991207, "uuid": "d91495ae-53d2-4665-bcb8-03f0697712a6", "value": "3072:WXvlm9LoZCL2N1vPqV2X6/kY0adkaZ2BayGrnhFYi31KahZ:+uL2jql0QVbhFYi38ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661991207, "uuid": "e2755596-72c0-437b-8e9f-9024fb446d5b", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661991207, "uuid": "211a0ddf-e6da-4416-89cd-18328349cc61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661991207, "uuid": "404f1297-1a62-46c7-8799-c691762fe4ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2afe1e5-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662022150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022150, "uuid": "adadaa24-10cf-4f57-8917-b86bb607b420", "comment": "Malware payload (AgentTesla)", "value": "65cbbf219596d9868cb8f939802ccd4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022150, "uuid": "a5dc8698-fb9d-4f0b-bd3f-8c9f5b3a3735", "comment": "Malware payload (AgentTesla)", "value": "e312387cc5b5cbd946bb9b201b3a5acd31d01540b139b5a287ced7c8f11812e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022150, "uuid": "475ec635-c3d7-4114-908a-d8e943333d21", "comment": "Malware payload (AgentTesla)", "value": "65bb83f9b7f495b4d7d42298b762f5da86321ec5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022150, "uuid": "038603ea-243e-45a1-9176-1d0ef71019f7", "comment": "Malware payload (AgentTesla)", "value": "6be75d8d0b02c663aa82ae17d6f8d08f60bf9ffff181d5438a9b0f6379b2fb49f04cbb1c601d7faf00ec8f4373c15139", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022150, "uuid": "bd76a473-e6a2-4d99-8fc5-f687685e4073", "value": "T140E423485A6959B5EDEF4D0E779FB988282CD412E3283DCB47DD1AC88F5811C32B2399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022150, "uuid": "06feb92d-f33c-4da1-b256-fd87ddb9c9d0", "value": "12288:MHAUq+eKwwucRQmxFtnTq0X8w+NO0egqdXcyBg8RWX343APpOR0I:GrpFucRTxFg0sw8uJdXct8RWX343iej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022150, "uuid": "5ee7eec8-0b73-4ff3-937b-046f6a7a7b27", "value": 675517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022150, "uuid": "5c699baf-df1f-44af-806c-7a24f95e9c7e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022150, "uuid": "7f0e7aa3-966f-4a14-b0c7-d9669b05b20a", "value": "ORS ve Tic. A.\u015e TEKL\u0130F_\u00dcNL\u00dc OTOM PY-2802.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813f1452-2a38-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662065769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065769, "uuid": "7c26396d-7e24-45e2-b20c-731a826287f1", "comment": "Malware payload", "value": "245249e52d04f52cc0922941f6685a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065769, "uuid": "9de64c78-51a2-4949-bc15-c5546cabf54c", "comment": "Malware payload", "value": "e31a7cd4000ea247b6b295a3a206267dd83ba42e56b4a663f78fecd9b3ec6651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065769, "uuid": "e65899de-41d5-4020-97e6-c1fc2cbd81cc", "comment": "Malware payload", "value": "1034bbd44390ef3bd66ef82b82982d3be2c37ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662065769, "uuid": "cf8b28dc-997c-4828-87e6-b95a7e46c1de", "comment": "Malware payload", "value": "04d2900df56bf735afcf323ad142b6b7c85ffba5422491a1792fced502d8d64cab510bc2e9835b00d2fdac5da710c635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065769, "uuid": "84c1fa36-104c-4a36-9c23-1c01cd8708c7", "value": "T19274E1406B80C567D06617308592B7714627AF2C7961870F67E4BF6F3BFE6C2A92A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065769, "uuid": "316218f3-e387-42eb-8b1a-8d3a7fe65bde", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065769, "uuid": "5227f245-3202-4380-956c-22c22c0b5561", "value": "6144:rMm4CC21vma6hhBGAfDshqKZv6n/dUFmhdxOEBAvx:rMw31vCGAfDs8K6/CFadxpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662065769, "uuid": "b02c1712-8150-4150-b808-fece97e64f3d", "value": 355800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662065769, "uuid": "d2255c66-c63c-44ee-9c92-d5779c9e5b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662065769, "uuid": "e7fa9173-d2a7-47ae-9681-b9c3abcbd42a", "value": "alienations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c25de27-29cc-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1662019240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019240, "uuid": "2f8689ea-8678-4d18-b6d6-1e5f1a27a13f", "comment": "Malware payload (njrat)", "value": "f7bd8746c3a025514b3ab87a10e99582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019240, "uuid": "14a14a20-fd51-435b-83e8-1af6d33bd185", "comment": "Malware payload (njrat)", "value": "e3589724f25b06655c87622bc518cf9da0805ac7ef11374284b73d4da6687b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019240, "uuid": "b0393700-8fa5-4b88-ac1e-d85d473556b6", "comment": "Malware payload (njrat)", "value": "579118c7930dfd792788f636db8246409596f00b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662019240, "uuid": "80296097-2e48-4525-ae75-c40782743f81", "comment": "Malware payload (njrat)", "value": "f11af9fb0f06a01cac89da2b4563f5e7dd3dd84fc72e4a184eca4cec329d55d764617efb41e50baef6b2a3b5c518ac3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019240, "uuid": "cdff76d1-75fa-415a-9eca-374fa9532993", "value": "T1E013D78CB694E174D5FF8BF1B4A2B2890B71A017A902D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019240, "uuid": "a2dcda6c-0b34-4e85-b654-8ef255b8cbdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019240, "uuid": "29d4493c-4db5-4f8d-81fc-514ab4c726d5", "value": "384:kZyRSg98NaIyrLPb3cWESES6ik7azsIij+ZsNO3PlpJKkkjh/TzF7pWnU/greT0k:SmywFrzb3cP7QuXQ/o5/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662019240, "uuid": "a57b983c-4e96-4765-8fef-8e64f2fe466e", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662019240, "uuid": "a4b4e6a6-e96d-4e4e-bd01-1d62a0980827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662019240, "uuid": "389921e6-71a0-4e2e-8ee2-246b948c9871", "value": "E3589724F25B06655C87622BC518CF9DA0805AC7EF113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da7008d-29ad-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662006009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006009, "uuid": "bf68c53a-04a5-4ef6-b9d9-2cb321b7f83b", "comment": "Malware payload", "value": "cb19c4519311f209b28b5f10578f0f3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006009, "uuid": "db62b4cd-321a-4418-8184-1a99d2886d8d", "comment": "Malware payload", "value": "e3de45508183f73125ac09d349928685e844c8742f35df3ec4350c3a8cd8d7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006009, "uuid": "cbd031c1-7486-43d2-8efe-d30e8f5e8464", "comment": "Malware payload", "value": "40bd5eb3f4029c3ae80764eeb50d2738e900a90f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662006009, "uuid": "f2c651c5-9ae6-45a5-8b50-dc8aec94d1c3", "comment": "Malware payload", "value": "e11e08b7ccbbd206a2d1b6bc56963a3ff9057b3cb170f61a78891f61e04ca50e8e7adb64d4049b44f75108b283f9dcac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006009, "uuid": "22dae6c7-60c1-44fd-a01b-ab27340f38fe", "value": "T1EAE2B547F66E873DE369167977BA96F002286F1734658C9CB0D0FD8F097198C89222D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006009, "uuid": "5313ec22-ab37-4b93-8e47-f2d87f47057d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006009, "uuid": "c6f7b1a4-22b3-46f9-9f27-4321a556a3a7", "value": "384:DHu2zsq5mwE6zlnWLRmRwgRUOnb78stQBSdXe:Cc5m6zlnigRRtnHzJdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662006009, "uuid": "325ac2b5-4690-48ff-a247-f63370aafb5c", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662006009, "uuid": "015453d5-9c8a-4e64-a744-b2e14917741b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662006009, "uuid": "4820779e-57db-46ba-aaaa-4f0de3db5561", "value": "S003762822047651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c6c664-2a20-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662055541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055541, "uuid": "116a40b3-7012-41fa-8f5d-c78386066aff", "comment": "Malware payload (RecordBreaker)", "value": "058450a2b3a8364cd9722a90d22b0014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055541, "uuid": "0556d7de-cedf-4d09-baff-03db765f8c75", "comment": "Malware payload (RecordBreaker)", "value": "e3f6666bcc343098a21a2c52ee8a63d03c042b9dfd4cb1dfbf984c6d0e985da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055541, "uuid": "534f1406-0c96-4d83-a90c-768587ccdbc6", "comment": "Malware payload (RecordBreaker)", "value": "5b0df91436c449d0a308b76ef7e0a36ace0844de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662055541, "uuid": "282e10c2-ebdc-4f50-921c-47edf165319a", "comment": "Malware payload (RecordBreaker)", "value": "2e5999c5905f0d8131f41aabc7e6e8926785db6685e5bd58936de6039524b20da7e0adcb56d871be5d2a18fca2ad9173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055541, "uuid": "2e456041-1abe-4e28-81a6-c3346d001288", "value": "T17425AE2039D59531EDE250BA07ECFE320A6DE8F00B2146CF56CC57EE86246E13F36996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055541, "uuid": "77ef9ef8-02b1-4d6d-83d9-12f1afed4d0d", "value": "885c07b22374dc1137a9f063282ad390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055541, "uuid": "2b70611c-f0aa-4223-9e14-5206c7c366e0", "value": "24576:ZDu/Jx8xtmEiOjwhSYJox37O8lo4wWwFuWzy:wHEiOjwSlUWwMWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662055541, "uuid": "c9da9360-0dd7-4676-ab1f-e1563684aa1b", "value": 983968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662055541, "uuid": "94ade6a8-8855-4919-b154-3f6f55ce6dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662055541, "uuid": "b8f3ba1d-fb80-4c71-bc35-8bc865625a88", "value": "058450a2b3a8364cd9722a90d22b0014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f933ae-2997-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1661996500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996500, "uuid": "03cd6e13-8d0d-4508-b68c-7921c8bab3b3", "comment": "Malware payload", "value": "b197154971461163a41fb822552d465c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996500, "uuid": "c3b73208-0de5-4d79-9693-3cc4a4106b7d", "comment": "Malware payload", "value": "e40a2ef3428c29f6373dd18d106eba845193d756dc832a8748b22e049ac48ced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996500, "uuid": "e13413c9-058d-4833-b413-a3988773eb16", "comment": "Malware payload", "value": "9b4f70797a6176c38d78e208bc12cf849b59638c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996500, "uuid": "48af95b9-3d65-4c44-854a-8ab14bcb99b7", "comment": "Malware payload", "value": "9919f4daa0b19b20dca4cbca067de3443593654ea330cafe955e5fab520cd3e45e15a6564b743bc14b1c7b52ce79c364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996500, "uuid": "5a2851d9-463d-4213-b574-2506a93947c6", "value": "T1BC552221F9C284B2E5721A345EF8D3716A3E7D225F39CE5F53A42A2D9D701C19238763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996500, "uuid": "c9c8fb91-59dd-4aab-adc6-3700336689af", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996500, "uuid": "e626fbf3-72e4-4488-8d13-5448f3819b0f", "value": "24576:hZ7Xar2VsBq/OebRtMQOF+ZWtSGAbypQIrwbGhXa2xBY6PcO/U8w8ndRpIoQfrKc:NsaWFNwyp7rw64826PcUU8rfZQef3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661996500, "uuid": "775db63b-f735-46c2-a42d-cc7d629762a3", "value": 1384008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661996500, "uuid": "19b9e837-df8f-45b5-8ceb-30b87ce68f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996500, "uuid": "05c964df-f577-47b2-bfb7-cff65fbb1920", "value": "b197154971461163a41fb822552d465c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24258c7-2a29-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662059409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662059409, "uuid": "3a7c0f5b-5b27-4e85-887c-4d1d8d24140b", "comment": "Malware payload", "value": "d33f5c381c8a2dc544c313355ba4eb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662059409, "uuid": "52e37d68-456e-4410-8f05-802768ddf5e0", "comment": "Malware payload", "value": "e40f0c222b4e696c27be11d5250c3763f04e5c4e7f1525becd1ec11b333b4c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662059409, "uuid": "29501d62-5627-42b8-8356-124aef10b629", "comment": "Malware payload", "value": "a342afff06633cacdb904c28ec7b78a8bfd559fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662059409, "uuid": "c71bd199-1462-4ab7-80c1-af35dc879f6d", "comment": "Malware payload", "value": "aa44f077867e9f6db5e346218c21c4c8fe13826bb0bd318fa0ad73d4c2edb9f8b0b6a73ff60c10a3068802f00f1a0bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662059409, "uuid": "9bfb461f-1131-436b-8543-4eee97830d2a", "value": "T1A3C5330BE2C5E9F3FC0255345EB9E9260C36B52A6539A8B673FCF8191E235607F44386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662059409, "uuid": "3886ed79-ea6b-48cd-aa8b-7d99824d7d1f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662059409, "uuid": "0812c18a-dd4d-4278-93dd-5bdcf21b051b", "value": "49152:AGdM6Fyam6/shkFP63zokMa5YY1ukGkF9JSjKpjLU4PRsZwYxWNFNg9zSsqOOKX:ddM8x/ukFyZ5F1uK/Jl84WZwY4NFNg97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662059409, "uuid": "bdffadbd-b3ea-445c-8e7b-c120d4ae919e", "value": 2574749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662059409, "uuid": "bf84b9f3-5825-4e3a-b700-238ab9f6d4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662059409, "uuid": "e395eceb-f9cb-4b62-9491-17d2f8fbef74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1f5505-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662027889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027889, "uuid": "094550b7-0fd6-4705-8966-fc89afe86faf", "comment": "Malware payload (AgentTesla)", "value": "e78b7b5708bf45fa46ce636d371badc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027889, "uuid": "bb113b37-e4b9-4cc9-94c3-b650fc60c8b1", "comment": "Malware payload (AgentTesla)", "value": "e494b204a5493348b13f727b2046d1cffe8d054444b0476a53a24186dadc2f2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027889, "uuid": "1f456e35-0773-4614-8528-700575cd5da7", "comment": "Malware payload (AgentTesla)", "value": "5a67dfb218b8cd5f0289c2cb9c8b0be4f4cc8e47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027889, "uuid": "f8e467dc-41f1-4bc8-9bb1-79697f4c91f7", "comment": "Malware payload (AgentTesla)", "value": "ac876df296e10b05eada89e742e64b08f65b0b6c230cab2bca115ae6e55dd1532c29a9da467441a8045ffa9575007bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027889, "uuid": "3feadc31-674b-42b5-bb6e-37e2d95d93c6", "value": "T13A350286E4CCD3F6F01A0A700D61F228567ABE218571CD99AEDFF59C44B470292B7E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027889, "uuid": "d9b3048b-febe-4c6b-85ad-d3283098ea9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027889, "uuid": "8bc65dbd-7434-469c-b3ea-d0f58712f97c", "value": "12288:eF75eM3o57uRyA8rdwn5D0+hpHVZCYRI+umocPEQimgPwqoXY+mzoRtbvRT7D:eZ5vi6exlqvRIAoWimXY+mzo3bvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027889, "uuid": "ffda7607-8cac-464d-85e8-d8dc1d259f91", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027889, "uuid": "886e7d93-fe5b-4d13-934d-215546c05f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027889, "uuid": "60310ef3-5585-4c21-a543-7308eebfeddd", "value": "DHL Consigment Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f714a6-2995-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1661995880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995880, "uuid": "fbc280fb-1112-4a2e-ad88-4a33e033ba40", "comment": "Malware payload (NanoCore)", "value": "99023804aebc2187653da5ec4f4c91e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995880, "uuid": "7513d0a3-d485-4cbd-9de8-2ad94b0c809d", "comment": "Malware payload (NanoCore)", "value": "e4b9d4a547bcd7aca2530b346b411824dbd83cdb7025d5ef876063a48bbad24b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995880, "uuid": "1b54c3ed-fa49-4d41-a170-cf52084cc8e4", "comment": "Malware payload (NanoCore)", "value": "f75e4f07d2d11970a7d211c6363559d3d49fdd5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661995880, "uuid": "b8d90c86-da96-4ff5-91df-6a3eaf16722f", "comment": "Malware payload (NanoCore)", "value": "ca005cb08238650c41df09218d272b1fe77a0249d9c619cee0c80cf1e4b0741ba17285202943a48c0ed770a07bf4b853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995880, "uuid": "d4cef494-84e1-4283-a113-5389159f37ac", "value": "T1FC75019F6F84BE40D13C77F1266D925093BBE1C398518797A9CD85983B636C07C8CA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995880, "uuid": "c16dcd14-0ff9-47d1-83e0-7b823ce14335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995880, "uuid": "9d6a4c00-bcfd-418d-ad39-11715e49f70a", "value": "49152:2YpKNeP1ku++rl0+/Cm5a/4jDQc6o/kSje:2YpKoP1kj+BNCQa/yva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661995880, "uuid": "3b60c315-dd10-4c7c-97dd-54215da38902", "value": 1649664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661995880, "uuid": "27351688-bb36-4a51-8846-8c5b0dd924a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661995880, "uuid": "fc4ce5d3-7fce-4424-a1bf-aa2ba66fe849", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7364.16746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a9549b-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031093, "uuid": "167a627f-8ab1-4a7e-bfb8-1e8fd80d34e2", "comment": "Malware payload", "value": "dc95fe88ba4d832e54955ff300705c04", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031093, "uuid": "ac53fe0c-2ab1-48ad-8b1e-e3302bd3a5e5", "comment": "Malware payload", "value": "e58c3864cd1b425c3432d7d82e7f480729e6759bec45507c6d87f5e0aa84a8ae", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031093, "uuid": "b0396aab-96f1-4730-8c66-2636597241b0", "comment": "Malware payload", "value": "27ee768cdc24ab457e9e6de59248d5e4a575ee3e", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031093, "uuid": "b7c2a5bb-1298-460b-9bc3-196cb1c2f5ed", "comment": "Malware payload", "value": "6108873efdbea9a08027b40a153463081af0d9a910c27224f09d9a93dfc8ed8125f4e63de65bb8418f3e83aca6aa8417", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031093, "uuid": "2d3fab79-263b-4a97-985f-fda91a220d46", "value": "T1D9132BB30613BEDF57270E41E50C2151DC59E8A762DC9DACBF8888E58BE41289DB8DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031093, "uuid": "bec6bf05-5906-49c6-b6e8-bc0fc43dc9c3", "value": "768:ZGhUt4KaeqDA0qjCfUaBoT7RmpN2kfgnt/XpXc3ytC:ZGi4KxqDAQ8aBoT7wpkkfgt/XK3UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031093, "uuid": "e1ca1fc5-4732-46cd-8db2-548ec8cedcf9", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031093, "uuid": "7c0fa04b-679b-4baf-a619-ee58297103f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031093, "uuid": "8eae0a0b-ff3b-48c1-86d5-0ca1198a18a1", "value": "w1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9519d2-2a0a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662046224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046224, "uuid": "9a6bfc69-6155-4422-9c73-29ce7b17d681", "comment": "Malware payload", "value": "463ff9a7fd90e299b432f296156dd605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046224, "uuid": "41f2c383-924d-4adb-b210-75f03baf8860", "comment": "Malware payload", "value": "e69e57ff76fb41026b66eb352f576efdaa2c9f013a6e6a1d77e916251cf7440f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046224, "uuid": "fecf3496-9c1e-477d-88fa-0e9ec5414337", "comment": "Malware payload", "value": "2183ac24046be1118914c1fbb3a89088daf7b099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662046224, "uuid": "dd38d8e3-1a31-4d9a-acbb-e96260864025", "comment": "Malware payload", "value": "167ad795bd1aa0d856ef5d4db4c137aad5111405cc5e0c9aad454c51c326dd01fc08106f74e77c659ab7fb8bbd27a0da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046224, "uuid": "5f6d41a8-0eca-4fb1-a27a-6341b6e098dc", "value": "T15E74D6007FE94B06F1FF9779ACF11C318E7AB4E3A566CB6E188A419C08627009D5667F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046224, "uuid": "df5ba2c0-f48d-4f2d-b544-32a243c4475e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046224, "uuid": "9670bf15-5bc8-4b2a-a40a-4b87e69b3b5b", "value": "6144:rrHeA1dx2TUyblH39xiBXHuLAKuEXBi7BH5AdMizNgENAHNWNJo:e1z1tG3uLAIBiQNgECk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662046224, "uuid": "7188e3df-e78e-4e2c-a808-fc401e9de8b3", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662046224, "uuid": "d4b7a0f7-da28-4dbc-a65a-66a86ec4e4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662046224, "uuid": "52ccdac8-c396-4db3-84fe-7fe5b46f3c39", "value": "Scan Document.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4dbcf70-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014745, "uuid": "108c108a-2612-41cd-81c0-540aee5d70ef", "comment": "Malware payload (Mirai)", "value": "297deff647c0122a632792be86ec627d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014745, "uuid": "7dd655df-fba4-48ee-a27b-6b4d1ace81ac", "comment": "Malware payload (Mirai)", "value": "e73f1870960ca37d69eeec4c39a4d64671d81980b278f144ed870aa8c750986d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014745, "uuid": "12363390-9966-4f63-80c9-798644549fea", "comment": "Malware payload (Mirai)", "value": "8e2c8027854cf3443d341560b302ffbfce3e38cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014745, "uuid": "ed3fc07f-1350-4869-ba1b-2887d0e93429", "comment": "Malware payload (Mirai)", "value": "bcf93e2ea87c9a153f1a2dff0c64778c2225db9e36f4d5ef8f1d66cc87fead56e1c9e6dc8f045a31a743668f20a2f01d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014745, "uuid": "912610bb-4531-47a7-b4a1-2135241faa64", "value": "T17A534ACDE683D5F5DC1704701076BF368BB6E2FD2268DB46C7B49932AC92602E506A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014745, "uuid": "a99968b9-8a3c-4a84-9be3-a525d526b174", "value": "1536:obabtzWuGtiIOQ9cGzryfzQc9zX/wWPRJBNVrZu:obabtzhlVayLVFvwAPNju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014745, "uuid": "5b37bce5-44da-4a91-9f63-544af7d8196b", "value": 62672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014745, "uuid": "fd976e70-8a2a-43ba-a550-09b1060e2d64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014745, "uuid": "1e6b84cf-8dfe-49cd-bf87-7f0b74fb5cf2", "value": "supercat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5e98d1-29a7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662003564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003564, "uuid": "fef0d167-040e-4823-87e0-70fc421dae78", "comment": "Malware payload", "value": "6e098ffdad3f6d636f6176802ec94274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003564, "uuid": "1df5b8dc-9344-437e-aa5e-3bf68a9066fa", "comment": "Malware payload", "value": "e7993a272971102ed4d9c608caaae58dab59fbabcdb071fe32abe1d5d5ac52cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003564, "uuid": "143b2153-c2b6-43aa-b8b9-ebe3fec485d2", "comment": "Malware payload", "value": "f849368c962a4898bd302f347ecf8693f1a9e6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662003564, "uuid": "30e2824d-78d4-4e91-a08a-101449209b4b", "comment": "Malware payload", "value": "ed9cbfddccae0b2fb0b226976eeb867001ecd055ad5c0be28c894d496b88dec360d8f3545cb9a2aa6249d4ece92ebce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003564, "uuid": "703d8dfe-c258-4043-bbc7-513b43d76082", "value": "T192F2E867F64C471DD368C6F9B5BF5A300264AF032402D99CB0E1FF8E69763AC99126C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003564, "uuid": "d27c7d3b-5bf3-40ed-ab7c-7bc8a7042a93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003564, "uuid": "17e08d5a-997f-4ac3-9091-9d0f79e5e202", "value": "384:B6vzT7J9ZFchg+UyLp6GdHrZQ9BaLbjIdqYv3TxtmAYuistQBSdXW:A7T7JTFchg+UyLQGdLZzwrbYuVJdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662003564, "uuid": "e8b72e71-f2e4-4015-8bf7-fc8cb3a0c70a", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662003564, "uuid": "7286ea7e-9b16-443c-a7be-14588aa18adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662003564, "uuid": "3bad2c62-b903-48f7-9645-bb3ff138d4cf", "value": "rpt1661216698_20220823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcee3ce1-29ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662018732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018732, "uuid": "92253fb4-5f82-4234-810e-3d8324d4aace", "comment": "Malware payload (Formbook)", "value": "bff45754f3e0f83d42e8765a3f555711", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018732, "uuid": "e1ca8158-7118-4685-a4f4-5f545164ba79", "comment": "Malware payload (Formbook)", "value": "e7adc99d7eb2bf7b5cf6878236331755c1c57f7815a8a72cd322a341a99adbf0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018732, "uuid": "ae7a6c40-7c32-46b2-9786-fbcbc11d1e6c", "comment": "Malware payload (Formbook)", "value": "426f9a1ce98192dd4855474ab0ef40f108a08ece", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662018732, "uuid": "97c75f5d-9c83-4b3d-93bd-2ec6162d6fb2", "comment": "Malware payload (Formbook)", "value": "24579c526dd5553df62473aa577380dacb76afd6cfbd3ad0946655e6d1df8ec857f61e0af8b2805fe009565aab5b3f42", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018732, "uuid": "eadb28a6-5657-4d74-bddf-f9f0523f78b5", "value": "T1C473020FD242635E245A0590C737C1B76331BABD925C960882443AF7BAD52F16AFDBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018732, "uuid": "b4d2c3fb-dde7-4ba4-b876-43e43f758ee9", "value": "1536:RiTE41STDt7eWz8NWDX94O/y8/8yWGJaA14PPosiW5Y:RitqDt7eS8NWDXyO/y8/86JaA1Xso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662018732, "uuid": "d1e8346a-568e-4e44-a1c3-087f53291ab0", "value": 79321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662018732, "uuid": "42733891-1efa-4f55-aaf5-6386da9a8aee", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662018732, "uuid": "06fe38f7-e449-452c-b3f2-07f85a42b7b6", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c50661-2a01-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1662042018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042018, "uuid": "87fc5d19-cabc-4486-98d3-78a1b37010ab", "comment": "Malware payload (DCRat)", "value": "fdaf757d00b87b4573e0024d31c09f7a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042018, "uuid": "0a06b41f-5fa4-492e-9ad5-612f57e1fff6", "comment": "Malware payload (DCRat)", "value": "e89e26efad420be6cc0c3a7c0d3459cb820d1393220caeed011ddfdc81cc57ec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042018, "uuid": "fc0d7c81-19ad-4ae5-bafe-8240f73fb9aa", "comment": "Malware payload (DCRat)", "value": "7dbf65524858f25cbe26ea5ba3418dccc34e6f23", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042018, "uuid": "4aad7b30-f5f1-4eef-a8e2-beb0136a9b73", "comment": "Malware payload (DCRat)", "value": "f516c884545668c1e164ab664ca6f6ce5482002bd5cbd4f1b48c940254d9ddf2fd615d1237a85714cc142d4f9670b2f7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042018, "uuid": "70f7300d-4dea-4bc7-80e0-c1bb7ef03af6", "value": "T17B658C027E44CE21F0085633C2EF494C87B5A9516AA6E32B7DBE336E55123A73C1D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042018, "uuid": "16db2c03-8110-4ecd-9181-d7eb618ccd6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042018, "uuid": "86093096-2058-4408-b707-1f4bb10b0450", "value": "24576:eemqmCPxSYezGxRJgNwj41HFYBzs0urnQlkAyywch5HSF:h17PxSb1wMliOnekFl05HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042018, "uuid": "373585ff-3269-4b39-8163-d14ff87ffe4f", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042018, "uuid": "8b0d1345-cd78-40fd-b6d8-23dd06aa3d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042018, "uuid": "e02ed2e4-474e-4c47-9b1f-8eab9ccf5afe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b797a948-29e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1662030641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030641, "uuid": "21d83216-dcd7-4ad6-ba02-49c22fcc7973", "comment": "Malware payload (AsyncRAT)", "value": "9b3a6a3b6b0fc35d632122542bd89eae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030641, "uuid": "354b6402-e2c9-4514-89b3-165881c5c15a", "comment": "Malware payload (AsyncRAT)", "value": "e8b15948351e4c8b67c73da3c3693b04d50348791370e607a25b884683d2ea46", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030641, "uuid": "e96661b5-e660-4b27-85ad-d5eeaf27acd6", "comment": "Malware payload (AsyncRAT)", "value": "e87cd874ca09c5379aa6baa7cf77b35f48f09773", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030641, "uuid": "97a0be1d-7056-481f-81d5-9f1443c8d441", "comment": "Malware payload (AsyncRAT)", "value": "67b805e00feee64ae88d9c40aca7681717da98e9e8d4001396a632280c472e0ee584412a5d9cabe6914a09d5e6a040be", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030641, "uuid": "9d406fc3-8f4e-48d5-a574-f451d6620470", "value": "T1FB34E187E3D348D3C15C1D75F2438B870770E30978DB8A6BA49D2299098F3AF75866CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030641, "uuid": "286111d9-8bfa-42e2-a6c5-61c31e2a103b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030641, "uuid": "f8c0d19e-496b-45d4-a5a0-9244ceee8d7a", "value": "3072:iuFkZiVajx+IOTuXTam8jNTcPb/w5iNLHmm8OBjGCNRrcfV7bltRAdXp5rW4l24X:iuCBSC/cfV17Q7CVdKrL3oJ8LvMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030641, "uuid": "31cb94ba-e8d0-4916-a50b-39ce111b53f0", "value": 237488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030641, "uuid": "beefd84b-5982-4eb8-a046-7965860a0d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030641, "uuid": "ff70e8eb-7868-48b1-81ae-b9533c0d4ff9", "value": "9b3a6a3b6b0fc35d632122542bd89eae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9907ca1-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662031128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031128, "uuid": "dcd20d7a-8fbe-4819-8d9f-9fc626fdfbdc", "comment": "Malware payload", "value": "9696725da84af3e08c930b66ecbcce68", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031128, "uuid": "0098c1c3-59d2-48b2-a4d7-152930899cdc", "comment": "Malware payload", "value": "e8f5ec787e065d84668e41662531c170fbe709f55f9a9c7a9e709baf69cfe863", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031128, "uuid": "f9dec4b6-403d-4c90-bba4-b5545cd8d780", "comment": "Malware payload", "value": "33c7d8e69e637db3af9313404bef2cf5aab7906f", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662031128, "uuid": "d3592348-b0cf-489e-b63c-c98ca7277986", "comment": "Malware payload", "value": "41400e8474534b4f88c37406c42c2eba1c4c236124a905d586f082c1d08daecdf266496f893d8e5b3c95e8a9e5cd0db8", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031128, "uuid": "c76f4ebf-cba0-430c-b280-0c57dccdf9ad", "value": "T173132AB30213BD9F5A220D45E50C2111DCA9BCB772D999ECBF4848E59BE4118DDF8EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031128, "uuid": "30336c29-1f87-4cf0-8c3e-37dc015059d0", "value": "768:7yx8rtu+TwK6GBJ0WvzRmnxi2kfgnt/XpXc3+:7DxTw7SvzwxVkfgt/XK3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662031128, "uuid": "ab3a8132-24d0-4d78-951a-28dd4fa899ee", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662031128, "uuid": "7ceb4664-6697-4c8e-adbd-2e340caa44e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662031128, "uuid": "0185e8e1-19cd-4374-bf61-3279176b3aa9", "value": "ZX1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be607d1-29f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662037279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037279, "uuid": "71af4475-6ffb-4279-b111-3c63426afac6", "comment": "Malware payload (AgentTesla)", "value": "0cfaa7fd1d997a9d61a9152c662ee219", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037279, "uuid": "0bdca525-9da3-4496-8d97-81d6625675ae", "comment": "Malware payload (AgentTesla)", "value": "e98f12057ba032f1bd8beefa88cfdc19d4d60ec8841501ec70463cda13023387", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037279, "uuid": "c571464d-06bc-4e2c-bf06-4bad37004f6b", "comment": "Malware payload (AgentTesla)", "value": "c2b7fd40a6c0a3f159bbca3fbcf8273dbd607e07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662037279, "uuid": "591df89f-49d4-4d40-a14f-7fb5dc0682bf", "comment": "Malware payload (AgentTesla)", "value": "0ad33381e57c7b6c340cee896fc45cb27597d66cdced2677eea78f38397935876f316573de089df459da792d6aced077", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662037279, "uuid": "89af60f1-9c95-4915-8c2d-9a10e0fd6267", "value": "T1C9529EB996C69EA5CB02C1E2676E3A543C42B578C2D39D80F5ACF3348F585DE0A17C31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662037279, "uuid": "dbd102e9-bb18-46a2-a93d-ac46572d70f6", "value": "192:qWpaSGZGPu8L+x1hgVY9KdRnP2AI0GF3JbrZK87LQmVNVEjINrrdo7ZVlzysJX8c:u5ZGPuU+NVKdRPjIDLHQ9+o7ZVlVmmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662037279, "uuid": "bd2b526d-9ec5-4f90-9645-1fe22e136f66", "value": 13761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662037279, "uuid": "7d23a9b7-990c-483c-9afc-260a3b45c8d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662037279, "uuid": "574b434c-cf06-47f7-b62b-810662c22c03", "value": "Data sheet.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5847c79b-2a1f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662054963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054963, "uuid": "3e156227-c5ef-4195-b500-22a097b9f5d0", "comment": "Malware payload", "value": "5cd1a7bef56fce17322fa9eea4537447", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054963, "uuid": "3083e2f3-643a-47f8-bce5-546761810a5f", "comment": "Malware payload", "value": "ea5a47032e6962162a6473db0c2f8e1be2c21eeb2bb2b938a6cbb97e66da39fe", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054963, "uuid": "61b334b3-e301-482a-9dac-8f317376e3af", "comment": "Malware payload", "value": "20d7c877186c45e694200380c5673d7b8f275bb9", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662054963, "uuid": "f197c272-515d-4d73-9986-6a9dc35ab1b0", "comment": "Malware payload", "value": "9bee492100e2fdf0157ccb445a538c6bca87ea171dd320752a0199263496aa01c894710a092bc43e3b3ed4ec811ad258", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054963, "uuid": "3f377774-e7d1-41a3-a571-0a621a10748e", "value": "T119E32357B88D0936EBBC5A39031522877F9446E6292F237A4D277313070992E27AF03B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054963, "uuid": "0098a8c1-46fc-46da-992b-a93e57af67b0", "value": "3072:WEhPwP8Cf4blEH6Ybz1mOcsKQnbEnLGRTrfs0YW61mylQPagnDNWYOSCTY:1ho064ZnyDnXeGRs0YeyYPJjOSC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662054963, "uuid": "766da2a9-755f-48ce-8909-cb09629a8b8c", "value": 148365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662054963, "uuid": "05b3205c-7fac-4c2f-b2ad-407aa8e70d3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662054963, "uuid": "6fff6b90-cb5f-4d38-a8af-bad1d10ec02a", "value": "77259169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afd75cf-29dc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662026057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026057, "uuid": "10695549-bcc8-4864-92a0-018303fafd18", "comment": "Malware payload (Formbook)", "value": "cf987f86907e06bef94e98efac168c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026057, "uuid": "d7d6cfb3-b08b-46ff-afc8-c1b51cbe1ba3", "comment": "Malware payload (Formbook)", "value": "eb5553282526065116c7a3beaf3c707052f9268b5598fac475f6f96c88080419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026057, "uuid": "33ad1bdf-ce84-4dc5-8bcf-2151a6855f54", "comment": "Malware payload (Formbook)", "value": "a7d695075eb626818030d196e53a54df61fa204d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662026057, "uuid": "5876a5f1-d6f8-40dc-a0da-2f892059fe81", "comment": "Malware payload (Formbook)", "value": "303b50ed4db0dded50d6701929307771d5fb3f8543f1a1077f7a8cf06f371773cdf56ccbc30451b168dbd4ed63d0f47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026057, "uuid": "46a0a8ca-1fcd-48ec-a780-284f50ef3974", "value": "T1200512242B5B9D23D4A40AF80892D79193F5E7229513E38F695C67BDFEB13C40E891B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026057, "uuid": "23615c9e-3646-4320-9227-bade1383989f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026057, "uuid": "3005dfdc-2fa4-4164-bb9f-76598d3fb804", "value": "12288:NzP6+aG6xFjjvuEHslgDay6nyn2eA+W5aGAN/dBuPM9l/8FeDa0MZC6VWLlcNCjo:vCub+W5alzgw/8FIaLZHWxcNCja0tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662026057, "uuid": "169b3887-a89e-48c1-907f-02a727bcebc5", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662026057, "uuid": "c952cade-eea0-445e-9e89-27bebffc71f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662026057, "uuid": "ab52fdf9-318d-4044-abf6-b82c5288ee80", "value": "USD92.15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c2e35c-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1662028090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028090, "uuid": "bd0eed61-11b7-411d-b1b8-235b7fab8c34", "comment": "Malware payload (Vjw0rm)", "value": "50a3c831c1edab5db5cef251c0f3f2a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028090, "uuid": "07cdde7b-2b99-43df-b81f-e6a4a62f2b74", "comment": "Malware payload (Vjw0rm)", "value": "eba955d84fefb31a29d8b7751edca895db13ebbafb8ebe73b84d402eb7562a6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028090, "uuid": "51b76bfe-6077-48b3-bd1e-a35df4d149a9", "comment": "Malware payload (Vjw0rm)", "value": "6f0f8a96017138c67db8f7ae5a59bd3473b2662a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028090, "uuid": "e5cc2384-1f6e-4b07-8471-b3a6818547df", "comment": "Malware payload (Vjw0rm)", "value": "3bf8523f7466485692b6359f2710216d78fa8744144800ab13bb0dc8093951c0846d747b1b82940dc1dffae3a79d32ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028090, "uuid": "b61db6f1-c4de-4790-8610-060254f35feb", "value": "T1E6D160683F90E5CA4F865E7B241BD885C3551A597A80CC4FC241FC2A3AF4712BAF7932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028090, "uuid": "f4841b68-0b63-4754-9867-e164bad1c125", "value": "192:1w0dXeB0rvDw2WkDR51R5nUipLc5Tt70g1b4Mn+ggmyI/Do:PXMTLgD1R5UiITtJKM+Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028090, "uuid": "f50e2d45-15f0-4286-8508-67e9c5a3587c", "value": 6355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028090, "uuid": "0065253e-2931-4f6c-8014-72e3ada4be12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028090, "uuid": "dbfeb15d-874c-497f-b082-d4a350d57557", "value": "eReceipt006.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6c5a1c-29e5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030225, "uuid": "ffbd888d-a7da-44d3-8f60-9b7835f89abf", "comment": "Malware payload", "value": "0ab873579b559f0f27dce3adbe54ca4f", "object_relation": "md5", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030225, "uuid": "d5a0259f-84c9-4e79-b888-c1d3ecec8cd2", "comment": "Malware payload", "value": "ebadd662bb797b5077e24638de04a1554e19a56362d8fabe1ea6b6903491c95c", "object_relation": "sha256", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030225, "uuid": "a5b46dcb-a22b-42a8-bccd-133b53b0870e", "comment": "Malware payload", "value": "e814237eabaeef49d0fb97b1f52ba4e0e984e36f", "object_relation": "sha1", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030225, "uuid": "e2a9bc5c-e9c4-4df6-9ad9-fba334aed913", "comment": "Malware payload", "value": "a39f529c18bbb1f186886c930bd5e84dbfb51c4361828a110dc293d67154ab749fb486dc95f6e0ff2ae0f736bf61bd2b", "object_relation": "sha3-384", "Tag": [ { "name": "149-248-52-31", "colour": "#9F791E", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DangerousPassword", "colour": "#7B5349", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030225, "uuid": "e796ffda-121f-4a50-bada-dcbae5efd906", "value": "T1FC31CE0137DD4614D3F68E37687AE30049AABC196E23CB5D0AD0E29C6451A04FD3AB77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030225, "uuid": "25e0e2ea-ee15-40a8-8e9a-9227b40c7c6b", "value": "24:8B3cJ5+Cy9s+TqAeRYWDv8S8o0B2ARjVuWAbMlJsh+/QT4I0G:8B30mhZwnvYoJUjjA4JshfMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030225, "uuid": "5ea47115-aca5-4703-89c5-554d31b432c3", "value": 1861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030225, "uuid": "cff02d78-fd76-485e-aa2d-c0f3f4f94c3f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030225, "uuid": "177724f8-2301-47cf-8c71-b7e16d0d2770", "value": "ebadd662bb797b5077e24638de04a1554e19a56362d8fabe1ea6b6903491c95c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a11664b-299e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1661999426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999426, "uuid": "474d5e61-820a-4b59-aa91-e2b417b19059", "comment": "Malware payload", "value": "907e1d4dd1029467d9734ee9bab44d32", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999426, "uuid": "a4bdc025-3f81-4e6a-a51f-730550670739", "comment": "Malware payload", "value": "ebc69aded3362d7de668370defe38b2295d26192ff5d2448112d6bf6daf7f5eb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999426, "uuid": "9332fc06-55ac-4dbc-92c7-8005f5fcfda7", "comment": "Malware payload", "value": "40c3bcf2d2c8eb01ad20a8b9dec51dfeb97a1095", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661999426, "uuid": "df7f3b04-a402-4bbd-9315-5a761c797f29", "comment": "Malware payload", "value": "9cea3968d7cf98e75b14c7c423f9b02b51605d1d4922ee1bee361ceeecf633f84577c917f70fe0b65eb481f703dbffa1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999426, "uuid": "b5eaef8b-4a1e-414c-8a76-4ca552120c3f", "value": "T1E074130BAF6DD137DE5AEABCBE97988036418490962B83CD3407F53CB16DC866F48875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999426, "uuid": "4da4fca1-1da1-4e70-8bd0-e2967a26d1ef", "value": "6144:Tnx/EEbLX0VuFkbQ9odH4Kr9IuMi/lq7ctjY3LMl61lkyyJ8tpC:Tnx3bLX4bQ294mSi9qy4LM7iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661999426, "uuid": "cc75df0a-ddc2-4a80-8844-31ddea7b000e", "value": 360029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661999426, "uuid": "375e82a0-0c8e-4a55-aa70-08853db5b4d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661999426, "uuid": "437267b8-0c17-4cb0-bee3-219c4ee347f4", "value": "SecuriteInfo.com.Trojan.GenericKD.61627654.3198.28293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5eb60e-2a11-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662049091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049091, "uuid": "38fa37c2-08bf-48ab-8fd9-6c45782093d3", "comment": "Malware payload (Mirai)", "value": "8bf08f435a68aeced1f71ccfbfece7a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049091, "uuid": "7fc58110-d843-4a09-b2c6-ba89c3156484", "comment": "Malware payload (Mirai)", "value": "ec90e0253eaa25ce4f2a2491512c79d148cf191aaf7604977b386407e09f1f7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049091, "uuid": "26ea2ee0-c0e7-4a56-888e-5894255822ce", "comment": "Malware payload (Mirai)", "value": "48026bb52de94ec31b68c6cce5bebb302a5b5f4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662049091, "uuid": "f7d56136-e50a-4048-8356-c3441186f77c", "comment": "Malware payload (Mirai)", "value": "eea5496aa19d9c4fbc3a6a093142071c5ccf9a706dcc454db841a3697183566ac5a61553b86be3870a2e2835205566d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049091, "uuid": "e4d749d3-5f55-419f-ac68-7212d5154df7", "value": "T112235BC09A47FAF4DD1506713073FB328B7BF03A205EE997D399A532BA41A45E60729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049091, "uuid": "e6be7d9f-6c22-473f-a406-5764720aff94", "value": "768:cMGnPBhicHkawr+3upmW1HSvKhz04yt0lgq8PV439q638dtMTNS5mA:cMGnPBhicHknrgcH1ymz0ACPO9338sB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662049091, "uuid": "1a9cef0b-4f1a-4b9c-a709-722c92543d1f", "value": 47376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662049091, "uuid": "caa0cce7-5c92-4118-81ad-069fae3faf3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662049091, "uuid": "1e62e4b5-7443-4134-b44d-4e060e4d96ac", "value": "8bf08f435a68aeced1f71ccfbfece7a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59ecd43-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014747, "uuid": "9f2583f3-4518-49fc-918d-42ae619f27ba", "comment": "Malware payload (Mirai)", "value": "f86cb39650ca74a4d2d7278a85cd9b43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014747, "uuid": "24266e29-a0a0-4d3d-818c-7ff33e45142a", "comment": "Malware payload (Mirai)", "value": "ed25b3a741c0716292a1ede53d0b78d9be083b29aa23955d7c86751d839efdb8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014747, "uuid": "9dc02f90-abc2-4314-b467-9d323b69fae0", "comment": "Malware payload (Mirai)", "value": "049d33f5da37e80a3cb35450bc422cc36c75e7a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014747, "uuid": "b3205fc7-6fde-4f8a-9b73-c422ef760d47", "comment": "Malware payload (Mirai)", "value": "bc9a23a679ba6312cb7dd328757222de70b065c1ca5d6084b24c7216f4112bc20ebc1ea10b91e9cd819b4bdbe1f730f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014747, "uuid": "8efb325a-bdba-4025-8c34-847dcdc88c96", "value": "T1C293A409BF611FB7E86FCD3705EA1B0124CD564B22A83B79B574D828B21B14F59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014747, "uuid": "711a28e1-8c84-4bc9-b7ce-21e29c643fa1", "value": "1536:2xWS/p5SJmnFytnqlts+RtQ0w8QZ6L8knb8Kna:2xWS/6on+2Q58QwTna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014747, "uuid": "eee17c70-d3e0-4dc9-bbf2-f51ae900395d", "value": 97044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014747, "uuid": "79ade5f7-4d65-49f1-b3ea-9486feb15d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014747, "uuid": "29a0831a-6b93-45bd-9290-1030b37550aa", "value": "supercat.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a9ad0c-29e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662029287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029287, "uuid": "626a4025-6d39-4b7a-a2e0-b6d9781503ad", "comment": "Malware payload (RedLineStealer)", "value": "0170d2b9bfeecaaa3ddef7d51e4c8b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029287, "uuid": "0f4159b6-f8f9-4381-abdc-4a5a12f1e24f", "comment": "Malware payload (RedLineStealer)", "value": "ee14304fc7093949120ceff81188f2cf7c057a915734e03e25af01dde0543121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029287, "uuid": "8d62b9ee-4a0a-4d6d-8b19-81004051a3ac", "comment": "Malware payload (RedLineStealer)", "value": "7b6a6494d9be0d513df09f8b744eac49015746f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662029287, "uuid": "fb90ae0f-eb80-4a68-9d85-140bd14307cf", "comment": "Malware payload (RedLineStealer)", "value": "bb5d0b90b6bb69e8fee920496e9d09544c4e346565ac04fbf71e68c7e593e82a75bdc4d04863399b1ee91e0ea8c14062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029287, "uuid": "1ffbcae6-1c48-459f-af9f-33bec2f37a79", "value": "T1E3F3BE2B93C5DE63C7E9017D40EB06944723F8101632E72BF2CD85A55F9B3EA4912B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029287, "uuid": "5c33a4c2-553a-4cca-ba75-4b3dcb1c41a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029287, "uuid": "eefd358e-9364-4309-93b6-c57766e02070", "value": "3072:RR/wGF0gk1F99LhG6tq0+gucgC5DCfnKrj4AUqDmF2AEk4f:zwct2LhVt8Y0CAemIAvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662029287, "uuid": "ccce80f1-2b46-4f92-b9d8-a91033ba9a11", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662029287, "uuid": "9dd89815-a74b-4f4f-a62f-b4a64c566488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662029287, "uuid": "887a59e2-5fb3-48d1-84f6-369f5204a8c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8a36f2-29bf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662013851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013851, "uuid": "18cd0671-1b1d-4269-bb6c-d902e3c25aa3", "comment": "Malware payload (AgentTesla)", "value": "0da3d1e6aa8c7e348cfdcadfb1046bf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013851, "uuid": "f0eaedec-7eef-4e36-9485-d869fa268eec", "comment": "Malware payload (AgentTesla)", "value": "ee942043dcf1388de5861ddc222f18f8016d1c1219c6414f899820efe1b62058", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013851, "uuid": "8cddffe9-5352-4bee-a364-245c1502de61", "comment": "Malware payload (AgentTesla)", "value": "2e30d6fae9b8c98f74ccc83cfb49411b8ec5a777", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013851, "uuid": "16c7ddff-8516-4695-9c65-c86141ffcf0a", "comment": "Malware payload (AgentTesla)", "value": "6b83659c0e53c3a033c9aa05937724c2e6a64658fedc92206cc5a6ccd4606e0502d335a26f9da4868b1f88b8490486d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013851, "uuid": "da5e6ac3-4816-4f26-b5bf-8c9c3da44399", "value": "T1BB03280432B1C422D455CA318EF6E2DB6B60BCAAAE32971B73C9371F2D356D0C95375A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013851, "uuid": "68913a86-c7b9-461d-933a-f9acca9689df", "value": "384:9HHx0DUn3+fuNHPFpQb9etRM1aKKNpztJ82iwmXfWig+Hg+cQbuZnDA/Wpfo:z0DU3MSjQb+RTKktJ8YIGnpfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013851, "uuid": "6d0dcfc0-5f1f-4dde-ab25-cea197eb460e", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013851, "uuid": "8a80a7a0-dcf3-4e37-b89d-0a74d93e0aa8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013851, "uuid": "170258be-703f-419e-b8be-d6c42eddec85", "value": "SecuriteInfo.com.VB.Trojan.Valyria.7101.7905.2281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee8ba77-2991-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1661994012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994012, "uuid": "f5779b31-1dde-49cc-8379-27386bef52e6", "comment": "Malware payload (AgentTesla)", "value": "e4e623b6aefba087ce9f11135c0b12f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994012, "uuid": "8ecb4c5c-3d45-46d7-a614-a8310e3d269b", "comment": "Malware payload (AgentTesla)", "value": "eebbb6b5b8d9afe86b6424f28a4c873ad248507a6c2547d3f861a6c3592d77ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994012, "uuid": "a063e11f-af94-4677-81d9-27242aafd042", "comment": "Malware payload (AgentTesla)", "value": "d51844e0dd24771ea75cb4b50455f4890f18e586", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661994012, "uuid": "fa9625ef-f175-4abc-8626-9768e6617e4f", "comment": "Malware payload (AgentTesla)", "value": "c1dd77901d937d35e473b954b48eb7844efcdcfaf15c9fe3ec74801b89ffb3443f3ad49cb0e6a382f0cf3afcb5a0d099", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994012, "uuid": "34715c8b-944d-4750-85b6-04adb262a6a5", "value": "T1BF15D0C522A89A29C63D4FF58463830143FB65492F1EE33DFEF110ED1A26B1596C16EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994012, "uuid": "2d8260fb-73c0-4ad4-9986-598bd2db8612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994012, "uuid": "2d0bc484-0c13-4b4c-b08f-c112a141af11", "value": "12288:bzvIh6KTNoPu3XDG2nZB05DCSiYl5YmHk/+TIfxbmpOXrZM72mRc3MPP:3S/TNoMG2ZB057ZkldmolMp0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661994012, "uuid": "d2219d1a-0154-42af-a28c-9cbe65eeafaf", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661994012, "uuid": "5526ca17-87d7-432c-a93a-50d9a4b05fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661994012, "uuid": "cf53fdf6-c534-4782-b977-12847755e922", "value": "23082022Paymentdetails_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837a1a73-29e7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662030983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030983, "uuid": "7a751614-0692-4f5d-a817-88c056607d85", "comment": "Malware payload", "value": "ba0f7b2121fa13579f186bf281597bc0", "object_relation": "md5", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030983, "uuid": "2f625fa1-3448-4b8e-a78e-4bd70c1c99dd", "comment": "Malware payload", "value": "ef6c12aeecc552d8eadf1a992d0e2c8e1dc5ce76e55bf5080400be0f804af797", "object_relation": "sha256", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030983, "uuid": "9d76e521-2158-48b0-9b6b-e84176dc4a20", "comment": "Malware payload", "value": "b2827edf3023418d0c0b37834c5cd7845a915c37", "object_relation": "sha1", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662030983, "uuid": "3fd7189d-33c9-4374-af4a-ca9c5e72ebb6", "comment": "Malware payload", "value": "f4e303bb1e5307e6cc074e8bbc54f6d5d4e149563b88a49dda96a58cf7b9918b9fc1adfdfe403051519c739bc50eeb53", "object_relation": "sha3-384", "Tag": [ { "name": "91-241-19-49", "colour": "#A1F89A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030983, "uuid": "b56856c2-1121-4da1-b4f8-072cd208c0e6", "value": "T11E134CB31E42FDD06B7E0E82E54675900D9F3E1B93B88DA47E84045C29E6711FF1E9A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030983, "uuid": "d897aa8e-ab9c-4b07-90e9-7bbf054613e5", "value": "768:8S/EYFO9yw721/Pk4ubthVUxTKKPrRrWqDKE8W9bRQKzGikuv3NwJRu3uwuRR+u/:8UAb72Z/ubthVUxTKK9KErN52GZW9x9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662030983, "uuid": "abc7439b-a6ba-4657-b34e-bb75f64f0879", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662030983, "uuid": "ab551a17-e8f3-43c2-97af-53b3b8fa5e8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662030983, "uuid": "d39a99fd-6416-411e-bb88-ce5ea8d7d7cf", "value": "JAR.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a39c5e-2a3d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662068063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068063, "uuid": "47d4cf06-d4b8-4c6a-8f2f-d0f5f1e793b9", "comment": "Malware payload", "value": "c039a3986e1ff6908007dfda04492296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068063, "uuid": "60dbca38-073c-4dc4-87a4-3c172ea6c8d2", "comment": "Malware payload", "value": "efc035ff598957f35768f2d84721bbec76633c60538eda9d5ec53092f4384237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068063, "uuid": "d44d7f01-13a5-4031-a525-84dc5238e0bd", "comment": "Malware payload", "value": "9f96b5604608eeafb8105049f3036684f149dda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662068063, "uuid": "de2ba691-51be-442e-b802-87ee4540b7b9", "comment": "Malware payload", "value": "461ca7ce7dcb6479177b5cdcf66a85b42057f63289861323a821a2af850f023483146e8d94c77718a443e828c771998e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068063, "uuid": "ffce2596-6bce-4e3c-930c-3b8ac8991b9b", "value": "T178F4128336D4E252D5948B39F5E7D392DA7ABD344EB0550B7250EF1E3A30382A80F369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068063, "uuid": "29328d9d-983d-4913-a5e5-2e09e1b26eb3", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068063, "uuid": "3cc3a7bc-6d16-4044-8af3-3b5d642d2545", "value": "12288:jqUyPO6sfIg5W8o0lgwYNyE7ZMjL3V9YAgcja7bYtleahPrNC4T6ouo8y2:oW6h0W8oyYIiMnLRttM4uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662068063, "uuid": "69161602-a845-448a-aa8a-0c4e8dc58cb5", "value": 771280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662068063, "uuid": "10de65e0-8e3f-4c0e-836e-1b184fef11ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662068063, "uuid": "aa7b20c3-5e60-4fa9-b51b-8029e91804e1", "value": "SecuriteInfo.com.Variant.Tedy.195971.2955.30957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f51129-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662039868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039868, "uuid": "0a281161-738d-4e26-9392-f7931061e219", "comment": "Malware payload (Mirai)", "value": "3c1099581c0d65aa12d894e4c7b31f05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039868, "uuid": "75f96cc7-9a80-4dac-964b-641b6ffe015b", "comment": "Malware payload (Mirai)", "value": "efe99999614596828f209be3248a5d07d6965fdcb8a63c28495e1589157af2aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039868, "uuid": "683767e0-a2af-4c8d-be85-9c587adcfea4", "comment": "Malware payload (Mirai)", "value": "53eb8cc9a309f028c26c2a467cd2d8529a9f403b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039868, "uuid": "4bf63b89-1e7c-4e9c-814b-635e978343dd", "comment": "Malware payload (Mirai)", "value": "3fef187b5afe0366af03c88ef76234ac661930e332ab0b4f8f8ee635af3aaf77a246a13056eb329462a3b7b227758ec5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039868, "uuid": "40a900f4-18c6-49b8-b08a-86620b692758", "value": "T17FB2D0EFBF346CD9C485B2BB6A2CD9B14C4734A19332A36762494002F17A7211AB5ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039868, "uuid": "344443ea-2a6a-4a9c-9706-a6ad38a94c3d", "value": "384:MyJt4+n277AT+pz+5XTMwZb8wYhTXYc2hJeBu1YCW0VttzYMvm4od0Oy25P3yL1:Jo772+454wZve7CJJ1Bo4m4kmRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039868, "uuid": "be34cea9-b376-483f-bbf9-286d3532267e", "value": 23916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039868, "uuid": "5bc267a1-4059-428c-834c-52536334ff9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039868, "uuid": "67d89adc-4d07-4dd7-9b3e-66b721a1c514", "value": "yakov.x86-20220901-1344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c27163-2989-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1661990782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661990782, "uuid": "9f222e68-95a7-4e4a-93a3-7b2f553b7d73", "comment": "Malware payload (AgentTesla)", "value": "aed5e5c44bae7a16bd43c8322c173e3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661990782, "uuid": "1581b97c-07a9-4fa3-b263-a1311eb9ca92", "comment": "Malware payload (AgentTesla)", "value": "f00d1fc6f83fb805db9d0ad31a92b4cc8b5d47e5006ab6af0f286699fba0f97b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661990782, "uuid": "03e4b4ab-a247-4c08-bfe7-57d0267a8c61", "comment": "Malware payload (AgentTesla)", "value": "c15d59eddbf7a7c04ed4f6eaa2854eea459a1a8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661990782, "uuid": "c7c46f04-9b83-4dfe-9a2a-7b3e7897d4ed", "comment": "Malware payload (AgentTesla)", "value": "3748a23e0984c93bd8ee9339ee40ac34966b0b46a9c2ebdc0c2bdc74eb28ce386f3801fcfc9860570099472c071e0215", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661990782, "uuid": "09387e21-dccb-42d9-94ba-118522717382", "value": "T16A15E12921F9B14BE135BAB54DC760F20EF4E932DD09B17FAC997A86C2959C34B4C312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661990782, "uuid": "4e4d2fd4-193b-4014-b4df-626243268f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661990782, "uuid": "1a638beb-899d-4f17-a148-7baceaa96d48", "value": "12288:5eUwrxpG2iNTaauuALRZWI6j73MY+333DZBa5BP9IV5JoNbe0i7+cAeJzp4huOL6:AUwu1UJuSf6jrMY0DZBatIqheAe1GQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661990782, "uuid": "b7c75fe8-0a44-4894-8289-3ae11dbfe956", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661990782, "uuid": "370239e0-7ba2-4a05-904b-80f1cf6a3e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661990782, "uuid": "f1246cd1-6e57-4376-9842-9f451c280046", "value": "BANK SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ff4787-29c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662014751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014751, "uuid": "2f66f7c4-8694-47ff-8990-8ad660701678", "comment": "Malware payload (Mirai)", "value": "d11891e7b02d161be21e3e02f6958602", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014751, "uuid": "ffc155e8-a732-4a8a-b262-a0b9be4ae335", "comment": "Malware payload (Mirai)", "value": "f07b7c01fe03a4426c5ffca21c1c897f5defa3c4064077577be02c187dcf892c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014751, "uuid": "95e1a94a-67af-40c5-aa70-9327970f62ec", "comment": "Malware payload (Mirai)", "value": "87f26594dbfc7356ba0da94e323eec1624f43154", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662014751, "uuid": "72d0d1d3-13f7-4c04-bc7b-84787edeeee0", "comment": "Malware payload (Mirai)", "value": "01a6dc6365b648bba17098db16025256710b3cda6c13e450fed6bf12ce3af568b34c88dab191b2113e740c720c9b2d9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014751, "uuid": "c2f99e4d-464c-4eb3-8b2b-9b70ddb16297", "value": "T1D193940E6E219F7DFAAD823587B75F22965833C627D1C245E1ACE6011E6034E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014751, "uuid": "cf3d194f-ddc3-4b68-be0f-e250658a8ae7", "value": "768:Jmdy3woEO5EsCxmBNh0oqF3ktIOJ5jfOskZbHuo2JggFxN19CWcqF5fzfWYhJsdn:hOHoqF3W1UB2ugzN1YWcqyYCIiedtWWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662014751, "uuid": "8bd02233-b972-483b-8866-f3aa368fa0a1", "value": 97044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662014751, "uuid": "3fd79336-1e13-4147-9063-efcfcee58ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662014751, "uuid": "db73ce77-afc2-4fae-b50a-91c6dabdf0b3", "value": "supercat.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d4f00d-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1662028414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028414, "uuid": "91b714da-9503-45fb-9816-e818341cf8d7", "comment": "Malware payload (ArkeiStealer)", "value": "56f93259f85df7a1c2674608dd8efcfb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028414, "uuid": "b0a34cc5-b01a-4fb0-8c0b-d2b4d7b9b28c", "comment": "Malware payload (ArkeiStealer)", "value": "f0b1c1bef9f65f6a69d2fa3211fffae43afdbb144bf24fd1d889a26fbcbcfafb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028414, "uuid": "dd29e263-3099-440e-97db-900eb5f9b047", "comment": "Malware payload (ArkeiStealer)", "value": "e0283924bb5adf6d4013c76d67c640a35e4c605c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028414, "uuid": "3e449a7a-f9c3-4d3d-8a50-953cfe099916", "comment": "Malware payload (ArkeiStealer)", "value": "df3edbe706eb794582d638beaf5763abcc61103c22996ea76248272b233b52c580a359cbeb7deee5ef47adf287bf1c92", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028414, "uuid": "892e144b-f16a-4418-a3ee-11253f020015", "value": "T11A94CF00AB90D435F0F712F4567A9378B53A3AB0A76454CF62D92AEE57386E0ED3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028414, "uuid": "84789ec9-6871-4869-81d6-7247d74d4b79", "value": "4bf820a5a1f7ec117ba307fe2d4372ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028414, "uuid": "a6fa0a4f-b2a6-4a64-af73-839afe93a913", "value": "12288:hScgcVt171braO2WobKhjA6b0y9JQIzqzg49:Acf7ZrdeGjjbD9JQI49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028414, "uuid": "1ed5e599-de69-4e95-91fc-54dfc60c7511", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028414, "uuid": "3dae6174-1852-4896-bf05-fc2fc9d147b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028414, "uuid": "5bc034ab-9d9c-4b49-b3c3-5d29be0741e0", "value": "56f93259f85df7a1c2674608dd8efcfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd9d9f3-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1662027833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027833, "uuid": "5a8f3ba4-1abd-4bda-9e7f-e4a8375ff7e6", "comment": "Malware payload (Loki)", "value": "1ec0bfc713ef2f529233bdc48acdc23b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027833, "uuid": "c604ea54-3861-4b6b-85e7-65a872e17da3", "comment": "Malware payload (Loki)", "value": "f1237eee91267a3490ded2801d50ae1aee37daf1a613e16d5574325acf2f2065", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027833, "uuid": "b78506fb-35c1-42a1-b628-f20423a2a618", "comment": "Malware payload (Loki)", "value": "b07a600233a2fa55df48f5937c8ec0425e6b7010", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027833, "uuid": "732cf7d5-245b-4b3a-92a9-6f8b4990b837", "comment": "Malware payload (Loki)", "value": "47cd5ae6bfcd13e87e3beef8f28275b8fae41503592cccfedf4f8ef885cfb5bd7dd2ca4cf6181e741e1926d7e2faf8df", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027833, "uuid": "e633f2b4-2a8e-4a92-849c-35dda2855c8f", "value": "T1BE1502895684C3B5F4271BB11171F22492BEBE15E275C2DC9FCFB2EC49F8B029257A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027833, "uuid": "08d5a3bc-e76b-43be-afc4-b462df2965f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027833, "uuid": "6d4ee184-08eb-4109-be02-e9e00c3c5b03", "value": "12288:vF75eNgPwqoXY+mzoRtbvRT7obsJtcENY+5rXWjK40vvV85aWsvOv0hnOVP:vZ56XY+mzo3bvjD3h8j0vvVGfMhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027833, "uuid": "49044174-52cb-4fbd-8a2a-04077828d6a2", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027833, "uuid": "705163f1-bd1e-4a63-bf21-b40090f82565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027833, "uuid": "cabfc700-0198-4e8d-ad30-9903db298656", "value": "DHL Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff63e01-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662027944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027944, "uuid": "fa4bc092-1dd1-4de6-9801-5952a7efd761", "comment": "Malware payload (AgentTesla)", "value": "376a071aa7ffed74b4cfd8a1f3ded645", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027944, "uuid": "85224bf1-5d55-49a1-a4a0-ae8aa1fd9633", "comment": "Malware payload (AgentTesla)", "value": "f300002be3d755c638fc1cacd1b1d0f8a51dc6d1ddd1bac7fda5529c4d4604bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027944, "uuid": "86a49711-84c7-4092-b2d4-3ecf3edc7164", "comment": "Malware payload (AgentTesla)", "value": "13bc74fbb4a9a2373af0acb7346de7ee7605ec82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662027944, "uuid": "2cd22425-0452-4f20-88ed-c9fd73c20242", "comment": "Malware payload (AgentTesla)", "value": "991b115c87ecda6cca2be535dd0e7b1fd62f16e4f641c69d2a2b5c4a759f8dcaa34b4872a197fcc1546b6679fc54ff4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027944, "uuid": "bf7b07ff-b485-4a0d-b44d-9899070234a3", "value": "T13191354227F0398803B75BE7B73A94D2D69B68BE2DD99C06A100F9D86D90932CCD5E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027944, "uuid": "f191ad78-3a11-4651-8729-b59b29273198", "value": "96:vlUWmAlwaSBXNdV1AxAWWzo6o9u2uUy+0PoZpA/GMIswMlI7/+7A2Cc/Ql3FbsOg:vlU0lbSBBmxAWWzzo9u2uUyrPqMIso7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662027944, "uuid": "64db020f-d73c-4a15-ac1a-ceae8b88704f", "value": 4441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662027944, "uuid": "a4f27da5-8097-4917-bd87-e14ead91809e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662027944, "uuid": "128f807f-dee9-4f58-af08-24215bcdaf95", "value": "Shipping Details_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e0ab95-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022158, "uuid": "220493e6-2ff6-4566-9c0b-4960a73c9ebd", "comment": "Malware payload (Formbook)", "value": "173d537e179df13b7178b1f9df196468", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022158, "uuid": "e0b9b494-d8c4-44f7-84e6-1720abdf5135", "comment": "Malware payload (Formbook)", "value": "f44ce0f53fdb372e0304cbfc3c02ae6c2f53a2ebd3fee99447cdbc21bf019bb8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022158, "uuid": "5fbd4d98-adc1-4fbb-b552-7f7e0105660e", "comment": "Malware payload (Formbook)", "value": "4fe92b03922448bcad0be0a4edb114b87e3cfed4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022158, "uuid": "be77ae4f-c5c8-4d96-9405-ba67076f1256", "comment": "Malware payload (Formbook)", "value": "e8cac6e5ae487b6e6541c374f2ab80dabefd0f4943e10a12d843aa1ee8996efb469dff162a62ff63ca220590e28c5a91", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022158, "uuid": "548b4cbd-77c9-454f-bda7-814d1e3aa232", "value": "T185D42314C66E6AAC43B80519BB16014A29975F9DBA740F7F9F6C4C432B72FE1C0EB847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022158, "uuid": "529c7cc0-f949-4c87-b1f9-06cf1c750da7", "value": "12288:Vw67pggLC5P38NeDIdTKatkDWWAN5FwjA6+ukdRzw1wiFdWM1CpSSAkXG:z1bQ38Vk6NTxjYl8puk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022158, "uuid": "655479b6-9934-467a-9da0-5f276dbf4871", "value": 619004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022158, "uuid": "cafd4cbe-f1c8-46f9-9bd3-0b89aac06a53", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022158, "uuid": "8ab8f7aa-7606-44ab-931b-eb34b8399016", "value": "RFQ-31-08-2022-Doc.pdf_1.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d223c85-29bf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662013847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013847, "uuid": "ed9ecaef-c10e-4d7e-aefa-89d1d7f58ae5", "comment": "Malware payload (AgentTesla)", "value": "ee6bd5b5ecdbfe986443a823d6fb771e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013847, "uuid": "9d0b6abe-5a04-49e2-b61a-497bc0950f30", "comment": "Malware payload (AgentTesla)", "value": "f451db59d5730552ffdb65bdcece7d8f664816925024d93e34be21d796ccf800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013847, "uuid": "f556240f-506a-43dd-b8bd-f2d95b11c667", "comment": "Malware payload (AgentTesla)", "value": "4f3fcca29229afe4999c329410b2616f04277ecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662013847, "uuid": "d4d9545f-e7fa-4de4-9fd9-2120ff04c6f5", "comment": "Malware payload (AgentTesla)", "value": "b807d5ff04497be8b37b4e620d441a50546d142db3242a2a1a11977e5e5e2570f73fd3b53c1009174c41bfbd72712929", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013847, "uuid": "f9b51045-5649-45b0-9998-275e303e43df", "value": "T17103280432B1C422D451CA318EF6E2DB6B60BCAAAE32971B73C9371F2D356D0C95375A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013847, "uuid": "a0862db5-b0e0-481b-a75d-481742f78cb8", "value": "384:9Hmx0DUn3+fuNHPFpQb9etRM1aKKNpztJ82iwmXfWig+Hg+cQbuZnDA/Wpfo:W0DU3MSjQb+RTKktJ8YIGnpfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662013847, "uuid": "adc94fdc-4d03-4cb6-ab73-a1f9f6e037ef", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662013847, "uuid": "0a34e534-da1a-4714-8858-6e56cec91472", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662013847, "uuid": "85c28f9c-3410-4062-af1d-0df9c09a3915", "value": "SecuriteInfo.com.VB.Trojan.Valyria.7101.17611.3854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a37952-29fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1662039870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039870, "uuid": "67296e46-4caa-43e5-b459-0ac4f2afeaae", "comment": "Malware payload (Mirai)", "value": "1f6691f2a87af8b0a623bbc4f89e0812", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039870, "uuid": "3be7adad-94a7-49dc-9164-8cc0b4fcccc6", "comment": "Malware payload (Mirai)", "value": "f4da3a6be8ea7bc08703a539fe9f2d9dae0ee4d751ebe9dce3cd634b1a70b261", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039870, "uuid": "bbe8952f-010a-4587-a687-71992ea95726", "comment": "Malware payload (Mirai)", "value": "dceedfe3816466a263af4898ad51bb35f1286caa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662039870, "uuid": "d0b92329-1b95-4015-bff0-560bc5e3ab3d", "comment": "Malware payload (Mirai)", "value": "5cec36fbe38bad3552bafd4e3b5fd0f7234934f11f5afb1d4392ecd140928fff8d64bbf188f90efb69096546a3e8b63f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039870, "uuid": "e76b8d65-3c75-4cf6-a6cd-59f7eedd02ea", "value": "T1E9B2E0E4E1A517A5C471EC33A9F0CC437D92037DE3CF342A13898544BE8721E35AAA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039870, "uuid": "41745927-d746-42d3-8625-db696f3d6cd0", "value": "384:rqGhySU7CJ2OhRFCUP066p5eEfSPdPx/CJ9jgEQ823vlyDAHPXZrQhymdGUop5hc:+InUQCr66p5HOx/CP32fYDAvX+s3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662039870, "uuid": "23b5b260-65f5-4a03-b847-6e1bd5db981d", "value": 24992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662039870, "uuid": "75104b61-1fbb-4ecf-96f9-a3cd23ae162e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662039870, "uuid": "ed41894d-c755-4ed7-986d-171358573485", "value": "yakov.arm-20220901-1344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b46d58-29f0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662034790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034790, "uuid": "7d13a082-16b2-42b5-a9dc-d11da8ca1a4d", "comment": "Malware payload", "value": "adfa7c6f9a5bb355a58416b5b8f184e2", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034790, "uuid": "6fc0118f-1f05-40ae-8c92-3e7a0b9ba4a4", "comment": "Malware payload", "value": "f6d5dd00719c7e394d53e84cc916c08daa3ca2dbcac2b3d8626bb84794ed1f56", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034790, "uuid": "54fccc9a-4a78-4274-8e0e-7950ed3bce7a", "comment": "Malware payload", "value": "f7575b82fcca31043ceb18f8048e36edae18fe82", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662034790, "uuid": "28116c21-541c-452e-afab-0dc9ce4955eb", "comment": "Malware payload", "value": "73c029043c74811a339092e5c8901273affbdfca880a887aadff5c94c1846db92169a1208681c727e24af61781d6f53b", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034790, "uuid": "29c0e731-e30e-4f9b-9569-3ab5f5ade01c", "value": "T10DC0928A8A2A8D3BC768A2BE656B3A05C891A58C4930C8B2110AE5C50D0A8C11A015BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034790, "uuid": "185e5889-29ef-4302-a37f-0a216bfd16c1", "value": "3:vhjOtJjNxVc7XtK1r3tItelWjNxVc7XtK1vbl+lklX:5jOthVhOtRVBl+lk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662034790, "uuid": "4b50c5f2-e357-4dc4-9418-2ffe83061197", "value": 152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662034790, "uuid": "51a8b754-a6e8-43d8-8bd2-f734c20e6dbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662034790, "uuid": "82cd44f1-4757-4aca-bd01-229a07fbf7cd", "value": "SWIFT.TRANSFER.PDF.2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e30166-2997-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1661996547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996547, "uuid": "707cf792-8240-4298-8d79-51c884603ef9", "comment": "Malware payload (Smoke Loader)", "value": "17e1c480f5d2c4874ef0ad44c04e2226", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996547, "uuid": "16eb8866-3ea9-4343-961b-19d9624cf110", "comment": "Malware payload (Smoke Loader)", "value": "f6e24be9e0ca768072111142940fd7246e19b86459039ad68868600ca6b6901e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996547, "uuid": "a70c068b-dfdf-43b5-8593-31cd6e248eab", "comment": "Malware payload (Smoke Loader)", "value": "ea99c7988446fa43e0d1c308ef8ff4ef0e8e3f4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1661996547, "uuid": "ec6b30be-91ab-46a9-95e8-14512025061d", "comment": "Malware payload (Smoke Loader)", "value": "cdad845f2ad29869c16a03e16a9391fda0463a65ebcc5ddefbf09a1b7e8b73b3b8def6b96ccfece2afc0a10d010148f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996547, "uuid": "ef599f1e-b1c5-460a-8c80-5917658d9252", "value": "T1A49533E566C196A9D93589311FBE4FADA1242C26FCE3CB2B184433091F3336BD0E6597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996547, "uuid": "98d85849-684b-4b0c-a7b9-b8a4e0efa53f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996547, "uuid": "beb776e4-af15-4f05-873b-e62033602461", "value": "49152:75Uo3qfmfINBKfIzBLMjD6qP2WrGuGit:7N3qfmANBKcBmD1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1661996547, "uuid": "5e692931-7b5e-4e1d-ba55-56229b40c17e", "value": 1891840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1661996547, "uuid": "d8557d9b-9eed-4c83-a547-d917e3928ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1661996547, "uuid": "d911a3cc-6685-49f1-b5bf-3d93e621eed1", "value": "17e1c480f5d2c4874ef0ad44c04e2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3836e11-29d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022501, "uuid": "c086977e-41e1-4466-a67b-00882cf963b7", "comment": "Malware payload (Formbook)", "value": "37ffe497fa3482d78464a92a069c697f", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022501, "uuid": "583e8b25-d288-4d98-a2d4-f6d984bbffdc", "comment": "Malware payload (Formbook)", "value": "f74cc276efed80b7a39ef167c256c4572c50810d546f532aade1580e46a3020b", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022501, "uuid": "6c2b75ac-7d7e-499a-b7c0-70e866684124", "comment": "Malware payload (Formbook)", "value": "1089e8173a3e181c03187033a3f3a30d45e5917c", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022501, "uuid": "628fb893-c7c8-4baa-9c59-08b28a644277", "comment": "Malware payload (Formbook)", "value": "77f01942a7e17dd3b422a759a1da664a1019cf183c68eee0f253f93c897181c22bc2d91b260ab169a1d2c76f519a15f8", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022501, "uuid": "9d43cd3c-cc7b-4b56-8310-92ceca3de6f4", "value": "T1521523941BD2B8474A397B93A2B44446B367568BD4F9DA1CF0E81FFD2D7C213148A3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022501, "uuid": "5f7ef2d5-60e6-48f5-ac2c-555457a1ca15", "value": "24576:rEsSe3zvo7KtWnqmXyzTf66Xg/kLb73X9qnTECwVi:Ievx4nq+yS6Xg8b7UTECH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022501, "uuid": "cb5962ee-387c-4e25-92b4-20dbe6335746", "value": 899088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022501, "uuid": "a5d72578-1be2-4032-b45e-8d46a984001c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022501, "uuid": "a6c322b8-f50d-4c74-989f-2802734cb415", "value": "$23,248.98.PSWIFT.PAYMENT.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4b2188-2a02-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662042593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042593, "uuid": "b6d7c08f-964e-41cd-8a67-a2afa0152b53", "comment": "Malware payload (Gozi)", "value": "b08feac96c4d5df975726ec7e242ca4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042593, "uuid": "914dd232-6b46-4c7b-b1fd-c6902a1d8304", "comment": "Malware payload (Gozi)", "value": "f7be3225113339e20f77508df8315142146d3d2a66e93796ba89ef19ffedcc9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042593, "uuid": "995808af-a46c-405f-95d1-136ae00786f8", "comment": "Malware payload (Gozi)", "value": "c1d9b3dd20ebd247e50e36814ef6a8f4ee6e5073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662042593, "uuid": "0012c35e-89f6-44ce-ac87-c4df6f4e511f", "comment": "Malware payload (Gozi)", "value": "4cfbbdf79d1dedd568b232c5f8a66969531c3bf19ee027d7aae398d52111d097d8bf492b9f1179a2f74283d5928292b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042593, "uuid": "7bc3182f-2ab8-4f10-9324-c7d8bb98d4ef", "value": "T123344C5AA3E51999E96BC6B9CD53D227EBF374092B24C30F5370CAA66F47722B11C301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042593, "uuid": "2d0583d6-f93e-4bd2-9263-ba2a97080519", "value": "3072:m5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vFBB78C752cjnY5e:m+nZ1o+NJWbn2CMFIzSTRDR1vFR5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662042593, "uuid": "bb1c87a4-de94-4f89-98eb-0454e7091b44", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662042593, "uuid": "75a5305d-410d-40c4-b202-72f168ab890b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662042593, "uuid": "f96e841c-7c28-484c-b7e9-3d270d16031f", "value": "dc00000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef9efeb-29f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1662036881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036881, "uuid": "11520a26-1a6b-480f-9b12-d9dac07e385e", "comment": "Malware payload (ModiLoader)", "value": "94629cc73487cd5d990e228a0c64c2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036881, "uuid": "dfa2bf38-a7e5-43fd-88cd-406d6ce34ca9", "comment": "Malware payload (ModiLoader)", "value": "f85bf1ff072c013d0f427e613aed83108fb8efa061897eda3a84c5c15b1722e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036881, "uuid": "779ff8cb-c8b6-4c40-af6e-9f9ff16169b3", "comment": "Malware payload (ModiLoader)", "value": "53ed5bf555075b14b12cf71a8dc382fcf54cbe94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662036881, "uuid": "8ae4cbdd-1092-4763-89e6-0f301f99b9cf", "comment": "Malware payload (ModiLoader)", "value": "942cbdadddeb11c969cc452ab1d4598d2857fb39e62a5f5e62a94c6e628d551b0fd1f7045561870cd6309fea71229df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036881, "uuid": "2c9ebdff-b4bd-4f8c-837f-423ae0a6d4cb", "value": "T14C159EF672F18A33C0331A7CDE1793A49D29AD556E14798E67F5298C8F74680382B933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036881, "uuid": "f8648ee3-4147-400c-aac3-58c17b56019c", "value": "e44b1ce3d13e55963ede0f334a1c0840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036881, "uuid": "2f10fa23-b8bc-4b6f-82b3-f88d999425c1", "value": "24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662036881, "uuid": "26f8b3f9-58d1-44ed-92d5-38a6a05a1f17", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662036881, "uuid": "9e9c0837-5743-4707-ae99-983f28d091c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662036881, "uuid": "a4d062a1-6935-415c-8f7e-f97780929f4e", "value": "design A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdba32df-29ac-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662005741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005741, "uuid": "3c8c2fe3-1515-4252-a2a3-289ef703e8e5", "comment": "Malware payload (Formbook)", "value": "0bfde7becd7b674725c6444a7b98937f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005741, "uuid": "28de5257-4001-4f05-898c-28af825a3edd", "comment": "Malware payload (Formbook)", "value": "f87714d3ff5810a2e395face8850a524b222e6393507cd39c3f0ce8d7698c737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005741, "uuid": "c22d6a88-a571-422f-bd46-458ae7f96372", "comment": "Malware payload (Formbook)", "value": "5488ea98e6d940478c731dad328fb18bc82f01eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662005741, "uuid": "85b7f87d-72c1-4a01-86ac-adc07a8797a7", "comment": "Malware payload (Formbook)", "value": "7deae417c1ed2af07ab89dc28549aca3307621bd40d784091023c7e3aaf210a6c6d25aa6f79670d1f6862ab9fc4d1499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005741, "uuid": "06dd0753-90fe-47fe-8db5-ed1e4bb199f4", "value": "T169D401A837754F29C87C07FA4171818097B5A22BB6C3E74F5ED220CF2E6AB5A5704E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005741, "uuid": "0af980ae-9f52-4b11-afec-66ca7d4c0b8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005741, "uuid": "1c9bfc30-29b1-49f2-aaef-d0325896d33d", "value": "12288:2WDIGNMu3XDG2f2fARFiC1Kp31jRGMzzLugEd8EtUr4NYtbuBACafbf:HnN7G2f2fAyuKXjR9zzslGr4e9uBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662005741, "uuid": "2ef21d18-4370-4db6-9336-c577b74f6b5a", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662005741, "uuid": "1009b61d-5f43-43be-b79c-bd97a9b2020e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662005741, "uuid": "cc767636-4f25-4a19-8c98-35b6e0c65b72", "value": "PROOF OF PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8527599-29d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022536, "uuid": "d20cb699-f2cb-4ae2-9407-c2d3354b53d5", "comment": "Malware payload (Formbook)", "value": "ca75f24c186cb80bb6a84e1249554479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022536, "uuid": "c5c215f5-3ee4-4ccf-97e1-e59faf369d2b", "comment": "Malware payload (Formbook)", "value": "f8b99ac55d584370b7d03a41c99bde376e605b9456de2ba75e642c2db2e93229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022536, "uuid": "a9f4880b-244d-4198-ad84-f5e91144d21f", "comment": "Malware payload (Formbook)", "value": "582ef1ececd4730952e1f427b72fc2e39a6a01c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022536, "uuid": "4a87fb41-6107-4abd-b801-11e01ba1d820", "comment": "Malware payload (Formbook)", "value": "5b77d11eeeab8eeba60df57d75b061d50fe5221c1eae5f7bcb1f1b9fd339ffe39c1b4e82eff7c2334849c4dbf6bcde40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022536, "uuid": "fbaf604f-9633-44ad-8513-cbf126db7324", "value": "T12185E98576E8AA27D17B2FB190FB01901BBCEA41EBE5DF4D168031BE1C417407D5A3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022536, "uuid": "fc4eb17a-3fd2-4327-9ce2-421116cfd7a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022536, "uuid": "cd770873-9636-4269-b57a-15d184b76b19", "value": "24576:N/4W3tsHFhCXhZYJlD6LMNs9Ln77km/dl:btYFhCXhiJlDPyZIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022536, "uuid": "c1bded90-f28a-4a21-b4ed-339c88fdfa81", "value": 1788416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022536, "uuid": "3087e727-63ef-4f54-bd67-a0be8f1383e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022536, "uuid": "c85c1a5e-f7ff-4319-b77f-3cead386455d", "value": "nFZCo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe471f02-29d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662022170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022170, "uuid": "91159b67-d4a0-4bdf-a903-a0a6e958e0d3", "comment": "Malware payload (Formbook)", "value": "ae6cb26b374dab82d003cd7c2f10d84e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022170, "uuid": "66ae05e0-73d6-42be-88fe-b4e602593157", "comment": "Malware payload (Formbook)", "value": "f8effb5a49039f326486035af2df05546f1e7bf030034e04a953cc82c044671b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022170, "uuid": "ee2ade4e-e01d-40fb-8aec-30a5921221a5", "comment": "Malware payload (Formbook)", "value": "c22b4ea80f98a83e26f13b0550e2df09d32a9001", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662022170, "uuid": "736baace-2962-4fea-940d-2b537188ac3d", "comment": "Malware payload (Formbook)", "value": "618dfcc1a35a71ef69e38ecfc66efc8c867cfd864516a244f5ed2998d2dd759ac26eca6d92da302f5b946fcc705ff402", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022170, "uuid": "834ae968-8838-4010-9ce3-5f14a242c913", "value": "T19905236C45DA2050F4669824C7F57CBF70F6386109F26C91BDBBA0E60D9EB36782C169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022170, "uuid": "234abdeb-ae60-4e12-b14c-837f3cef246d", "value": "24576:KXiOpH/ls4VI90jpuMRXZn7t82ceCH4C7Ipo:XOFts0y4puMRXZnJjmnao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662022170, "uuid": "f51a959d-44a5-43cb-accc-8064d1e2769a", "value": 831386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662022170, "uuid": "17422a7b-d85c-4a03-a71e-da5ad93dfb1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662022170, "uuid": "14eaaaca-3a72-49bb-872e-18a4632e7435", "value": "U prilogu Dospjeli racun_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a99f937-29d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662023560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023560, "uuid": "6140287d-0884-44ce-93d9-9d156173ddfb", "comment": "Malware payload (AgentTesla)", "value": "79d49d161155847eb73726a2332d0e7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023560, "uuid": "381344f4-38b6-42c5-8a18-fdb15c11fbd8", "comment": "Malware payload (AgentTesla)", "value": "f8f97e9982461cc48aee7ea75ebb32e7f7d488cfa657c22c2ca39c51a4da5d58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023560, "uuid": "98cf8526-bb50-49a3-8fff-73c7bccfc9fa", "comment": "Malware payload (AgentTesla)", "value": "1b96a47f8ce802108e0f625faf2ecaee9f927410", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662023560, "uuid": "b020df84-159f-465e-99a1-2d3012e20f43", "comment": "Malware payload (AgentTesla)", "value": "fc1a6903f6dc635ecc1f73ec13171ee17599f0e79f88a578d81c5508bfea60f3300503270e58ceabf5c803b03c934c5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023560, "uuid": "5b2cffa0-c699-49de-9f44-7caac61bc77f", "value": "T18B34E682E9006674EE68AB346E33C93507127D7DAD78942D24E97D4B3FBFAD36025423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023560, "uuid": "b126ee8c-5189-4065-8929-dbfc3ce7ab96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023560, "uuid": "39434303-9bd0-48a5-9664-128b0db76a18", "value": "6144:DhNE08tYLtZpEUrdm4Vz0Rppppppppppppppppppppppppppppp2:nuUrdm4Vz0RppppppppppppppppppppM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662023560, "uuid": "506d8e22-0e39-4196-9133-85040550f59d", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662023560, "uuid": "9a48f89b-c171-4755-8626-77885fd1c1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662023560, "uuid": "2596ed97-0658-4d22-bfef-e3534207b2ef", "value": "Products lists and Specifications_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82caf8e-29ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1662041433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041433, "uuid": "2e8f9d20-7f61-44f7-97c8-adf351a6d185", "comment": "Malware payload (Gozi)", "value": "1bef5cff7deea59f329b06e93e8cfa1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041433, "uuid": "2497fa69-eec8-4ec1-b825-d189baa3518d", "comment": "Malware payload (Gozi)", "value": "f9a67c7fcb660340f406f1364db607139101ea166290f35ceccf628b12115928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041433, "uuid": "ddc66fef-2422-49c2-b974-6baceca30642", "comment": "Malware payload (Gozi)", "value": "755604f7aa552e63f1887c5d93c30bd0fe34781f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662041433, "uuid": "92a1cfcb-4567-4e25-bff2-75aa667e56b1", "comment": "Malware payload (Gozi)", "value": "1bab96b5898f219b49e5509e071a5910aa78550ab8b38a99edff8063de040aa5c447f580fa87248f6febd595dd1ea0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041433, "uuid": "d99ed22b-0ee5-4820-bf83-18c5b3f3acee", "value": "T11B246C6AA3E51195E96BD5B5CE53D227E7F330092B24C31F53B4CAA66F47722B21C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041433, "uuid": "383fae79-81c3-47b6-ae4a-cc02c2c7a7af", "value": "6144:SOZiNwkzdjpi5azwE2uP3qqMFTXAie5RjwN:SHwkx9cazwE2Y3q9TXthN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662041433, "uuid": "d6ec7d6a-cbd6-4b9f-8d73-4c8960373fbf", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662041433, "uuid": "7bf58493-c207-4af1-b373-84abb4e9557e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662041433, "uuid": "0d577ac2-1e15-4f78-bf71-2738f2079016", "value": "eff0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0b32d6-29e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1662028426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028426, "uuid": "ebf6a340-a868-4193-9196-46aaa617a53a", "comment": "Malware payload (AgentTesla)", "value": "9828c461afcb08a96a10579d5f854d8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028426, "uuid": "fce92509-ce5c-4ee9-985f-d5e064b2c0b5", "comment": "Malware payload (AgentTesla)", "value": "fa898193d74a20d95a965dc07ac8aee9f87b380d03186d8231ef0ceb6fc37d2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028426, "uuid": "386bd0a4-6569-4bc6-97c1-2bc6dd554d8c", "comment": "Malware payload (AgentTesla)", "value": "c83517a661eeea4d3425c154b220ed5198aa044d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028426, "uuid": "9335095f-e0be-418e-89b0-512b19d8eb9f", "comment": "Malware payload (AgentTesla)", "value": "e65d920d89d7b4fc097c825491cf0447e021c6fcf460754bfe2b83db3955f47867606b93641f8aaea205d8f0f547f49f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028426, "uuid": "0359ffe7-10eb-405e-aa0e-5000bfd918a4", "value": "T15C250289A5C4C3B6F4260B7011B1F61452BABE1592B1C3D8BFDFB2EC49F8B029117A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028426, "uuid": "91d93435-314b-4adc-9159-dad0b0352d4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028426, "uuid": "1c21fac6-df22-4a7e-bf86-5d120e68f602", "value": "24576:oZ5cXY+mzo3bvYr/2d6j7nhLUou+0hZZ:K5almzMQe8jzhA26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028426, "uuid": "b6ed7cb7-a51a-4ab5-8383-44a39956d110", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028426, "uuid": "c776e14c-009f-45ca-8ef8-539ae957c7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028426, "uuid": "eed12d19-11fe-46c2-94ca-95e0b2f9d95b", "value": "9828c461afcb08a96a10579d5f854d8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07e1979-29e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1662028106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028106, "uuid": "bbd59614-824e-43ba-b26c-2705e372e1c4", "comment": "Malware payload (Formbook)", "value": "d17e898e1bb47e8fb21657a547cdc22f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028106, "uuid": "59a2dbd9-4cc2-4a5d-8be9-4f824c8b0fbb", "comment": "Malware payload (Formbook)", "value": "fb3e15c8c0da16cd614be57a4e98aae0854dc3effde59aea8717452ea3b86ae2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028106, "uuid": "a309c059-00a1-4a04-b1e5-208345843eaa", "comment": "Malware payload (Formbook)", "value": "4ff74220e8ebdd567e4750134b4eb34fc7fc5cdc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662028106, "uuid": "25c9825f-4485-4d47-ac5d-07873075c2a8", "comment": "Malware payload (Formbook)", "value": "fd50add76e430cf255eab66e3f76b35cf0e03203fb0a756501c6a9cd88763fb7c9c0e428873462839b223340c5d866b3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028106, "uuid": "d240faf3-b570-4d3c-a827-4edc1b6074e2", "value": "T18C71328D74AB72B454331EF2EC9B406F21656757D17949A03B0EE9D2CC340ACA7C9C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028106, "uuid": "59c6abb3-c842-4978-ba78-0ab9abe9185f", "value": "96:dpMc6hqz+rn4bJk8rStLulIlAoEZVVD5ACgB:dpl6l4bJ7rStLulIlAo4D5Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662028106, "uuid": "30a4c98d-aa04-4441-8077-96524ad7418c", "value": 3647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662028106, "uuid": "b5211f11-a1d4-4ec5-842f-9755018da9d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662028106, "uuid": "3fd6e119-be09-4c6b-ab77-c518466ef8f8", "value": "Bank Copy677755544343_SMK84477464746.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35f9637-2a15-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1662050794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050794, "uuid": "c70163ef-fe3b-4c77-a4dc-bc1febfc6ee1", "comment": "Malware payload", "value": "2600f747e04252c6a273b0c48fb4c11b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050794, "uuid": "a623f67f-9552-455b-a522-b6112702e2fc", "comment": "Malware payload", "value": "fb9e0607c2b1a1396a79f2c571f7c1517abcf299e1ec8ac1b9c394d96aaabedc", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050794, "uuid": "50d9a657-7608-4b4a-ac7f-5fd5cb0319d9", "comment": "Malware payload", "value": "f8cb26ef8134e09198c72c07ef2c8ea5978102d1", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662050794, "uuid": "292ffe1a-c37b-48ea-9294-f24a56ed2db9", "comment": "Malware payload", "value": "9c784abd8aa251a66876a54fa43e6a32d0fdaba1ff1ca3685cbc7c4dc3a336bd247f288f6a6025dc182dffa0e3faa83a", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050794, "uuid": "a4b6a157-69a9-4b9d-805f-488229ed761d", "value": "T110F423F1FB620363FD90BFBC96A48C2013A58770F069D1C202F6DF642596F66B2815E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050794, "uuid": "01c9aa36-68a3-44e7-bdf5-5673c7eb61b3", "value": "12288:CkI44cOU87/hLkfmR7JgVdMN2BcIhVi7LxYtXn35o8jyYbIOYH5ytQxE/4aTNS8:j5hOU87/j3m+ABFB3jFbIf5GAEwCS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662050794, "uuid": "ecb54332-fad3-402c-97eb-edb88ec830bc", "value": 787458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662050794, "uuid": "29d669c2-7287-4c13-957c-8be4ce3ebdb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662050794, "uuid": "a9c260ae-3bed-4ac7-bea5-ac0785b7e586", "value": "PRD removed.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479af5c8-29c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1662017998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017998, "uuid": "fda22f67-efeb-4c3f-a91c-83bbb8359705", "comment": "Malware payload (GuLoader)", "value": "d53a3fed62f06f8de617b5fddcacdd9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017998, "uuid": "fb3ae6c9-5e5d-4eed-9ce5-5a21a8d249e9", "comment": "Malware payload (GuLoader)", "value": "fbdc7fea4ecdc2b577c79bad4b3bd0a4badddd415a5a66f2d1c2c08fe068aab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017998, "uuid": "0c4f40dc-3f6a-4bf6-af04-db3b39ba721d", "comment": "Malware payload (GuLoader)", "value": "1a6204155313a4c70d503c77c9efe86ed8e73e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662017998, "uuid": "b3da0317-56f7-4bcf-ab5e-09b53d615e2d", "comment": "Malware payload (GuLoader)", "value": "ddbe54ebef58724bcd429971b20a9fc1f95cd2c49ab23bf0593ffc5c2bcaae2ee45a001b2ea19897f3f4c005da279a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017998, "uuid": "778d9e23-56dd-46d3-afba-aba6abc4b0fb", "value": "T13C44E141B79052A7D4F14E729897CBA66772DF215B024B0FB394770E3E722839F0A798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017998, "uuid": "f15ae29f-20f3-4c45-a969-cfad59ee7d1b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017998, "uuid": "da5671cf-b26e-46d8-8b44-73648e2ca733", "value": "3072:yNRCywDw1DiJku2eE8gs2BfEuLygCSrdNaAirLjyWbuTbDQ/6yMvq3pzOP9ginfi:yT4DtnEBErg9v0jhb6USy4V9VfI4IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662017998, "uuid": "4cead2f6-1653-468a-84da-fa65797de6f2", "value": 276152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662017998, "uuid": "29472359-1aa7-4800-8504-d33d568bb9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662017998, "uuid": "bd361be1-28f9-47e6-af9f-405e31c41851", "value": "SecuriteInfo.com.W32.Guloader.E.genEldorado.2876.22225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b8ce5c-29c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1662015631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015631, "uuid": "319bcfc1-328d-4d93-94ca-11c92eb54a29", "comment": "Malware payload (njrat)", "value": "e5afa19c2c920a1ffa28667ea48fb590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015631, "uuid": "4cf7673f-f1f0-490b-927b-d4d06fd048c4", "comment": "Malware payload (njrat)", "value": "fbfac509c16a8f9d754668559780fd3232f9670057c93178b190c9ab63841ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015631, "uuid": "e48bd9ec-da97-4a34-bca7-fc8c6db5b165", "comment": "Malware payload (njrat)", "value": "7854b124d7e58357a8d37c28b76bfe89aa4e0c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662015631, "uuid": "45e0494b-2943-48c7-a310-1e5e22954515", "comment": "Malware payload (njrat)", "value": "d5e9fbeca911100ce9419903a07e2ec908bba89f6db56149afeeffea4328e36e164d34aebe78a2583fed099b05524b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015631, "uuid": "428e8b6f-2ee2-4f26-ab22-29164ed37107", "value": "T18F93E74977E56524E0BF56F79871F2004F74B48B1612E39D48F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015631, "uuid": "c9c1e59c-9fd5-4e38-8d8b-0ebd497f7542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015631, "uuid": "6df4af04-0cb2-439e-88f6-ab4b1a28a510", "value": "768:lY30UfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3BsGdpWgM:7U5WhIUKcuOJhPhBjEwzGi1dDxDWgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662015631, "uuid": "1be4bd15-0bb5-4f94-9b20-10caa5a600f4", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662015631, "uuid": "c2b836f2-fa62-4382-b51c-8b84ad92d8a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662015631, "uuid": "73c1c048-91be-4e2a-8db7-e1c41b903e5b", "value": "FBFAC509C16A8F9D754668559780FD3232F9670057C93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ed7c55-2a18-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1662052224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052224, "uuid": "4efa9043-e55b-4644-9d59-9cf3ef578ddd", "comment": "Malware payload (IcedID)", "value": "9a18605fbb2312fabdd481bbcc3ed35f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052224, "uuid": "a4a75ae6-cd25-4876-a05a-4bc55ca36ebb", "comment": "Malware payload (IcedID)", "value": "fd46ad3ef89011b4ec6eb3709f903f5212d94c98ab81296d5664b82e7f9d6493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052224, "uuid": "cd5ca7fe-9510-47a3-8f27-21747f6ce4b5", "comment": "Malware payload (IcedID)", "value": "8dd5dd86c96341744e97620b1f71b2c075aed5b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662052224, "uuid": "f0b74610-6432-4704-baf8-e8ec78d83ae7", "comment": "Malware payload (IcedID)", "value": "ecaddd643cafd1d5663a73465421dbddbc1feb4dc6555478d0cb4126917cc831df889857a1dc6f32aa041fd17f4ef776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052224, "uuid": "501e70ab-b66a-4369-ab7d-2c30a915981b", "value": "T18D7419DCF246B4BAC6666775C11F5909A23C28F2764CBC40D99A88D81E351B93263FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052224, "uuid": "c2ad30ad-b680-4fc2-b138-d5a08fd1b7e2", "value": "4e013a8dff9f649aada694b345eaa2e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052224, "uuid": "4b8c54de-ea0e-4441-9e23-fcddabf27b20", "value": "6144:am0DekUg++nFEN0GjeW/JVD5N9D37NKoCaG20q:ET/AeWThN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662052224, "uuid": "0d613e16-42fc-404a-a9a7-557489281521", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662052224, "uuid": "f7228124-baf8-4fbf-9d7e-d7bf95d21746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662052224, "uuid": "4960e47f-21a7-4ed0-8496-1bc82b0d08af", "value": "9a18605fbb2312fabdd481bbcc3ed35f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }