{ "Event": { "published": true, "date": "2023-03-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-21", "timestamp": 1679443382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3ab986d4-9b8c-49b5-b728-6d372ed193ff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820ccd5d-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679391668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391668, "uuid": "77003069-2d68-4f87-b7b0-42ac457d7e76", "comment": "Malware payload", "value": "de286f2308ee9c05fa68ef53ab0e0e93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391668, "uuid": "8e0ff062-6859-4278-af6b-f64e529c1e64", "comment": "Malware payload", "value": "01c8f9ababc8223b84b2ca9bbe4b198876166ad897d90e2398bb62d5b4f160d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391668, "uuid": "02c557b7-44b3-4264-aec7-4ad48efae1a9", "comment": "Malware payload", "value": "1efebb73d0c7cd65fed411125082525c4ba9ec6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391668, "uuid": "7e4c87dc-0579-462b-af82-ef8c0a7bf5e1", "comment": "Malware payload", "value": "8c8a37f314d660d3353fb42ab9bfd9656447f2757457345d12bc542f38ae1d703d805f3bdf705c2f31ef3af1b310bf45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391668, "uuid": "4917e112-cd88-46e1-8c3c-3d5f40104a0c", "value": "T1F5838D57B12B088DDCEF2A7F54218B025E98E452BF9757FB21B8C6C6285DAD82E37500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391668, "uuid": "c4ab3d13-a098-4ddc-a403-71976b421416", "value": "1536:MBPOpeKlNOV+uWC1JMg4g4RH8GXST04LEM5lyHMwsfE:yOpA+drgQXST04QM5lyHJsfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391668, "uuid": "ae7a0ccb-684a-4e51-8782-fb697abf70d4", "value": 85048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391668, "uuid": "7a5cdcb7-f500-462c-b57e-bdd974ee8848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391668, "uuid": "be142ad8-94e1-4a96-a15e-190ae5ce18eb", "value": "01c8f9ababc8223b84b2ca9bbe4b198876166ad897d90e2398bb62d5b4f160d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8522e7-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679391687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391687, "uuid": "279aa4a0-2ae9-4744-9431-cd322ba804b0", "comment": "Malware payload", "value": "ac4f6c29786fc1abe7e190bc1b934b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391687, "uuid": "7b3ff0d1-f680-48bf-890b-fa40f0d5321a", "comment": "Malware payload", "value": "01cc1ee9bf55cd48b64ad608d0717d05ab8f1a85536c395150cecbfd8f239220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391687, "uuid": "97a45b67-389c-44fa-8182-a5f63f02e6bd", "comment": "Malware payload", "value": "14b8423bf6e6dbb20837c11001b4316b9ec78b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391687, "uuid": "75bf36e0-0f75-4dde-9b02-c4212bc189d2", "comment": "Malware payload", "value": "bfed63c4f7ae656b2f598f29b316c8ec0cf4d36d275b87e493e354e9764a5ae493e1ecc1bc49de8e8d2967e316d3cb2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391687, "uuid": "03ef3a71-e04b-4cfb-94a6-39c463fb91cb", "value": "T113D3BF08EAC985E9E868467498BF4D3F16637971428F5477B34EB73843700D6A6A03EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391687, "uuid": "4bacabd8-b7e2-4f49-94f4-d98ed09b4c92", "value": "6f33ec2ea7879f0b45f322e7091fae17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391687, "uuid": "a912d6e7-8634-4233-891a-bfd2bf6ce289", "value": "3072:iociA1/PAtNOtTBfhTFe2uspvzf+AXGZLg:qiAtPUNOtTBZTEFGq2og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391687, "uuid": "8dcfa3b3-8f30-4724-869a-e162e4fb9aed", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391687, "uuid": "d200e7c2-94fb-4860-9f63-40c76d708b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391687, "uuid": "a2618901-4983-4ffb-aee5-10b45223e8c1", "value": "01cc1ee9bf55cd48b64ad608d0717d05ab8f1a85536c395150cecbfd8f239220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d712eaa5-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392670, "uuid": "5bb00949-cf65-42f6-b2e9-c30531ea7bcf", "comment": "Malware payload (SnakeKeylogger)", "value": "fd9401d8e001e556d943e30b3ae6d16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392670, "uuid": "14ac28f1-fa9b-4c79-954f-cfb254212fac", "comment": "Malware payload (SnakeKeylogger)", "value": "0355a54d6aae27829f3e33aa8fce6dee0310802ae4e5a842bd7fe25fe1a6274a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392670, "uuid": "9972bbf2-7574-460f-9d19-1c9a9e678c5d", "comment": "Malware payload (SnakeKeylogger)", "value": "dee7365087e86b44bb3af8afe4f4bd71890fd611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392670, "uuid": "98375f3c-9e45-43e3-bc93-e8ce7b4426b8", "comment": "Malware payload (SnakeKeylogger)", "value": "4da187fd7d937856113d661921ece163b92e39c395ec6bc154809d47243f06e522a10d210fd11c680d0d3f7aacdfaa15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392670, "uuid": "99f93304-5c68-4e64-baf0-9a6e83db4047", "value": "T1A8150231AB979531F536577EC6E021C5033977936713C69E18F612CA8B23B878EC0A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392670, "uuid": "7d02a262-750a-41d0-b2bc-2df54b70c64c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392670, "uuid": "59f17372-e84e-45e9-a71f-80b1b9755c2d", "value": "12288:aKYMKnFW/NIknBnjAK5KceG4dj4v0AEIIcQjq33mCcI+DEP0+17cawmUDIpJlc:aIxn5EceZdlkQjq3mI+w81mCIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392670, "uuid": "1dad15a4-e1fa-4c92-bced-89977fca5342", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392670, "uuid": "a39a1ddd-248d-4ec1-9795-b53c3b7d29da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392670, "uuid": "57a1b882-644b-44d4-bdf6-8c8e9a94a85e", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0855467-c802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679414912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414912, "uuid": "87e93765-cafc-4122-95a1-8c7b89f8a5da", "comment": "Malware payload (Formbook)", "value": "5ececd3b863cb974102ae4f6ffd2162a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414912, "uuid": "048e8949-0b73-4fff-b11b-8e1d08e2051e", "comment": "Malware payload (Formbook)", "value": "036d98d173fb619eb15bbd96049eadd630a39e1862e27440dc63b57e3896cb9f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414912, "uuid": "3c104ebc-57d8-42e9-8b70-93d595cf576e", "comment": "Malware payload (Formbook)", "value": "11cf575e75cade8eea07bd9fac5acbde78a4f0b0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414912, "uuid": "bb908c2c-0c6e-4bcd-b5cf-17ca520d5d86", "comment": "Malware payload (Formbook)", "value": "48104187a00cbbde2fef592afc6249670b6cc5469284458bcb9fd6d4c12cb2c54dc38a9a139b77edaee408f2978baaca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414912, "uuid": "12e1b3ee-ca30-4ae4-86a3-76e78c8fb116", "value": "T127F423D89D8082FA5FCF8F6F3B6501332A55E3D832CA6A7A70D78AA885F544D1F8D150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414912, "uuid": "6682c49a-58ab-4731-9c9b-1a1e5af5bb48", "value": "12288:kjMfU5dDHYSp47jrMl6KZIpbD3b7dGpCec9MaBrxMKIfl0Ay7gpWvi3uT0a:mkuDHY/7jAlDebD3cCeVQtMKG0p7vv6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679414912, "uuid": "bf705acc-60ca-4a71-a98b-a18fcc58e491", "value": 777167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679414912, "uuid": "1c6a183c-b520-4576-bc79-508bdb15bcf6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414912, "uuid": "a10afd6a-4bd7-4652-a676-7bada368818a", "value": "Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda35f94-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679364280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364280, "uuid": "8dd3092a-c1ea-46be-ac74-eb34eec495a8", "comment": "Malware payload (Rhadamanthys)", "value": "9f4cafcfeecb46ebe2eacdf524924dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364280, "uuid": "7d69a901-091e-4456-baac-c9b80fe1331d", "comment": "Malware payload (Rhadamanthys)", "value": "0458746488bfc7b98664fe384e53bbde97024537aaf97e96b6851f95e5a5d706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364280, "uuid": "c18b62d1-8671-4502-b039-d639fb0e571d", "comment": "Malware payload (Rhadamanthys)", "value": "a074c48136ea48542d6ae059f5864479ceb09d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364280, "uuid": "2dd31d22-5d1b-4aa2-ab02-abf96681d898", "comment": "Malware payload (Rhadamanthys)", "value": "4793ac6d180c4f343b69b137bc0c1614538d9fce938da2cd6776d67610ecac318335949deac3aed469b8d5b7461df34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364280, "uuid": "e2d3a53a-9329-4cc0-9b8e-08cd7de8cf74", "value": "T1E244C0434AA07851E412CBF25E2FC2B4B60DF9D1CE5D6B6E63086E2F0CB7161D1AA7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364280, "uuid": "fa3761a1-5fe2-434b-8b4e-35054e9b4c61", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364280, "uuid": "6977708d-c589-4d6d-8f23-417bb4cfa1d9", "value": "3072:3bhrk2yzQeW9kMGaEIjEJR92NpoJ+4YoYOCtKvkHdVLo8tAICc3I7qZ:lkxA9GacQNpWNY1Olc2ICc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364280, "uuid": "f38b2c50-7073-4dec-85d6-6ad331460f39", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364280, "uuid": "3835191e-8331-4322-8aaa-a84bcd971a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364280, "uuid": "b654f5d1-5b02-4069-b4b6-44c9b809d4d8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f18364-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362769, "uuid": "21e52752-829c-4b08-9248-4bcade882ca2", "comment": "Malware payload (Smoke Loader)", "value": "d9a2a419f6afb602f7f297853da1d510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362769, "uuid": "0d91ba6f-3c8b-476c-be6b-e099e784233a", "comment": "Malware payload (Smoke Loader)", "value": "0487bf1bf042cd5e1ddca7d6ca3edab3ca4fc18e1b1e1de297b131e340755562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362769, "uuid": "b4736e14-fcb3-4bdb-aa56-8298ff25c853", "comment": "Malware payload (Smoke Loader)", "value": "bce897e152c6fc3d798589cdeea1f36250d432d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362769, "uuid": "8f2f63c2-344a-40c2-9cdf-a3a69dde110c", "comment": "Malware payload (Smoke Loader)", "value": "6eac30b6c8d74127f34770bbec0f93bac7ad685bcf274dcee901d2e076aa245e450f38d30270012bed2fbd86107bfc1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362769, "uuid": "14f759e7-2782-492a-b72a-8bafdb10fcb1", "value": "T178047D239A907861E412CAF2CE1EC5B4B60EFDD1CE5D675E32186E2F0873162C5AE7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362769, "uuid": "8dae83f5-95d6-4fa1-a189-c7b07396358f", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362769, "uuid": "a01cf05d-c62e-48c7-a007-c86c1d4bc7d7", "value": "3072:itMwTH3U6BW1tLwm2n7svtJK7wMSZ1ssZ:ETXEkm2n7QcwBZ1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362769, "uuid": "5d1f42d3-5570-4251-ac68-bd0d1a064d0a", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362769, "uuid": "837c99f9-8b96-442c-8544-6c99e8a27442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362769, "uuid": "b9e7d0d3-b6e7-498c-b9fa-6d9f847313b7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb8d3e8-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679398773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398773, "uuid": "72014daf-c442-469f-b068-36a7ddc3fbb7", "comment": "Malware payload (Formbook)", "value": "ca19b29e80779c0f9d74604b3d17940e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398773, "uuid": "0b8e5fc0-d181-45e6-bb82-b1eef4123493", "comment": "Malware payload (Formbook)", "value": "052b6162527da70a384bfa5712e60c065c4d449cc70b6619ec2a50c0a92e2493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398773, "uuid": "15a2cb95-1056-4ca1-81c3-1a79ec83ec92", "comment": "Malware payload (Formbook)", "value": "e77629dd87bc43581b4281b376330d5b998ef800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398773, "uuid": "15c15b4b-a3d5-4b68-b92f-a08cd197e54b", "comment": "Malware payload (Formbook)", "value": "19cb2056a145e91ec8d85fe5a4daeae6d3d86b0e262a92584bd1a2265c4dbf20d3f93504a62459619fa087facb10334f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398773, "uuid": "0cc1176a-f381-4d1d-8dbc-87c91c38c6bf", "value": "T1CF44121577D6C8A3E8319A311C3B732A8FBDAE1E1664032B27514F153A34B86DA5F393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398773, "uuid": "bb7b0e2c-4f4d-48e6-b89e-58e42e7e69fb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398773, "uuid": "2896bd18-1b64-40b8-aa2c-35b7a6be43ef", "value": "6144:PYa6gNE5mIDnBrb9sJm1eF0Wmvos7g/LRVNNlIpuY+O9M:PYWimIDcmvosUjRhlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398773, "uuid": "669c51a4-4de6-4362-9a4a-610f7c6108f3", "value": 255590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398773, "uuid": "27dbf83f-dc8e-41dd-8fd7-067b29ef03ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398773, "uuid": "f3e80a9f-edca-4051-a9b6-c0e428260f70", "value": "ca19b29e80779c0f9d74604b3d17940e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eae0c96-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679416037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416037, "uuid": "b68c5271-ee4f-4c05-adf7-eb4ac1431a46", "comment": "Malware payload (AsyncRAT)", "value": "a7f473e14b7c3e56561ff51f87b2f279", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416037, "uuid": "40b6d414-e5e9-4d67-8de5-5548f246ceb5", "comment": "Malware payload (AsyncRAT)", "value": "05b1080658b2c922f7becdb930e8f9fc34822b27982a4d89784f335565df7361", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416037, "uuid": "4da160d2-d6f8-4dc6-a228-a169b0f2279d", "comment": "Malware payload (AsyncRAT)", "value": "799bb3816916db3e6e92ff665c34e020cf444859", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416037, "uuid": "f2a315c7-c80a-4a8a-b422-55105ed74cad", "comment": "Malware payload (AsyncRAT)", "value": "993e3a4c89bf1755bed7e8e20636de677546fd9370b000ad738a5530cbb6ddd230502c6dbc0994ca247e66568b2d0cb5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416037, "uuid": "54221abb-b568-4d02-84d3-bade2cfdff79", "value": "T161231A003BE9812BF2BE5F78ADF26145867BF2632603D54E2CC4419B5613FC696426EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416037, "uuid": "6a340eed-7aeb-4231-8fde-9248c0982183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416037, "uuid": "589913e3-afd2-4cf6-813f-06f09685d822", "value": "768:TuERVThg5RXWUr/+1mo2qD84lNVx1VEHUPIKFjbmgX3inm6AhL1uQHQoBDZTx:TuERVThaa2AlQKNb5XSTApHdTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679416037, "uuid": "93637a73-17a2-443e-bee0-ad8ec69f8a5f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679416037, "uuid": "1bb05075-32c0-42ff-a41f-21475c2cb9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416037, "uuid": "fa67c617-f323-4197-99ae-24c5c5025d33", "value": "LafameBeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609b93b4-c7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679378727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378727, "uuid": "478dcd6f-c378-4540-98d8-00640e100dcb", "comment": "Malware payload (RedLineStealer)", "value": "0192d35c916b3a26132cef7dd09dbabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378727, "uuid": "9e54b116-e07d-4667-af84-2da8a47363f6", "comment": "Malware payload (RedLineStealer)", "value": "06736e8c8a3dafb02d3ce28f9917f7e79e37b6a0d998c375b91d7029ef356da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378727, "uuid": "19298a14-1a59-46df-8aa9-ccf58b2f8bac", "comment": "Malware payload (RedLineStealer)", "value": "9480935bca8e7c22c379e894633ad59acae0c871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378727, "uuid": "c4b14f4d-f995-4918-bb6e-312954863e0d", "comment": "Malware payload (RedLineStealer)", "value": "816fcdad8d858fb24331cabf85b1a03a195c39e18b164d0f9e8ab31279794b0b893aa987599eb8966b601bd3a292f350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378727, "uuid": "f77cc3af-ddbc-4377-a54e-de660a2cbefc", "value": "T17D252246AAFA9077E5B817706AF742930E367EE15CF4836723C6990A0DB33C46975323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378727, "uuid": "70d0bcaa-a934-4fef-b102-3cc2ece0512a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378727, "uuid": "06119274-09e0-42c9-8f76-13138820f064", "value": "24576:syFzLdzags/31Oqoj83ZR2hJzSknQBlL13M64C:bhFaXOqoj83ZVT5MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679378727, "uuid": "9e726bf4-e49b-42b2-9ac8-083b0927090c", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679378727, "uuid": "adfa561d-87e3-4d55-9206-79a6815713cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378727, "uuid": "9728605e-efec-453e-bf76-d956be3ad71b", "value": "0192d35c916b3a26132cef7dd09dbabe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069db2d8-c794-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679367409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367409, "uuid": "60dbfa17-eea0-4468-a101-9250f922ee13", "comment": "Malware payload (QuasarRAT)", "value": "bb5e24ae449c14d485bffb194bb3326b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367409, "uuid": "fec7c042-7dce-4302-b7c3-64c933afc8c5", "comment": "Malware payload (QuasarRAT)", "value": "06f7a5380d0d2f23e9c481071e7766486806d38c6cd5785b5897863b481d56d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367409, "uuid": "8b7563e7-b3ef-48e4-8f7c-7df9b0344b2c", "comment": "Malware payload (QuasarRAT)", "value": "9e28d1c69ce22f5345c287a7d5fab3aece14ae2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367409, "uuid": "2a02a721-31de-4224-9cda-667dfa424efb", "comment": "Malware payload (QuasarRAT)", "value": "8c8e5e347b19de1b1d5ec7bb25ea9070ee28dc7644647aa93756f8b6f7b047a229ed2fd138e16a84b6a529f73c690ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367409, "uuid": "944cc221-a9b4-49cf-87f1-6cceafcaa6e2", "value": "T1EAE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367409, "uuid": "32fd6731-6b0b-4fb3-b048-34059150cdb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367409, "uuid": "74f710d4-1390-4b2a-aa9d-bd8c58141702", "value": "49152:rveI22SsaNYfdPBldt698dBcjHBpRJ6DbR3LoGdnTTHHB72eh2NT:rvT22SsaNYfdPBldt6+dBcjHBpRJ61X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679367409, "uuid": "a7238a2e-5f7e-4413-85d5-9f8e802ff8a6", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679367409, "uuid": "92745f16-7a4a-4181-8e47-12d9190c02e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367409, "uuid": "6d54e19f-be85-42db-abdb-a698807785e9", "value": "Dell-Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a05042e-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679391708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391708, "uuid": "294fc72c-0d4d-4fa7-8e61-20fd202a8d9a", "comment": "Malware payload", "value": "73a80d96daa57f0e1e83710f8618f7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391708, "uuid": "ea80f8b2-3a9d-481c-a102-2a6895f9d399", "comment": "Malware payload", "value": "07c036b6c6a238a913fdbcf30b9ed872633973cea25b03fdb9246e31f2c5f33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391708, "uuid": "a96e1a94-564f-4ab8-9aac-7b4601e748bd", "comment": "Malware payload", "value": "c6e71898a10abc655bdaf9cab9d4970c44068fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391708, "uuid": "1ce794a8-ec31-4120-ae05-14cfd8ab18ed", "comment": "Malware payload", "value": "851b493e6f6b44945a8416be51dcd2e4915008a46406261d3e97d76ad6a392e8933b23e3634a23b94993ee347d65436d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391708, "uuid": "5b231000-a209-4585-a4cb-2ba180981858", "value": "T1E8540109DBD980A9FDB815B464BF8E7B0A636635019F5477B30EF73047600866AA43EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391708, "uuid": "fdaf6dbd-3881-44bf-af83-b520c2b4032a", "value": "6f33ec2ea7879f0b45f322e7091fae17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391708, "uuid": "34534cc2-c6c4-48e9-9582-9471a3f3bbd9", "value": "6144:KiAtPUNOtTBWJlmLMcVMs3ptWvVGuVOHAcYPnvzFGq2og:2OOtTkm4Ap3ptOBZcGnvzcJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391708, "uuid": "52f6364c-a3b2-4bca-a831-71a9b85e8ba5", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391708, "uuid": "222e24d3-9c62-465f-9c53-34379dbfba0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391708, "uuid": "7d57537d-92cc-47e5-88d1-b5363a3d8d3e", "value": "07c036b6c6a238a913fdbcf30b9ed872633973cea25b03fdb9246e31f2c5f33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fbe110-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679398840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398840, "uuid": "12768b1c-4ef7-49d7-a8b9-f358f0e463d5", "comment": "Malware payload (DanaBot)", "value": "5efd8205da8de1e8860f9bce8c65c089", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398840, "uuid": "a709131c-03d7-4b56-bdc1-93da59b497a0", "comment": "Malware payload (DanaBot)", "value": "0800a2f451823c72bd7dd29d067b84f369606669c40c3ad1d8c47df464cb9c0d", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398840, "uuid": "89539227-42a2-4f02-a7f2-26c172b52d69", "comment": "Malware payload (DanaBot)", "value": "6c9aa961b5bf3208eca571889eb9450217e92540", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398840, "uuid": "48acb0b0-abb5-4fee-aa03-5879ee043dd2", "comment": "Malware payload (DanaBot)", "value": "f4350e0f7c41d63f1b19dbd501f0a0f4d0d34c91e825a6296c4467c4256aec4995ccd99363fa2762d182e7e5bc56136d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398840, "uuid": "13c98f94-9933-470b-a576-fd98b8c8cca7", "value": "T146C53303A6B27851D41ACAF34E1AC6E1A52FBDD2D97C9A5D22004F6F48732E2C1977D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398840, "uuid": "0c7fc95d-3508-48c0-a028-c64e548887fc", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398840, "uuid": "70db29df-3c69-4c8d-a3fb-6029aac2b080", "value": "49152:ld4vu8f5KOZM2L250M3eGGUj5WHe88wick2N77mM7Bn8q:ldou8f8OZa50MOG/QJRk297Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398840, "uuid": "c5be791c-80a9-466b-a801-6a21564a8316", "value": 2625536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398840, "uuid": "f7357755-9ab7-4d42-9aec-d84ebd109401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398840, "uuid": "111f203e-c982-47ab-8331-2f2d386b1cb8", "value": "5efd8205da8de1e8860f9bce8c65c089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbb186f-c780-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679359127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359127, "uuid": "afa3cb22-ec61-43c0-badc-afc7803d451e", "comment": "Malware payload (Smoke Loader)", "value": "dd41d9959bf2c7cf172a860b2f817dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359127, "uuid": "d9cc6979-bac5-41ab-9166-ee5004af070a", "comment": "Malware payload (Smoke Loader)", "value": "080d5a7571324ec50b929ba088d9617109bf1504bc2fd3b3b610a196664e7fa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359127, "uuid": "c8b0bb9c-e667-4894-ac0a-4f888ccf2261", "comment": "Malware payload (Smoke Loader)", "value": "de1b6158432827be707c841a11b9d2a7060ebb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359127, "uuid": "cbcaedb1-72a2-4a09-befb-0c7bf24bfe59", "comment": "Malware payload (Smoke Loader)", "value": "944a86cb6d5c76c95befd73b3346982603fdd218494c9c0d6594867e81e7b0ca602e085bdbd43dce5338c2b6eba519f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359127, "uuid": "d938ac5d-75f7-4f3e-b699-6a74487a02aa", "value": "T1C7049E235AA07851E526CAF1DE2EC1F4B61EF8D1CE5D67AE32046E2F0873161C16E7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359127, "uuid": "612fe235-0a12-448a-8490-c89aa8280272", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359127, "uuid": "4ae44415-3da1-4630-8586-9cf4168b5800", "value": "3072:6W1Z9rWKK4IK8NWLOk00UTX4UBo5zr9T4/ZZGZ:nlrW5Z2Ok0vTX4UIzpeZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679359127, "uuid": "20f427bc-f1ec-4292-a92e-2b9e3de1dce1", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679359127, "uuid": "d2329eed-63b8-4d7a-bd9e-22df4106a24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359127, "uuid": "b61655c3-f173-43f9-a612-03762ee7b34d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dec70db-c787-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679361946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361946, "uuid": "d332253a-78fd-48be-afae-f9746724fa4d", "comment": "Malware payload (Smoke Loader)", "value": "d7161c737b05961694b37258471dc116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361946, "uuid": "d00f6a29-e7e1-41fc-9b1b-802c16be28b2", "comment": "Malware payload (Smoke Loader)", "value": "09323b762a216ece584496962ffcf0f8394b613af412f8c5556b60d61b138d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361946, "uuid": "790abdf5-f81c-43a8-bd21-bd375ffab3e6", "comment": "Malware payload (Smoke Loader)", "value": "3701abcff17fed286ac22eaedec81e53d56be539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361946, "uuid": "fb1fb126-4f6f-49f0-a871-677f9ae3f1df", "comment": "Malware payload (Smoke Loader)", "value": "699f2656a0d93167a81e80efaa0425e64d90d6e1be07521d79dd27ed0db23b93f91cded631b5a1559edf79f207810f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361946, "uuid": "32f530ba-15bb-4707-b8e9-149a2641d702", "value": "T149048E039AE1B811F416CBF15E2EC6F4A61EFCD1CE5D67AE22046E2F08B3161C5667D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361946, "uuid": "b9fb1d1b-fa63-4fed-a71a-49109cfe9014", "value": "c7e43254116cf1eb594def3fb89b8588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361946, "uuid": "276b4802-95d3-4977-add1-08b2b7171081", "value": "1536:vrqjAC79LZNcSIyGMjEOeidPHbto5eK1E0lLWGKMCv8lgl0djIC6ElMnrnpVKyNR:mh5ZGritbtoi6KMo8lglUZMrXKcX+NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679361946, "uuid": "503bd8a4-452d-4660-8110-f0ab477774da", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679361946, "uuid": "b030cc66-f82f-4aca-8096-8a01f04dd863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361946, "uuid": "76f755f8-7563-447e-b1c7-8ba81353537f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed4ab0d-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679398803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398803, "uuid": "6da8746e-8536-4e85-b550-1834234a19be", "comment": "Malware payload (AgentTesla)", "value": "e49f11131e67d0a0e9fd9e28bfc41de0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398803, "uuid": "e815474c-1424-47a0-a958-457563e569a3", "comment": "Malware payload (AgentTesla)", "value": "0a3910d28d3f2f885f656070a26c9f7abafac1e5231c6b9a8e07844a833f6077", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398803, "uuid": "eb0218d4-4c61-4de9-bd24-05e8680581e0", "comment": "Malware payload (AgentTesla)", "value": "d90afa316ddb436909f93e49f510cbe1ff7eaca2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398803, "uuid": "1712aad5-a8bd-4fff-a03b-dbf18a7e6235", "comment": "Malware payload (AgentTesla)", "value": "0fc9ad50a7003ff00b6746103f81b016cd802f4bcdc05781052b86c4af903573d95367f7c00ad465ae2ef94cf7d5eab5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398803, "uuid": "307a087b-2522-489e-842b-d4a90658eec1", "value": "T19F05025A3B949A03C36D6979C29351241BF19D8327B2CB493CC911852E0F7FA9D4ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398803, "uuid": "d3fd8990-53f5-4e08-b598-ddc46122b347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398803, "uuid": "216e50e2-fa63-4e45-8384-dd893bdcbacb", "value": "12288:FR76ZD743ncK4qvaWaqirbOgoXzVIAKXjJ/xKcQURsOIU5Cyb/A1sNX8Li8YYIM:FZ6NDIzSHXNxVnIUQc/WO2NYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398803, "uuid": "cc9da915-d5a6-4eb7-bceb-648be0c48278", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398803, "uuid": "763faf67-fc6e-472b-8d33-85d52893e2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398803, "uuid": "0165f4d9-37a3-4aaa-acee-6b42bbf3c5f7", "value": "e49f11131e67d0a0e9fd9e28bfc41de0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da14c20-c7a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1679373541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373541, "uuid": "dfb0521e-c46b-4182-8626-6626c003155f", "comment": "Malware payload (Quakbot)", "value": "b53f07264a6596684359c3dda0c6ae68", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373541, "uuid": "e7a489af-34c6-4ea3-ae4e-26c8780b31e1", "comment": "Malware payload (Quakbot)", "value": "0cfbbf046bbbb660e6545eb420032c690961d6fef772a7a31000fcb03f696f35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373541, "uuid": "cc849682-78d2-401c-9419-cea929868b7a", "comment": "Malware payload (Quakbot)", "value": "0834de0717606d233d68aea8b2085d2c1a19b04e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373541, "uuid": "2dad88ce-0a01-4ca9-97bf-8ad0b4933c1b", "comment": "Malware payload (Quakbot)", "value": "0107f3735835d0fbb258f9d7f95148cdd9a5990ba1bead7dda2586972d7368c1e1de17d8bceaae13ac294361f85a6d3a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373541, "uuid": "7a1df008-2431-40b0-8d3e-5250295b057b", "value": "T1E4154BA8FF8720F2FE6754B1914BF77F963966158024EEF2EF085989F433B12611A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373541, "uuid": "0367727b-fc7c-4fa1-b7a0-909a668f7869", "value": "a38facd15189938baae5b1dff7179319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373541, "uuid": "43d372ca-0bba-4ec1-9cf9-dfe4ffa81e97", "value": "24576:i9sT4ppMP7Empue12E35Tdkq0aljWrHnl5oPhepzGIrx1lA0ijNf:bQOD0nEZAl/iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679373541, "uuid": "f95c453f-41ff-4c5a-b016-69fcf0372b9a", "value": 880796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679373541, "uuid": "db2d583e-e211-4756-859c-2a7d359e0dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373541, "uuid": "f29ba535-c6f5-463f-a5de-2eb238333dcd", "value": "B53F07264A6596684359C3DDA0C6AE68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138c137e-c7c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679388476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388476, "uuid": "5753349e-f00d-4415-998e-e8e8cbcb6922", "comment": "Malware payload", "value": "7682d10c7d8f06b663b1d0f16067adf4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388476, "uuid": "2030ba00-2019-4249-b0bc-87af3bd0b6f5", "comment": "Malware payload", "value": "0d49ed0ef687b35e0f3a806dc9f20dd9cef84ea06a197319ee8c4a1b5a04aad4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388476, "uuid": "9f5bb8fe-e545-4baf-a1f7-b37c92aec50f", "comment": "Malware payload", "value": "408ba3988f038083f382b89a0fb0889a6ccf0658", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388476, "uuid": "9aa7cdf2-ff5d-431e-98b4-d713bd0bfc43", "comment": "Malware payload", "value": "589270c4bd25c8e3ef60d7f9357c2ab670a1cd21eb4f80c57b1b356d3ae231c4d8dd3ddc00a051b94bedb1bc123765b8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679388476, "uuid": "6bfe274d-c2cd-4d51-a618-0a2ab8ee488b", "value": "T1443633369E32ED2A4664523C74BF0E8C2F600E8BC058D6E6A751BCD355857B088AF5FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679388476, "uuid": "72118ed4-8bad-4d2d-a2ae-01cdb04a899e", "value": "49152:3HSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGWP:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679388476, "uuid": "ffcdb98e-bbc6-4de3-9a9c-e47f80f8fe37", "value": 4961947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679388476, "uuid": "9cf7a293-bddc-4892-986a-d3f16858ecc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679388476, "uuid": "2189b0cc-5aef-47ca-95e2-76ca79da17b7", "value": "informacio\u0301n de reserva.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c3ce1d-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679392943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392943, "uuid": "45c31f7f-313b-4b29-a6e5-9c6c698e02a4", "comment": "Malware payload", "value": "46851a5426df02ef6fda86255e939ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392943, "uuid": "3e9131cb-6823-4e03-968c-c00651159b01", "comment": "Malware payload", "value": "0da2d5a757fc068941da686827495932afd10abe3b20b4979c188ecc29a37389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392943, "uuid": "374f0b0e-4f34-415d-b733-3b250b063699", "comment": "Malware payload", "value": "c7128699dc800897d73fe347f22a8ca337772b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392943, "uuid": "65912262-3864-4085-9d3a-10de0c590edc", "comment": "Malware payload", "value": "9b25f17bddc6c36c1d3eafcb6155fde378c6f9d83d2be68704ea2eb22f463ae905867910e6c0509dd76a64eeb95fc8fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392943, "uuid": "baf1f16e-712d-4b21-9d1f-18e62fc5e93f", "value": "T192C63903F9A180E8C0EDD234C626D362BA717489473433E73F649AB61F66FE46A79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392943, "uuid": "197d3b88-40bc-49c0-bd24-f5df664498f9", "value": "49152:4ymjilhTfD7DzL9krb/TfvO90d7HjmAFd4A64nsfJ7TTsmeiyZVWKKhiETItiJyu:F1Xry3PAhuoO1voVrJEDpXj5OyE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392943, "uuid": "198047ac-fec5-42a5-ac50-0dd2cf93c29e", "value": 11635910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392943, "uuid": "0c1fdaa2-6cb2-4419-af69-f11b7dd3c68d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392943, "uuid": "f5ab38e6-5c02-47df-8f2d-bd676947da61", "value": "46851a5426df02ef6fda86255e939ea3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd30ec5-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406506, "uuid": "762e2385-f4c1-4c04-a5f3-398ed30c6bd2", "comment": "Malware payload", "value": "39a0335d84c5b90e1e5a6424e459f6e3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406506, "uuid": "e1c1622b-add6-4417-b315-8c45f1df8a8b", "comment": "Malware payload", "value": "0dc2d3f24614733343d0de96f7f253a5284a395bd5d8c07fa76c6ad6a5e21722", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406506, "uuid": "319b662c-db00-42f5-964c-622171b83ad8", "comment": "Malware payload", "value": "9ab39d1030a4daa559621a3ae3e73d55ba34351d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406506, "uuid": "f75c8bae-423a-47d7-ad8f-93ac62dcf600", "comment": "Malware payload", "value": "444c0053548457c52715f4820277ab041ce611d4cdcb231c319097d4976c2caeba9ddbcebe3881a6a3fd679e033150a0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406506, "uuid": "b51b95f3-42b2-42b9-b0a3-3c144777b3a4", "value": "T150F6121A74CA8637FB7E86386679D73A65B93EE00BB280EB53D0691E0E715C14271F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406506, "uuid": "543de512-7a33-4eb5-ab94-da38dce476c2", "value": "98304:bYViQ/umyptpe6Z9TM2AkyYVKCl2FlyvnzWdWSJnDh99Llz5/uCbgSfk:ujAe6Z9GIlHCdWAnDhzlL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406506, "uuid": "1ab3551e-6847-432b-968b-d87273c9c4fa", "value": 16047104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406506, "uuid": "e8ac2bf3-b4e8-4cc4-b3cd-7ff6747e8d47", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406506, "uuid": "c4958370-4261-45bb-b4ff-835f41218214", "value": "B.a.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1a9bea-c7a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679374826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374826, "uuid": "edb937c5-c0b0-47ce-8b28-e0a11faeaa24", "comment": "Malware payload (Loki)", "value": "dbf573b953d88b1efe9b33a605fafac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374826, "uuid": "d8db1025-6ed5-4edf-889f-df4ee635949a", "comment": "Malware payload (Loki)", "value": "0ec3433ce751deea6b07865898b680121d9416a47c4d670abc29389d6305606a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374826, "uuid": "4189e380-90ee-4a1d-91fd-dfec2fa61879", "comment": "Malware payload (Loki)", "value": "0fe73073348dfeefc702a963ab6830dd3d7212bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374826, "uuid": "0acefd9b-1f46-4515-898d-ee751c3e0da9", "comment": "Malware payload (Loki)", "value": "0ed84195a5e5cdce8c6d0b7d61daf81d55901cab84a319509d39370eac2bb8ca66031b7568d15a9b5a63a44bc12aa8c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374826, "uuid": "a6761593-7662-456c-8733-4f49574dfe96", "value": "T1BA54DF2D37178930CB4C56B0996787582375FE862D2F4B593404721C0EA2ADE7D8BBFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374826, "uuid": "5cca3256-5320-4c61-93f6-2d588f5922da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374826, "uuid": "3b2854ab-1324-4e2b-8c43-1ec3bc0e3d75", "value": "6144:g6zA5t/fQXcdb3CoX6G7Nz9kiZ6d/9W6VjT4:gP5t//db3SGPk+6dk6V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679374826, "uuid": "753f97c4-00ad-44a3-9199-d9a407c2e20d", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679374826, "uuid": "6dc1ec76-e2fd-4ce2-96e9-24b3485fb7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374826, "uuid": "b38653fe-b855-4e39-a2ed-39f4c109cf63", "value": "0EC3433CE751DEEA6B07865898B680121D9416A47C4D6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96c721e-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392674, "uuid": "ad052b31-6041-4a47-b3dd-649e5d7391eb", "comment": "Malware payload (SnakeKeylogger)", "value": "8ba0e39cc1a9940d1fc0e47d3ed8e48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392674, "uuid": "67280dd4-af59-4d00-aecd-0c19fda75d0f", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed333ca8332a025c80a3824fee4a5e66ad39e1a66c9a8f9fbf18ce9d9c49b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392674, "uuid": "552f41ee-76b6-487c-b1fb-91984055d93d", "comment": "Malware payload (SnakeKeylogger)", "value": "6701d0bd809111fe21ce2b4077326435e82f688a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392674, "uuid": "b7992f10-6fb0-4dd6-b7bc-bef8eacd9ec1", "comment": "Malware payload (SnakeKeylogger)", "value": "b64ae8d275dabb1ba07399d44d955ec98f1d6d3190c597a45c3766e5d9e660b53c8dd9d7a0229779e79f5e65a1d9094e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392674, "uuid": "aec9e2e5-9362-4845-8005-1afdad9260e3", "value": "T1791502286AFA1729F5776BBE91E02641977E63E33703D64E0CF111CA0767B024BD066B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392674, "uuid": "f6a0040f-0d0e-4aac-b78b-7294b52c4acc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392674, "uuid": "663e4e6e-8635-47fa-97c9-834f4e9a2791", "value": "12288:PbKX6ljMulXfczE4mlKk4A0sGtwLvTqjqzAv/7GvFhRl6gpvBvY9vYvRlIHHUhwv:P2X21yE4mf0sgwqjv6Vl6EcvYRlSN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392674, "uuid": "743758db-fca6-4fee-a4d7-556828d7dfde", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392674, "uuid": "cbd317fb-ee76-4bbf-b82e-c535f1400ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392674, "uuid": "49498203-f104-49bc-ba42-1d17351ca3f8", "value": "c0j0t6vEV7ooUSX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d374d6-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679392505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392505, "uuid": "32676baf-5211-4bc7-ae42-1de13cccf0a0", "comment": "Malware payload (RemcosRAT)", "value": "0ddc625bc9f8a86c9f20d1f03055e66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392505, "uuid": "816f928a-2adc-48d8-bb12-f6af8cba52c9", "comment": "Malware payload (RemcosRAT)", "value": "0f27e5f647e28a535aa0ab9dde5c707150431f10c62d12f1e192ea02d698b3e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392505, "uuid": "8901f502-ea87-4bb2-9063-6c3791b6ae61", "comment": "Malware payload (RemcosRAT)", "value": "34aeb0edb91628bf5ac25cc03a8bb4f24f924724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392505, "uuid": "9c351911-c1e5-4388-b1d3-a46a68e8b7a2", "comment": "Malware payload (RemcosRAT)", "value": "3db6e9443f9fadfa1e348f9e2b9e6ae85e3724f9bbd25b13c43096bc716fb9872c9b060555bf9bd721aa57b6109daa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "IDN", "colour": "#4B32BF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392505, "uuid": "bff94b82-6172-4b5e-af0c-a084c5401eaa", "value": "T110E47C507BE8D617C2BF3777A4B162804BB9D467E256E7CF448661F20CA2780AC1939F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392505, "uuid": "4998dc69-89ab-44e2-ae36-50bc38c03b59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392505, "uuid": "c91fb103-500d-4ebf-92c8-d9edf0220754", "value": "12288:pXfbhIAe6RVnGSTustt+185wjXGF5BZJtmI:pDhIkrGST/t8185w6FTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392505, "uuid": "7f100e5f-20dd-4621-9137-f89ceed17351", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392505, "uuid": "43e2bfea-7a98-453f-89b2-b106fe8992d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392505, "uuid": "b99f2aae-72f0-4f38-bbc5-536267d8d1ce", "value": "Bank Bri_Dokumen Pembayaran_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cbaac7-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679393344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393344, "uuid": "88b351d6-8cf7-4257-8bf3-28c985fc0a51", "comment": "Malware payload (Formbook)", "value": "8153a2e7f9caf30f24e796a13797cacc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393344, "uuid": "eba5f770-9cb3-4439-8e61-7a75a940e8a2", "comment": "Malware payload (Formbook)", "value": "0f356ec01936c3fc641acb21605d163198e1176a78f88356f572bce8573dc5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393344, "uuid": "51f845be-1a7d-4450-8d6a-89274d80cac1", "comment": "Malware payload (Formbook)", "value": "c7364c49a17e98ea406650507de21f01eca6e954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393344, "uuid": "7559377c-cfae-42fd-899e-59d5054ff38d", "comment": "Malware payload (Formbook)", "value": "9a939cf7e591dd6e7d96c74aa5625587b35cbf645c31a9da056a3fa2022bb3435b4008f79cfba7b621605cdaaa759cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393344, "uuid": "15cce7f4-f68f-4d15-8163-e276e974a8e5", "value": "T14C54121027B1F83BE3AA6B730D389262ABFBA11154742F1F3721AA057C599D0715FB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393344, "uuid": "dc74ace5-66c0-4eb6-8bcb-f5a891cd5fcb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393344, "uuid": "2bfe353f-62bd-4b28-9741-81e8cb6b5faf", "value": "6144:vYa6/R1eJ3wqRfASXw2x38QMy5ngizaBpAz0XPZs0wyYScC+1tyw:vYtsgqRLXZ8QMy5n+BO0XPZTwHScC7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393344, "uuid": "c89bf8bd-1fbb-41fc-b9b7-34e086bfb245", "value": 287029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393344, "uuid": "159b98d9-3033-4d59-a021-c138ed16d196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393344, "uuid": "e2908c79-4f04-4b97-bdbe-2c993ebc1530", "value": "Siparis 584801571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c43be6a-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406664, "uuid": "d706dbeb-badd-416c-8cf4-3854784ad5d9", "comment": "Malware payload", "value": "a45bd3a20cb69a76e9727e2aa4a6f08f", "object_relation": "md5", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406664, "uuid": "04a57ae6-85a0-465b-a885-9f2a7a704950", "comment": "Malware payload", "value": "0f9d505915253e50334829d29975dc46a09bcd9b2a5ef36fc13a0e943f9671de", "object_relation": "sha256", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406664, "uuid": "4ddcb145-351d-4ca5-be5d-b5ae5be0ab7e", "comment": "Malware payload", "value": "2bc67e126db7ae9ff5b4a94e9862f03bbd4352e9", "object_relation": "sha1", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406664, "uuid": "7ed9a63c-f6c3-41bb-a643-29dc63a8048b", "comment": "Malware payload", "value": "425374dc7d726071425ee612a86e95f972ab36e966dea047a24e9722ab265190011cad96f09223ee457f93d76502b467", "object_relation": "sha3-384", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406664, "uuid": "4dd038af-0da7-4704-8bb0-05ae9b91bb92", "value": "T11E41CA06534BDDD4F2853C7B23DC2D29E6FDC548D852425A4B92039E48C4C56BBB65FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406664, "uuid": "4ef0670c-77e8-45a6-8e56-58d57a4922e3", "value": "48:9oJVaWgQJ8C7YCb2+pXiNUgGF7ljaTF+geMXSTF7i2P:uJVa5QXYCbJpyyVcFTecSTF7bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406664, "uuid": "fdb037bf-f303-49d0-9356-02c77539fa62", "value": 1995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406664, "uuid": "f9afa226-584f-44a7-ac5c-4075693c016e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406664, "uuid": "3d7f5e8a-5356-4016-816a-1a64fe6883d1", "value": "RIMESSA_CASSEGNI03212023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66dfb6b-c815-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679423109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423109, "uuid": "477eea5b-d461-4a92-a43e-e5e61d41563f", "comment": "Malware payload", "value": "e11ac9c18cc9cb42aceb7512f9a010a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423109, "uuid": "070f0e49-c6fa-4e42-814b-7d72968bee93", "comment": "Malware payload", "value": "0f9fd2b1376d623fcf0c9703561ca7d217ab96b8d7d72644c5690a8c0ce555cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423109, "uuid": "1bdfee4f-93f5-4bda-acdc-9db7df5b39b7", "comment": "Malware payload", "value": "c428aa03c66158a9d31fea9d787b327d50546566", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423109, "uuid": "b5c5b86a-f292-4a93-b68f-696a22d6fb54", "comment": "Malware payload", "value": "5e5987e38b83b0d61a15d7d55442013919e1e61678d6359da2a9838da02fd020fd2f892a4b6e337b717da8d8ed18d5de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423109, "uuid": "40135bdb-de2d-4a63-b9e3-98b23b6d3c28", "value": "T12643A460498614331787BDA75A3DA010D67C29124B88F61BF49E7253FFCFA8CC9E86B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423109, "uuid": "78e5ac30-95d5-46d5-be2c-50ab229dc23f", "value": "768:9PmPJ5avjG3orMD5wcMNGGuz+L6XJissxphkvgNOPtitB9AhOY:JZwDZMNG7te+vgcFiVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679423109, "uuid": "839bd366-5567-4205-bcee-019a598d92ea", "value": 55487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679423109, "uuid": "e18b51f3-ca63-4c3f-aa38-a1fda8389919", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423109, "uuid": "4a8cb4e9-6448-47ac-b3ca-15c141e654eb", "value": "lsOF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2f9e66-c7b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679379629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379629, "uuid": "15ae47de-58c1-4344-95cf-d59fa43e7148", "comment": "Malware payload (NanoCore)", "value": "b4ef6d5785dd94bd5bce5b980bbfee62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379629, "uuid": "b3d60808-a3c7-4db4-bf18-ce3a4177c3ef", "comment": "Malware payload (NanoCore)", "value": "0fed79a59d3224424da47a06f87f901e8676a3042f5dc878e095312c3f6c0081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379629, "uuid": "30a36ffc-f51b-4560-afcf-f466571f2d6c", "comment": "Malware payload (NanoCore)", "value": "02c89f672fe728cb334f25d7b0cf90b84584a963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379629, "uuid": "c70b127e-24c3-435e-8931-7da6bddd1b8d", "comment": "Malware payload (NanoCore)", "value": "453c3c8f71f3fd589f16d3e4ec13217f715cfa72aab87332c327290d88afc2f7155755679e3726aecb1558278c1906b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379629, "uuid": "30256381-3293-43a3-9e0d-36e63736bbf5", "value": "T15E05025B37999912C3992939C2D7812807B5A8432733DA493CC613962E0F7E95D8EFCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379629, "uuid": "35ce9e6e-cc13-4012-8717-200378674b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379629, "uuid": "4b8bdc86-58b9-4901-9cf7-b210bb9692c2", "value": "24576:JWus7/pDr5Ls+9mWSmwMgHMDviBI3POYQw/:Jl0/pDlLTIWSmwMgsDKB+r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679379629, "uuid": "783694e9-c087-4876-905b-4cbb32046f29", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679379629, "uuid": "1bb7d401-512d-4f28-9a29-83bb7eb1c0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379629, "uuid": "913121f8-739b-4b2d-bbc6-ab4230ea79c0", "value": "Products inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c481966-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679393430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393430, "uuid": "8c45f4ce-3547-49d4-9e7d-601001b6eb36", "comment": "Malware payload (njrat)", "value": "0dce71cf8a80f37d8749265f9c40349d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393430, "uuid": "d5801df3-2169-4aa8-a733-4a9013ccc79b", "comment": "Malware payload (njrat)", "value": "110353c2ef6c654dac5d7f4ca57a6bd0e377c11a6576678ee605f03569d57bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393430, "uuid": "28999597-124a-40fe-9552-c931d345972c", "comment": "Malware payload (njrat)", "value": "c2604513f2d7c56718a3fdc5aff101c3cf2e8367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393430, "uuid": "cdddac28-af18-45b9-89d4-8c67bafead6d", "comment": "Malware payload (njrat)", "value": "c11c3001ed1f52296c3b6c5523393cd2d76d8b05b9bb06b83a5c34fe5dcb34c6ad6afbe481c2155e1fb94a00cb0d734b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393430, "uuid": "2af7bbfd-3a79-4c3c-9a13-b1db89aca244", "value": "T1E435332781AEE030CA05B5B2A34C3415D9EBC64CF68E175DE0BBDFA759462A33077693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393430, "uuid": "463a8ac9-1499-410c-8835-28490940a393", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393430, "uuid": "0e62f5b8-36e6-4b78-8b1a-d5782dc6f33c", "value": "24576:3SGA+xWHTVBPvzFmRydOw9e/o6FMRCwo+LPlj509aRVu9:iG7xkTzoRydOw9e/IC5oSp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393430, "uuid": "6c439039-9335-4717-8942-4ff2a21f2807", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393430, "uuid": "76a99158-dc95-4212-ae9b-0ed116b394ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393430, "uuid": "3230af1a-4dde-4712-8059-65fb1f4f31bb", "value": "0dce71cf8a80f37d8749265f9c40349d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9649e17-c7f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679408055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408055, "uuid": "6cb8415d-2d6a-46e7-b1e8-89e8896e1c1e", "comment": "Malware payload", "value": "e7494023cbd3ebd52b8d8020590b5487", "object_relation": "md5", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408055, "uuid": "7578a79b-1248-4b36-87c6-f95193423262", "comment": "Malware payload", "value": "125e79ff2d28862e0811e4b43df98e6a9c2ab5183f4d0b3deaaec26eba91c59d", "object_relation": "sha256", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408055, "uuid": "3c26502b-bc83-45a2-b6e8-cfbc4837a523", "comment": "Malware payload", "value": "21435e5cc18ed98fe3431be6aa7ef3abb8b0c976", "object_relation": "sha1", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408055, "uuid": "7f8ee84e-e434-403e-8c2b-5b06e4a034bc", "comment": "Malware payload", "value": "24e4b3fbeef4a53cb9d22dc96b71a7d33a493a0deff3fd918539ebfe34247c39ebc46e11161ea3b04ee8a5597f89d2f7", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408055, "uuid": "1bd848be-db51-4d70-bb71-d4684d581890", "value": "T1C7017011BB25F50C430249413C5DE4D4B734237D6A35ADD4F3C39C54C12A6E5227375C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408055, "uuid": "921173a3-13a5-4325-88be-44476d355fb7", "value": "12:XS7HLgyacwVwQEKIKF2/LgyacwVwQEKIKF2PDRAzLgyacwVwQEKIKF2BjzLgyacN:iTLDwOQEKIKF2/LDwOQEKIKF2P9AzLDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679408055, "uuid": "438213b9-7734-4bf9-8ed0-518a71dba056", "value": 707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679408055, "uuid": "51cf1038-4fd6-443d-ba65-42b7bc529b98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408055, "uuid": "df6b97a3-4abb-4508-9df8-0f1c7315b793", "value": "HRdX7Qd2.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ef24ae-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1679391618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391618, "uuid": "860edd6c-1f60-475d-a633-fd87d7d6a153", "comment": "Malware payload (Guildma)", "value": "3db843640b1afa4db0ff6a4cb5bfff89", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391618, "uuid": "6a396b43-733d-4382-bf06-42a3de7ade88", "comment": "Malware payload (Guildma)", "value": "13048fc764edcd59c59d1ebb8ebaacc53786edc91617f1663c92979db40f397e", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391618, "uuid": "7b50007d-baf0-4f8b-91f0-a745439a8419", "comment": "Malware payload (Guildma)", "value": "21377d511daddef91aa4897ea9c7a1c892730156", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391618, "uuid": "602ad61a-0e3e-4742-a57a-90bfaac521a7", "comment": "Malware payload (Guildma)", "value": "510ef5edadc4e585e1dffe5c1b729266cd1474705e37221e06b53eff9193b920182a822b4185848460067f1b4308759a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391618, "uuid": "13b886b9-cd2b-44df-bbac-d25d06fc351b", "value": "T14722B06D230D8ACE76AA031C65F3BF92F519E011005249EAF2398780EF36D5DA793D5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391618, "uuid": "b37fe071-a515-4a44-b683-4e5759efcef6", "value": "192:I+XV3oXAHvyKJmAnximTveziKGjcIQvdwr9qqvf9xZQhaXhr8hrEhrthrukhOrhd:I+1oXMyKJmAnxzTveziKGjcZvd0ZQhaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391618, "uuid": "d87b6be2-9c3c-4b18-9153-1074765cc8f9", "value": 10513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391618, "uuid": "69528ecd-50de-45d6-83de-3ee112854eb7", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391618, "uuid": "a6a3b01b-3dbc-46c6-8972-57a8626a7e9b", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af24b34e-c7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679387449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387449, "uuid": "02d704c8-1f00-4048-9b7c-0fc0b77bf3ef", "comment": "Malware payload", "value": "9ac2d6a90b5fad415a589907dd5ea7ea", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin.net", "colour": "#4D75FB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387449, "uuid": "9c1ef9d4-ed80-4a90-ae2e-280524fb41a7", "comment": "Malware payload", "value": "13716fdf716aa8479df57501ce208cae4fc31e5a5bb9f483764ba76fdbea4b0d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin.net", "colour": "#4D75FB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387449, "uuid": "0fe352b2-19d4-49fd-b651-d0ea9c27c5c6", "comment": "Malware payload", "value": "bd41eb8d00f88972812752bbe3a3be91d986d73f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin.net", "colour": "#4D75FB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387449, "uuid": "8a95cd0a-fed3-4064-b002-85a9642d991e", "comment": "Malware payload", "value": "5a8ff39ab4b16c722ca3cc846e19b38f7e3340999bdb3c91fe02d7f39a04472fc45c31d30086828c971b46874e3fd6d5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin.net", "colour": "#4D75FB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679387449, "uuid": "95c0408a-8db8-4bc8-bb8d-4cf3a37b1da1", "value": "T1B7C633E693172EA7E249BF7A245C1311E1646ACE307492A74CF0B0D55DE7FCE132A86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679387449, "uuid": "155e9325-c63a-4872-9056-8442fcfa8375", "value": "196608:4DiDSy66GIbqTpOSLRfyvA8QRGqtgA9aHPa4eAYwKbacjTy1tdW9Rd+PrLv+8Otp:4DQQZFh8Qb6VHPd8wKbacjTy1O9RkfWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679387449, "uuid": "7cdfd901-c9ed-4fbc-a01d-caf5ce78ce86", "value": 11870641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679387449, "uuid": "be7b9d29-4a6e-43a3-add5-b3c4c88c0303", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679387449, "uuid": "5c39f19d-21f7-44b5-b408-00f916a5d0cc", "value": "pcworldx64installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adf9d07-c7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679408353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408353, "uuid": "0b4215c2-9a69-4ad4-aeef-108cf66028ae", "comment": "Malware payload (AgentTesla)", "value": "fd4fe9b1f8e0bf3ca95dfc86d3e5d3d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408353, "uuid": "9fa45215-26ed-4535-9f65-045c72bf0136", "comment": "Malware payload (AgentTesla)", "value": "143fcc434f1292929c4094082966d7e2aa0c175a7766fe28087879721b37e047", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408353, "uuid": "dbf67b17-2990-41a3-a568-3fb685945c3e", "comment": "Malware payload (AgentTesla)", "value": "8942cc1d310eafc1d7504bf073c95668872afa25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408353, "uuid": "86b2cf3f-3948-4a32-90a4-20c504a906ed", "comment": "Malware payload (AgentTesla)", "value": "30aff7133e3e52984ef9190c309fd9f9c3120ab90cdcff04b42004d8f4e393a37c5cc5f18c9390698e5e26356d63ad99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408353, "uuid": "b13f4431-7eff-408b-9e3b-0843e4c958c1", "value": "T147F401352B9A5639F43257BD95E42692672DA3B32723D81D08F511CE1B73B038ED0A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408353, "uuid": "5c991017-f537-440e-9465-b656d4210ace", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408353, "uuid": "272db94e-22dc-45dc-936d-5be6e652e151", "value": "12288:L/rmYMUnFW/N+bL/5rWOl/n05skp+qnkfJrj5Dfld33Jk6jwbNCb9hKftYfygWZU:L/rUw3PlmfYjRtdnu9bYgtYqjZ5G53/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679408353, "uuid": "2bfbe30f-7a7b-43d4-843b-d6474acd03a5", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679408353, "uuid": "9c3148f3-2968-48c1-8fdc-ce4a2455dc9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408353, "uuid": "a62efc8c-37f8-4795-b50e-f5bd1c3d6fcd", "value": "Order Requirement_600002543231232434581-Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d80c9b-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679398949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398949, "uuid": "145edf6a-c2bc-40dc-a1ee-22521ba4081b", "comment": "Malware payload (Smoke Loader)", "value": "d2be7b7d8f340631798a1ea4f50c10b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398949, "uuid": "96a0688f-72ae-4577-b803-9976b700631a", "comment": "Malware payload (Smoke Loader)", "value": "15e1fd6c8f86d072f3d6f79be7b62dff782c17b6e146e04e75e347cdef000b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398949, "uuid": "16ba032a-c252-4e67-9dfa-bd98a0edd8d8", "comment": "Malware payload (Smoke Loader)", "value": "0065f79a5ce402bcfa5bb284cda2267ed802824b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398949, "uuid": "272296b6-f320-430a-93db-123ec6119e47", "comment": "Malware payload (Smoke Loader)", "value": "d554af2291c5fbd609d65f2f9e4d7d4da71ed374afea0f0aa9dfa0a4179b765fb7fff164cfb3beae1d59f7c5ca0d79a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398949, "uuid": "99512e9d-6d0e-4228-ac04-d72cd58da097", "value": "T10D049EC35390BDA5E4158A36AE2FC6F4370DFC81CE69AB95E3086B5F08BC172C562752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398949, "uuid": "d80da7f7-3705-4b64-b2a0-d4b72bf5bba9", "value": "b6299cf22bb1b2b906c76a98a991dd84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398949, "uuid": "3b8b0537-5a75-4b97-a20d-2b552c46c0b9", "value": "1536:oOHWAVMYgkGcCCwtc9I3eaEPM9N8kk/knqyGTVNwNsAmQqg1ysZp9QNXCuQvBOwY:oOviBpt2ax9N86qyYemQqgh9xv0e05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398949, "uuid": "09bf1d31-2fa3-48f1-8982-17cde6af81f7", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398949, "uuid": "b1ca249a-588b-4826-84d3-41e54a10e16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398949, "uuid": "b0354148-510e-484d-8671-8d9b09da7b06", "value": "d2be7b7d8f340631798a1ea4f50c10b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41de1c0-c81a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679425280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425280, "uuid": "bfc21567-6645-4d07-9e4e-f5ca8981ca3b", "comment": "Malware payload", "value": "213838221c47c1d5fd11f7eaaf65865c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425280, "uuid": "ea3256f0-5a2f-4eb2-9a4e-4f1c86266c61", "comment": "Malware payload", "value": "160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425280, "uuid": "16228051-bf9c-4217-914e-ef16041c865c", "comment": "Malware payload", "value": "e0444a48c57f1b4a4a46e363bbd421c50f3deca7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425280, "uuid": "99b389da-fca4-4bb8-820d-e5d721187360", "comment": "Malware payload", "value": "9e38347db6020aab5758279b0f0f0e3f6cf159edcf58a7fb25accb9fc5efcf5dac842fb176d5bbd081a2f61a527571b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425280, "uuid": "35a0c5f4-faad-4fad-bdff-7775c06d4d93", "value": "T120E37D21F212D0B3D83718F127367572B3DE8E2C1AA96847EAD80F5DBC658232F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425280, "uuid": "c4e10669-8dd9-4f3b-a1f3-f0ad8f841e4c", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425280, "uuid": "49b57534-1544-40a9-8fa1-7e9bcc1867ab", "value": "3072:M6glyuxE4GsUPnliByocWep+EE2GLTlsuGb:M6gDBGpvEByocWeBGLTlWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679425280, "uuid": "aa5e21a9-46a9-4c11-9209-761578083f0f", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679425280, "uuid": "6378befb-55aa-4a74-b1af-38cb3d64973d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425280, "uuid": "ce2ff409-151f-45ae-ae31-08a2a395ac25", "value": "LB3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b0028b-c793-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679367173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367173, "uuid": "71793e02-ba9b-4e97-ae71-c40de3bb4c8e", "comment": "Malware payload (AsyncRAT)", "value": "0b2558275f8bf9af6279cbf0c0763ac0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367173, "uuid": "a55496af-1ea0-40fe-9140-ad91e9d64906", "comment": "Malware payload (AsyncRAT)", "value": "166d6d5be18a889db530c818bf4fabc70a67b381b3d58d64652efbab55ad6bf1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367173, "uuid": "7213b6ce-f5a1-48c8-975e-9c9fdd69b335", "comment": "Malware payload (AsyncRAT)", "value": "5385e1878071ae18061c1ddf517d616381efd282", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367173, "uuid": "7daad378-9f9d-4497-90bb-2d798286b5dd", "comment": "Malware payload (AsyncRAT)", "value": "14e460d0384ff021e8bde8dc3377a29bdbd8c60c8e4e5304b252694d7c5ce31da457dba7f167e39e04dd3862f4b65ab0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367173, "uuid": "d4bd224f-6b8e-4587-9583-a5d893ba1d42", "value": "T126B317145F8E0B45E1557EB80CB29344D5B2996F4C22C1336C9E20D96F3FBA07B89B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367173, "uuid": "000e9168-7d9d-4c86-bf71-1c3579cef45f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367173, "uuid": "1a42d0ab-8ef1-4466-923e-25e8615bd3d3", "value": "1536:Gq+AGtQO2dzb1DBxnkJwAUaPQ4EXJ6EipXy9FMXsGjB+V7DQ4X63AsqiGwHak9i7:PotQOQzb1vTrXni52F47927ogw5aWdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679367173, "uuid": "d0a0e0d1-aafa-409d-aa48-e3a2d23dca45", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679367173, "uuid": "37f93dbf-9ef5-4e78-8e26-d950251ff1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367173, "uuid": "1c197e41-a5e3-45ef-beda-f4486ff63740", "value": "minecrafthack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bd01a5-c801-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679414379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414379, "uuid": "fce99787-698e-469a-b469-fe1252975903", "comment": "Malware payload (Formbook)", "value": "9a916fb75b40c9d574590a3a85634b8e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414379, "uuid": "7759bb2e-f8b0-415c-9822-31aa2eb66168", "comment": "Malware payload (Formbook)", "value": "1707ce3b6634958d3aa91757ce34b7303d9a4d80da9052fafe49f9e6f7647c7a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414379, "uuid": "1d2b1e01-139b-45b8-b0e8-ab6089e80dea", "comment": "Malware payload (Formbook)", "value": "424d9c1f7affa0c7e93e548a135ae7a0c3b68a43", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414379, "uuid": "9d628d76-bdcc-41b9-921a-a4e82739e2fe", "comment": "Malware payload (Formbook)", "value": "d4201053dc2c9a246ed908835b1febf07cff17e6afb71237bc5dc77f750804f90b7dab9c00e0119c0af6b1682d87da48", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414379, "uuid": "1a49f29a-5011-4db3-b2b0-0e468cb2637e", "value": "T1071533957A3C84EE2FC9E28DD2E8B4C46C62637C45B0C1F97025A47477B727D6A63A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414379, "uuid": "80369bc2-a95b-4c6c-a446-7ec4bb359ab5", "value": "24576:Uf1sOIneCMJhH9c2pijgEC80LrQYLkwg5nM7g/nLw:Uf1sOIyzHCWFE8IWg5n6snM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679414379, "uuid": "31264303-e614-4734-9adb-f92917691b95", "value": 912893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679414379, "uuid": "c1a01dea-6895-4248-80e6-a5aed35ba38c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414379, "uuid": "ae334528-bd3d-4d08-935b-10197d1dece0", "value": "Payment_advice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b6d994-c7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679387675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387675, "uuid": "84dcef97-e007-4a64-95e9-c4dc0be0e397", "comment": "Malware payload (Mirai)", "value": "ed1472168cdeb8c93dd3f03c3c8fdba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387675, "uuid": "bd7cbb4e-8ecc-4e27-aedc-8c71c9213017", "comment": "Malware payload (Mirai)", "value": "17492e1447ec32d450601db269a687e058fab102b0bd35763e93483c755921cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387675, "uuid": "6e2ef669-7e82-4999-abd0-0c91e52ad0c4", "comment": "Malware payload (Mirai)", "value": "647657a97916d4db8ade0115a6fb5b3de3c02f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679387675, "uuid": "288dc33b-3a29-4bc3-860e-867ef861a63c", "comment": "Malware payload (Mirai)", "value": "3bd9f50567f46d422d8c290d85d73d4c275f31271de24482d2215eae22124ac210ecd92d98d6cd8283eacca7722f3c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679387675, "uuid": "f40e81f1-0cff-4e9b-a1c6-4ac4ce41eef6", "value": "T101C2E1A3A4E5CD15C863413B6F1F1AAB61386524134DEE1E323BEBDC63460B4A176DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679387675, "uuid": "5919842d-cb54-473f-beb6-552ed5eab27e", "value": "384:MRG/9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5cwd/DyZTYHHJC8oytPFnAqV/LlTf:/5+Kcrb9VDJeIwkTYTlPFnz/Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679387675, "uuid": "ac903ddc-42b7-4941-8758-5ad75b21e193", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679387675, "uuid": "66507635-5daf-4a91-bc6a-274dddd6805e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679387675, "uuid": "1c0300a8-6a9b-403a-b4a9-0565d33f17aa", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b545a959-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393043, "uuid": "74a9d839-d3b4-4458-b6ce-6462b42aebcd", "comment": "Malware payload (AgentTesla)", "value": "5069054980bc233520e9b07131a96a9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393043, "uuid": "08fe2828-f901-4882-9d12-1edfb42e72ca", "comment": "Malware payload (AgentTesla)", "value": "182638cc8043d9ee42926a8d79a3976c7d33ac8a1b08ec914092ba709b2e3265", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393043, "uuid": "cd20f514-ae19-4da2-aaa4-e8706a99a937", "comment": "Malware payload (AgentTesla)", "value": "93ba31cd767a059aeb7b8dfdf529d76d5cceb312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393043, "uuid": "c3c2cc04-7328-4bf7-8e54-45f4af6e7ff9", "comment": "Malware payload (AgentTesla)", "value": "4c1250876c3e3e6b1126ec514e5fd429b5dbed2c83c7e03cbf497a135329a0e2ebd6a24e72fe7e8ebb1c6e96511cf0d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393043, "uuid": "6b7a7d78-276d-4e71-80de-eacac40831fa", "value": "T1AC450213EAC49D46D4420BF96AE375D5131EBC227BD1A2C72358B70F6FB8AE44A0711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393043, "uuid": "73e2fdf1-98ba-46d1-9e56-39fc3d78ab70", "value": "24576:iLKKWQmmav30xl+MXUu9/lgr+MXUu9b3bVC+MXUu9b3bVUfcrDC/oExt:iLKvQmmQ30n+MXV99e+MXV9b3bVC+MXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393043, "uuid": "3c28429c-225b-4afd-8950-8d591c6892a5", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393043, "uuid": "7f20effb-552b-48ce-b065-a4059ce6c7ea", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393043, "uuid": "b4d4f12f-bebc-451a-a195-492ef220109f", "value": "PO-23101.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62983aab-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362410, "uuid": "c6fd4116-252c-46d2-b98d-1d18033a8e31", "comment": "Malware payload (Smoke Loader)", "value": "27b4d83be6dbc1d2ba58c0b8c82cc6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362410, "uuid": "f6053f3e-d8a2-436e-a2bb-87c44f43bc98", "comment": "Malware payload (Smoke Loader)", "value": "1851dda6a56dfab827e2a12b1f5828eb5ad1a7b889125252630375dc84c5578e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362410, "uuid": "2b2f7310-f632-42cd-9b4d-4758ea716764", "comment": "Malware payload (Smoke Loader)", "value": "e5c39a377ee4c6aca1450df51bdf38b51b356667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362410, "uuid": "ef66ccb0-34d8-4467-b198-735003e877b8", "comment": "Malware payload (Smoke Loader)", "value": "864cd9b3ac83e3049eb1b703176b8abea834fe0b92115dd36786431e9d47d1c3443826fd41d28b4400561e64c25e85b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362410, "uuid": "2afc85d5-6ec5-41db-9a1c-b7ddeba5e84a", "value": "T1E5048E035BA07851E526CAF25E2EC1F4B61EF8D1CE5D676E33086E1F0873262C56A7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362410, "uuid": "86578275-9b8d-4a55-81e3-7b9694e0b6ed", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362410, "uuid": "9c31952f-0d84-40e3-9cfd-7c91a076dd44", "value": "3072:4W1zTaqN7B6Ie8NWQBnpRHzcsrMAwjkt4Ad370fOVKlYlJVn6YPGZ:pRa+ZdJcIMAwjwgOVVJVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362410, "uuid": "b680d111-32e6-404a-a7df-fbd41960c330", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362410, "uuid": "c9dddd5c-d7e7-4e65-9a84-0c60c4b8de69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362410, "uuid": "70c35666-83c4-4904-afaa-b07d6041ef19", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3a93ee-c829-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679431550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431550, "uuid": "a112190d-b12b-439e-b941-6140fd25d3db", "comment": "Malware payload", "value": "acf538263e88093afece96e59a50548d", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431550, "uuid": "cf2611cd-b71d-4d1d-811f-159bfb24f06b", "comment": "Malware payload", "value": "1967d4164751bd485460b7e6177ce5d63e18615d08f76cfd505d211c3fae8c7d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431550, "uuid": "4cad54e6-b6ee-47f1-ad53-50c3cec8bd33", "comment": "Malware payload", "value": "e4a39e79c96a29b3ae5cb004901c47393dc48532", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431550, "uuid": "d1baef33-d51b-4b1f-a423-0cd9b134501b", "comment": "Malware payload", "value": "652f78f0db7297a84286741d83c76bf942c83859a98f47d756e897f2d16c795240e26d3e61faf8b1c1395fa46249b7bb", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431550, "uuid": "a0c5ba4c-7c4a-4111-8f7c-c6b5758ce372", "value": "T19495022533B05F15F6BA577054B2E55163B37A2AF633D708ACC810DE3EB1B804B19A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431550, "uuid": "c790787d-0e84-4872-908d-426a674fe2a8", "value": "24576:oGwX9orGfSa0KjO111VD+7AB7L+KgyrrrrPrF0BMnlE6A:oGSoCffBUykODyFBnK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679431550, "uuid": "d280e11d-d357-4e71-9618-4ca68b398d6b", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679431550, "uuid": "e2070bfc-9078-4eaa-b16c-8cca745817bc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431550, "uuid": "f7495d65-659b-4937-8677-decca6c41db8", "value": "nQuote_3500001277.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1604d7d4-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679415968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415968, "uuid": "e640c058-194c-418d-a953-3bd236fa2a7a", "comment": "Malware payload (Formbook)", "value": "67a09ce3a6ac852a8d493d41ac68231c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415968, "uuid": "c8340eef-5762-4cbf-be1e-1bd4eaf9c37e", "comment": "Malware payload (Formbook)", "value": "1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415968, "uuid": "6c32d9a5-fb7a-4dd2-817d-d12d79033c19", "comment": "Malware payload (Formbook)", "value": "0a4feb27fbf7af7465ffd3579cf79932ae64af61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415968, "uuid": "7497e5bf-46c8-462f-8f17-dd5a2525677b", "comment": "Malware payload (Formbook)", "value": "a4fe6b0e9b8dccb1e884c5a9c76dffcd41383a0d38d4f2615249f27b32d932762070af8bc1233764f7847305a9e5070b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415968, "uuid": "0f4e3624-e3d8-4af6-896a-057143341a6e", "value": "T1AAE49E26A5918933E07759B49C0B83B49C1ABD623F34A9C736E43E4CCF34F917A29257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415968, "uuid": "062f1d45-222c-4b6b-be91-493839e7ba23", "value": "1dd7dc7340e86bf03e29b493fc3eaa69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415968, "uuid": "3b498ff0-9a1a-4096-b71b-d04c4f29c860", "value": "12288:7xsnwyGGFm7NjhBBBHS4PKZr7j65hhxqeIpqOZODCFwxK:7yw0m5jhBBc4yZr7shCBiCix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679415968, "uuid": "7c3d6e09-bac6-4adb-8180-142013c89ad1", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679415968, "uuid": "6e101f0f-e9d1-4d18-a62d-12cff7b1e936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415968, "uuid": "48a17479-947d-459e-a9ce-11793b0d48a4", "value": "Swift, unicredit bank.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32224c23-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679389387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389387, "uuid": "27e7abbd-b801-4df1-b17f-e23d636b4a83", "comment": "Malware payload", "value": "b5cb1485653e39d9e5c87e796858c592", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389387, "uuid": "b7e1c1e3-bd97-47e0-98fc-e5b3edbc893d", "comment": "Malware payload", "value": "199728ed3a5dcc31d6d5fc9214f61d72abdff1590e54a3fa24673d3a45e6cd0f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389387, "uuid": "554e32bf-5bb1-4fd1-ada9-5787e5d4c3f3", "comment": "Malware payload", "value": "1dae3f07c429ef28b45fe34635fed96bef8cbd68", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389387, "uuid": "84ff0b42-e688-4ddb-be50-45270050f061", "comment": "Malware payload", "value": "c88ac8d7b45d315195819072372328e198420c6be140ab0edc475e9942e5eddf3dfd155db58dae477382a1e8ed49f230", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389387, "uuid": "0793b5f5-3ef0-412e-94a0-92ee6e3d9ec7", "value": "T167A3F15D75A1C346D805AA35CEC1D5CBB7F9BC92FE52830B36C83B0F0A7D1D98812A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389387, "uuid": "f26c0dd7-8686-452c-b9b9-e4bdcd4544c7", "value": "1536:Hzrsqz2fWqXscGeHePcipVb60CJIYGWZWn30IOmAUbA+O6GGphTtB9F4KP4h:HXsqroGcqb60cIi8EpFCA+OvgptB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389387, "uuid": "40982fb2-7169-443e-9a9c-2a3ad7442317", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389387, "uuid": "71fe427f-24c5-4dd0-b771-9a72e963be1e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389387, "uuid": "27b26c38-a473-4556-93cf-6a889578047f", "value": "shipping.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b999a9-c7b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1679381929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381929, "uuid": "ee293664-5bf3-4cd4-800f-072045ec70ef", "comment": "Malware payload (NetSupport)", "value": "2db4e85f42ab1b1b22a6829f273566a7", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381929, "uuid": "e10b26ea-2edc-4f08-9df0-cdf1a309e63e", "comment": "Malware payload (NetSupport)", "value": "1b23f6605bf3ee638b369bc344cbd02591b5a9ab320a874b07088652b8d93888", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381929, "uuid": "4318cb6e-bd77-4d05-aba2-62c16be3c1b6", "comment": "Malware payload (NetSupport)", "value": "9883c2037aba20b5a962a121030360e989261bde", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381929, "uuid": "9d61ebe3-8715-4a4a-ac7e-3ecf43b5ddc6", "comment": "Malware payload (NetSupport)", "value": "7155ce0167ffa31812b6dda4e7cc2216e4e128dda8a8e11578345081fe219a330152b35a6f73163acef354fcace99381", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381929, "uuid": "a054eb16-c923-411e-94f9-4aecf378252e", "value": "T19F94D011BBE2C072E907097A092B476E9736FD4A1F2587C7EF941E1ECE702D29E36251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381929, "uuid": "f53db9c7-d4fe-4323-93d4-55e8c40ba8d5", "value": "2053909a946a770e91562fee33517d62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381929, "uuid": "51ff05d8-4943-41fb-8941-24cceac19552", "value": "6144:AZqs7XDQk8PFrWKN5nwtm/NYGridElYaa/7d8BrNtDAqlPJedOJKn4eirAj:AZqs7XWiKNBwaNtCZNKJdJZsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679381929, "uuid": "7bc218a8-fd23-4c5d-bfca-111ebec31bb0", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679381929, "uuid": "a6ca264c-c0ac-4031-8a09-439f4d5c62f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381929, "uuid": "750c03d1-fe49-4a22-9833-88b75c683b15", "value": "2db4e85f42ab1b1b22a6829f273566a7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a19d7d-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679405386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "1c893002-eb49-449f-a785-d59b44472bd6", "comment": "Malware payload (RedLineStealer)", "value": "01bfa421b6d8e93c203ecb40d29fa672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "4f812268-97e0-40d2-913c-b43107191485", "comment": "Malware payload (RedLineStealer)", "value": "1cb3ca9ccea023e0bda566458b1bd2b811e0aef018c5564e491c0f671202f55f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "a790f39e-434a-4f52-9117-ceca966bbf93", "comment": "Malware payload (RedLineStealer)", "value": "eda8d7434ca23e746bd9cb1d07ceb6153507034e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "d2c95d53-e973-4072-bd81-c9d3cccb4702", "comment": "Malware payload (RedLineStealer)", "value": "0e18097d8692e0b8b32521ba266048e5ea3f6749b8dc7a9e413259c999e9350c1baa303c46929f0e116eabb5a2d443f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "be28a90b-9bef-439f-a447-17b4a39a7aa3", "value": "T12F152312EBC404B2DCF41B7198FA03470E72BCB6A9F9975B2714586B1CB2AC0593777A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "44417d66-c0b8-4d4c-8b17-a643562a0c8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "5507a252-99ea-49d6-b58e-b0762e990184", "value": "24576:QyfEqCdkQ4jusnWwFwwQ560kuAoDHBhB0fNr:XfXV9IjYa1hB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405386, "uuid": "e85a1bd8-2de0-4ce4-81ae-f007d8ebecb9", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405386, "uuid": "2af9c39c-9340-4f94-8197-857f292b8ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "05813fe6-ad02-4c7b-bf46-f928e132474f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f0b4df-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679391646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391646, "uuid": "dcef7efa-e410-4691-89b7-fe5a7c4016a2", "comment": "Malware payload", "value": "42ba5580d4769cc04927cb87d6e8741f", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391646, "uuid": "1265cf12-2206-41f4-8bb1-6328969b8ef4", "comment": "Malware payload", "value": "1d6b7413e684f70103aca0e6b259dda9728c2d7b8ce2c07d6068232e6a26aba8", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391646, "uuid": "fcdb3f27-3078-4698-8c87-ca72f3c8e90a", "comment": "Malware payload", "value": "609b0876f2aebf4305af89f328cf5cd1acc1d5f4", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391646, "uuid": "9d00e807-777f-4721-bc94-89f696629d46", "comment": "Malware payload", "value": "83ce8ef09480ad8486d19d2823827d44363259c46c993b2ecfcaf8edeea6386a4b4cef2719fdd81f68a951a10ba861cc", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391646, "uuid": "29f7c4c1-cbc2-483b-aad5-151c4eb4f3cd", "value": "T141B6331B798B40F7DEB1EA3952359D30742C246651626EF6733CCB2A1918FEEB42C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391646, "uuid": "ca30c158-a6cb-4fb3-8318-c121241c836f", "value": "196608:lR6krlqiwUpcED67rIBxn4UxYu9kWj9jZSajmL+A3LXFwrrnPGm9Mz0Q:lR6krlsW7BBtquz9SajmLHKrjGmLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391646, "uuid": "f2a017db-fb7d-4025-bf82-30915046cdc3", "value": 10494478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391646, "uuid": "22a6079a-3eb6-4745-bb36-06b7cdebbb27", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391646, "uuid": "42fea25b-00b0-449e-bba9-9ead4d1d93f7", "value": "pcworldx64installer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9fd5b6-c77f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679358509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358509, "uuid": "2d8a1b0f-36b4-4748-a0f6-8e0f9c9cf4f4", "comment": "Malware payload (Smoke Loader)", "value": "385cb03a414e08bd403b294087ffc93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358509, "uuid": "ac66368a-e156-46ac-b04c-ddca5aeaf443", "comment": "Malware payload (Smoke Loader)", "value": "1eaa79cc6464a1f5f54beaf7d0cca883d98181cd0e82335804a5f690b36d9e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358509, "uuid": "ba33874c-18e3-4083-a46e-c86ab7f64ca0", "comment": "Malware payload (Smoke Loader)", "value": "70811cd99d37fd6d2e24df1c352ba63ef4fe3333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358509, "uuid": "cb00ab92-49bc-4c87-97d8-ff7d8b203d0f", "comment": "Malware payload (Smoke Loader)", "value": "aab89fd07be5709b25e3421abde9151307b5f4830587adc65267d49a2890c3c1cee661342d7f9c97ce3b0adf6e88a985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358509, "uuid": "d01ce4f3-dcab-49c3-8f0e-4df54bb2902e", "value": "T135048D1396A06C51F412CAF14E2ED7B4B61EFCD1CE5D676E32086E2F0873262C56A7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358509, "uuid": "ecae21b5-2a77-45d4-bc81-64af9675e43c", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358509, "uuid": "4b1d074c-3d15-4a84-b855-8097b9ebc57c", "value": "3072:xa132T9nFdEvyNWpn7SIaS+BAb+rS1ohJ2FY6/uW0aZZ:oBM9FjoSI8C+rSOKS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679358509, "uuid": "be34dd38-c56c-46a7-bdfc-c4d46969ac2f", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679358509, "uuid": "2a20462a-0375-4707-8366-cb61aeaeb433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358509, "uuid": "8347986c-bafc-4b01-b8ff-6d623d126559", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1355d796-c7af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679379027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379027, "uuid": "7f869481-0f39-4fb6-b016-ad344cfe549a", "comment": "Malware payload (Loki)", "value": "370ebdf4ff5036c106793994cc851779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379027, "uuid": "e701250c-5b34-4a39-9c57-c580df39924d", "comment": "Malware payload (Loki)", "value": "1ebedb652fa27423240c3efa860e7551958811120737ee5d3ea7badf671fbacf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379027, "uuid": "e7a90967-be6d-4622-b06e-40538879b5b5", "comment": "Malware payload (Loki)", "value": "cc04ea26c1364b9a058b55c8697a49e1c7e16970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379027, "uuid": "434140a5-e38f-4e0c-86da-9cafdf5d1a2f", "comment": "Malware payload (Loki)", "value": "e91bfc6ee35a6f2dec6d20ed9fafb2f69e8bb2feda373c4b6c831b9f9e4f0a633b5e9861735b6b6e9d680bdefc3083eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379027, "uuid": "347241bd-d390-453f-8e8a-5b2ae00021ea", "value": "T1F00507435EBB5085E8B70F38547A76980B34E953BDD9903B3CC9B61A8FFA68360463D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379027, "uuid": "7831a928-16c5-47bf-a682-34e9087d6b7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379027, "uuid": "1cac6ff1-9ae0-4b28-ad7a-4033e6a68d88", "value": "12288:0wRZRbIx8nvRW3NVuf7sBF84DpHCojUzQO7auRJ0CXfmv5gn:02+xuv89V4gc4DVhhuRax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679379027, "uuid": "5bea3903-14ca-4f16-af14-f9a9e330ddcc", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679379027, "uuid": "36038c2a-1d70-42fa-b9e6-3ff61415e479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379027, "uuid": "1cdbab45-a968-4252-893d-3eca6ab9bf3c", "value": "DHL Express Shipment DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94ddca5-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363012, "uuid": "2644f6c1-d93f-4163-8748-3495cd26462d", "comment": "Malware payload (Smoke Loader)", "value": "b92288fb617192c1eff11da83b7bbb70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363012, "uuid": "844a1e19-e9d1-4252-b9db-b25a90ab0a81", "comment": "Malware payload (Smoke Loader)", "value": "1f5792fd2562f076c434647506d5a4346dedf0cb256df3f9c63f4b56e00911b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363012, "uuid": "83bfd973-3523-4436-a3b7-1574fc4615a8", "comment": "Malware payload (Smoke Loader)", "value": "de8a17baf0f0ac1d416f6506302b53f9a2584f9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363012, "uuid": "edafe18f-a0bd-48f6-90ea-53fc175c2029", "comment": "Malware payload (Smoke Loader)", "value": "643c3e3f785943d8b14c1d8944ba6a06e3ddc3d6a6e7e7d8505a3b61e292f312cd9215061f69af4e5c1359b1fefa6947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363012, "uuid": "30c4d546-2c3c-4426-8840-20a39e0bdf42", "value": "T1F1048E0356907861E412CAFA9E1FC6B4BA0EFDD1CE5DA76E32046E2F0873162C567BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363012, "uuid": "cfc79f27-78d0-4a3f-a08e-e22b97c5e65a", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363012, "uuid": "63ae6d07-0624-4588-9095-11154497f6ce", "value": "3072:XUvNqlKTQ+WE3pQWeHqpxIkoDwhR2elVsQagezc6c7iuZ:aqsDy5HxkoD4RlVsQag0c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363012, "uuid": "842b5cbb-16f6-4b11-9347-fd67db48d896", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363012, "uuid": "3f804c5b-ede6-4c9f-b537-2eacbff2654a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363012, "uuid": "b7c33d5c-dbf4-4d4d-9e06-97742e1fb9d9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17b06b2-c7af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1679379266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379266, "uuid": "172ee67f-a896-4309-bed2-3ada6f3c0657", "comment": "Malware payload (RaccoonStealer)", "value": "66ac9ab5cd3881b7799a8cec1c6611f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379266, "uuid": "a1903eed-c0b8-4742-8812-204a42338392", "comment": "Malware payload (RaccoonStealer)", "value": "1f9bd27fd7591a98afd67499ae6730eb56c137335d283892bc06b7ab2241ed6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379266, "uuid": "fb341520-9288-4de1-bd93-21d9cd769425", "comment": "Malware payload (RaccoonStealer)", "value": "6671c3205779264e90cfbb17221f62a31aef8d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379266, "uuid": "7131b422-8d3c-4d33-9e5c-f4ab004a4372", "comment": "Malware payload (RaccoonStealer)", "value": "a094090910f3ec7d6a05a1a18cfceb982b753d87eda8f6bb7f29ec0d9d12c1b03c39918a9e5bca413f0dc926db932b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379266, "uuid": "e46bb5f8-db63-48e1-bfe3-01a0af31aa11", "value": "T15186332312E90199E2E7CC35C92BBDA877F953177A43EC7855DAADC03A154F4A203B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379266, "uuid": "9f8edfea-7026-4000-8975-c28a5c5870a2", "value": "201158e51d2f48f39b5bd36ba20e0af4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379266, "uuid": "3b161886-7a27-4f50-b6cd-0b8413060aed", "value": "196608:57bHTT6IwW0srdF31vvetKgMU3zClYEcuSGNP:p7/6NWbdR1vvkDH3elV4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679379266, "uuid": "089f6924-6c5d-42fd-886b-3efc29bd4b01", "value": 7896576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679379266, "uuid": "010c427e-53d4-4e6f-807f-3ec2b4c57fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379266, "uuid": "595f3125-4592-429d-b9c4-5dddeb020d5c", "value": "Autoplay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eb0557-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679393151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393151, "uuid": "517b93b8-6176-457d-af12-1018d14f2f76", "comment": "Malware payload (AsyncRAT)", "value": "bf77e106994c623f8b5c1747e97ba97e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393151, "uuid": "eedaffc9-2d21-4347-a000-75c706974d8e", "comment": "Malware payload (AsyncRAT)", "value": "1fcf39f27164b5bfee7f234220f5cd10f73932d72794cafd678a0dac1297707f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393151, "uuid": "f04eba20-7e4a-4ecc-9f33-ca93c4d5f0f4", "comment": "Malware payload (AsyncRAT)", "value": "d66c2fc3c47cd4f60924cf863c43d1d8c28929d8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393151, "uuid": "5fdc204f-b7b8-4f4f-bd09-fe48e25e95d7", "comment": "Malware payload (AsyncRAT)", "value": "0cbfc26a5d28b38d776e7b305aef799052ca662fd9488250c92bc6e9fe3f1e53b186baf69fe8a977a879acbcb83bb9f4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393151, "uuid": "3d1a5d82-5252-4217-8a0f-2be450ee564a", "value": "T1ECA46A70B5FEC2C5C6A87538ED5BB1F94990EE21D8248C1F3E987E1A34716A1F93421E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393151, "uuid": "c76f7e7e-c289-4d3c-afaf-bb635cac7e2b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393151, "uuid": "673ebcf6-01f8-4413-b4d7-3cdeb4c2b6c9", "value": "3072:IfY/TU9fE9PEtuoNbGi7KV6WBp9aHRhFDCPuu+CANvDZ23ykOnp3l7JO/:+Ya68G1p9aHRhd2+CANvDZ2CkI3dJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393151, "uuid": "37f33aad-1468-46dc-90b4-6692b1f24ee0", "value": 480359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393151, "uuid": "67e39138-19db-4a47-bd88-6ef724056bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393151, "uuid": "2857d920-1fa6-4425-aa92-bc0761abcc6c", "value": "BG000896543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16cc18f-c833-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679436040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679436040, "uuid": "a74a4380-2dbf-42eb-87cf-1423026ea7e6", "comment": "Malware payload (DCRat)", "value": "23726a41d7c42dfbec508e8203659e41", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679436040, "uuid": "3880e855-948d-45a8-92a7-e01a32301c39", "comment": "Malware payload (DCRat)", "value": "1fd9be727b7e58a9bb3fce45e8bd8925d471725ca2a86e102e2adb44da28e5c7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679436040, "uuid": "c78fd77b-c2ab-4d9f-9808-1aa8033e357e", "comment": "Malware payload (DCRat)", "value": "f17e7dd847cbdff1743301b15a567116e5a56cb0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679436040, "uuid": "70acfcb1-6184-410e-85c8-cb26154bd92a", "comment": "Malware payload (DCRat)", "value": "8dd9b7c7ff211601ec46d148b80f0db89351379ded18c81da3c1549677326ffaeb52e9ef9b2d87a5a585075ac2fb196f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679436040, "uuid": "762b60ef-03f0-4144-bd23-a6d50162c080", "value": "T137C5CF027E558A11F0081633C2EF450847B4AD516AE6E32B7DFE376E55123A3BD0EADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679436040, "uuid": "478c2c71-466e-4b80-aeca-5f8264b53335", "value": "069407361307fa34b23ade96ab2d8363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679436040, "uuid": "2d992ac1-0dad-475d-b0d8-32b2885ace3a", "value": "49152:tWMazWNh42R1Wtm+DEGZHFUNxD16rtlqsC0btgzPZ+hT7cG:tWMaiNpnsJSjDAhb2zPZSIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679436040, "uuid": "d55e0ba4-5fa5-4b80-a1d2-9e4db1b5c4fb", "value": 2669806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679436040, "uuid": "72d6e42f-c692-4f02-a8c1-49d370ef3de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679436040, "uuid": "f3e5762d-08cb-41bd-aeb7-972a5a3c9124", "value": "23726a41d7c42dfbec508e8203659e41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29354ed-c7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679399937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679399937, "uuid": "e4291d42-90dc-427a-a604-2fe42d08122f", "comment": "Malware payload (Amadey)", "value": "bdb116b8a8e6c7646c3731480d223ef3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679399937, "uuid": "8fa4c62e-4cd6-4106-b208-534ace66153b", "comment": "Malware payload (Amadey)", "value": "21656a1a281d78acca102b8df2b424bdc696cc081cd3b7c6ee696e7d50671bc2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679399937, "uuid": "0178179b-1cbb-4d48-a1b6-35f8f742b88f", "comment": "Malware payload (Amadey)", "value": "8d9850b47559f5fe0d122981277667ce89f5ecf5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679399937, "uuid": "ba19f36f-6dd9-4367-8a92-151005cfc338", "comment": "Malware payload (Amadey)", "value": "1763117fd81ac42ab5ad8ef6ff3df88e0fc46c60cea5a59156c94b953249a034860ca915f89985248dfaadcbbbd7a144", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679399937, "uuid": "9721ae9d-4fe7-4e75-b724-c282edacfaf2", "value": "T167451303A691B8E2FB6741354F1ED598BA6FB5318E4C9643331C6A3F19B42F2C2A7315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679399937, "uuid": "fa5bce72-a28f-44fb-baa2-e7b0a5407e79", "value": "86f73ba4a5b0bd6d0633bc10b0ac18f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679399937, "uuid": "e63f7b78-4596-4083-b772-0983aa97993d", "value": "24576:kt0mgo7IYRQq6madDc0MFjRGSucplKTg4s5mCN0TU8/ByKJh0otC:k1T7I5fAXjRGStlKFss1Tj/Byqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679399937, "uuid": "28e3ea11-c65a-4ee6-8baa-f8e79e479ba9", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679399937, "uuid": "aaf72345-b7fa-4eb2-91c1-974a0aea3d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679399937, "uuid": "9b1b7d8a-3c2a-4211-96f9-d3541469663a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d358b1ee-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392664, "uuid": "620a9a5f-46a8-4ddd-963d-361aec78a39e", "comment": "Malware payload (SnakeKeylogger)", "value": "2de06ee11923f6b39f7f9dd36532ed85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392664, "uuid": "2fb9e12e-ac29-499d-9dc4-8eb8904adb85", "comment": "Malware payload (SnakeKeylogger)", "value": "2191c01eb3c66334a271578c1a0a421a12167a6137b8be35628460782ad029cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392664, "uuid": "665e4cb4-f107-438e-b4e7-53113ff03c3c", "comment": "Malware payload (SnakeKeylogger)", "value": "353c3627ba252c7bea49bb535bf93e98b280aad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392664, "uuid": "928d4300-669d-461f-b44b-cce429167d72", "comment": "Malware payload (SnakeKeylogger)", "value": "2fb84285246be68113f990b89cf016ccd1c2eccd7856a0d3189aa390d6f067b8cc9764460e39b8a56a2078db2d76ccbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392664, "uuid": "9e1bd80c-0d3f-4f2e-aa04-8a0cb94a7952", "value": "T132254B424DBB11C6E8B70F5C547A76980B39E966FDC8503B3CC8B65A8FF9A5360063E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392664, "uuid": "2ed6fc34-db39-4e52-ab3c-b4b20b309346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392664, "uuid": "20f62847-b6ae-4bba-b2c9-21a9e954130f", "value": "24576:YfwMI+6DRIZgdya2WlOvZj9R46lN/8dHkoJs6Lgq/8:ywfDRM/ah6Zj9RlNkRpJsUl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392664, "uuid": "1169c816-ffa3-48b5-b1c4-c529b6ae8527", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392664, "uuid": "8e0e3ef4-9fb5-4600-94dd-5fa1d980a86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392664, "uuid": "92346208-c373-4fcc-a974-bf7cde604376", "value": "purchase order YS-3205.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc04929-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679393351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393351, "uuid": "841aef76-bd6d-4c3f-8263-6f9b99f24af3", "comment": "Malware payload (SnakeKeylogger)", "value": "a78f00c0e5fd95bbdf2dc806b9c42b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393351, "uuid": "b084885c-7e4d-4b94-b833-cfa46216d33a", "comment": "Malware payload (SnakeKeylogger)", "value": "22921908f60799e10819fbf874d0f4509cd0c68f9f59efa401d78ebc9099c9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393351, "uuid": "87504260-82e0-4ac9-b70f-2a4cb77156ca", "comment": "Malware payload (SnakeKeylogger)", "value": "e44549b4e4ebb1217d7081649b79ea2f37a4e9a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393351, "uuid": "9ba029f9-10f9-46f0-bc42-b344a75b1146", "comment": "Malware payload (SnakeKeylogger)", "value": "455ebc90ef0da4dd83cd361797a34bb065cf8e34e6ebe7c676f5ed197ef6e283d539c81d8bc5b0762878ab58dc552d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393351, "uuid": "36b3b7d5-0dcf-4292-af99-9bc775af1ca4", "value": "T17A9401217F8BE81BE45669B4744BDA2D9E74EF249109E707F2B03DADA4B63126C1F103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393351, "uuid": "56ca28cc-9258-4291-bd17-aa6d4ae3f686", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393351, "uuid": "049285ef-271e-41b5-aa6f-67fb164ec2d0", "value": "6144:H6bAcJvkzKmPPzS58G93IuZTzsHoWDiNX5t4qgKOhY2Pk7yCQXa7g8F:Y7ubCHICvsHrY4582Wy67DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393351, "uuid": "05258720-8c77-4387-970a-e91ab671d42b", "value": 433248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393351, "uuid": "d9f5fc75-4cb7-4e13-bc01-e8293fc43e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393351, "uuid": "5134c91f-bb85-4b29-8dee-8e39946476f7", "value": "\u00f6deme belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d492f4ed-c814-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679422730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422730, "uuid": "b7b69a84-bd85-4971-86fb-e40a4e5a77f9", "comment": "Malware payload", "value": "a20d0465258be732fff35b90a1b73e5e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422730, "uuid": "a3e7122d-12a9-4177-8f51-bb0ec9a77fa7", "comment": "Malware payload", "value": "22c13229520d5aebe0a068ea9d0c79fbac824195eda7f51c985dd32be8998f3e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422730, "uuid": "3e85da59-4232-4f46-abad-2223e6f17fdd", "comment": "Malware payload", "value": "cea7925c3df2a5c305ad3bbd1682a4f5ac4806f0", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422730, "uuid": "15dec664-1b15-4bb5-a040-8506cef648f8", "comment": "Malware payload", "value": "7787d69a04007eee205be76beb42ef3a5e1bb91eb06e6f2a7b7bcc3ea752f157604e7c658d15f7497adeb090e03859d6", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422730, "uuid": "12b799ec-a0a1-4d97-be41-fdcd48d82c7b", "value": "T1C793022D6D6A8523E091AA354ECCCD176B992C947BB2BC83655333C5B13694F0F02FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422730, "uuid": "97763a1a-97ff-48fc-bb90-75b853862039", "value": "1536:QD6q6SSSZLqw03+r6PWsWcDQeB9d4uES+oPoPPUzr0y8eVFFjGVpKQ2VMiq4u:QD6fSZOwE+roQcdBp+HP9y9VFFa32VeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679422730, "uuid": "f1e508d4-dd72-486f-b613-68903a1d096d", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679422730, "uuid": "155e6073-2a4f-4651-a896-e1a37e4907fe", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422730, "uuid": "675f09cc-15dc-4349-a97b-0a1974c8c6c7", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b318103c-c7b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679383590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679383590, "uuid": "0ffd417b-8c15-4200-90bf-6f8a685d581e", "comment": "Malware payload (RedLineStealer)", "value": "16d168390ce2f72b25a09401451bce23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679383590, "uuid": "ec412627-f291-4f2a-84d7-6a41c9c9367c", "comment": "Malware payload (RedLineStealer)", "value": "22ec03d8668c7e05ea9b774a47978e93edf6ab9b005b45fcb69048b83615a806", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679383590, "uuid": "c83cfb60-e7da-442b-8b53-9aee9b0d3db3", "comment": "Malware payload (RedLineStealer)", "value": "44af73ba1dbfd166abbf7963d651fb84020c63cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679383590, "uuid": "274d7686-7a0a-4f3c-955c-e0b87d9fdb23", "comment": "Malware payload (RedLineStealer)", "value": "3405419264d9ba3f3669be149ecbb873b946d763a5350cbcfd89a29c3c43507e3ca39014baec80e9dee0c0c0da9e01c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679383590, "uuid": "1a20a916-e78f-43c5-9e85-5b87674a8ed1", "value": "T18C45021382A27D55DB1ACB729E1ED6F8775DF6308E49775632086B2B0AB13B3C223711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679383590, "uuid": "46cfbbc2-deef-46f5-8e00-a1e85c21455b", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679383590, "uuid": "8a8efac1-e572-44a3-a882-6f43a107ee46", "value": "24576:J1x4Y79vRMcmZBqkztFhjyDcLrai+hEmWF6:J7469vicSBl8f3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679383590, "uuid": "06dd8d57-9119-4496-b0f7-5c4091097c62", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679383590, "uuid": "d64932b4-8c0c-4b49-adc9-9252f3dde802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679383590, "uuid": "32046711-a160-4e5b-a364-84350c091ff2", "value": "16d168390ce2f72b25a09401451bce23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f015f85f-c7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679390994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390994, "uuid": "0bdcc489-2556-404f-904b-ed332722770a", "comment": "Malware payload (GuLoader)", "value": "81c6334642219323545f7bab1db856d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390994, "uuid": "949dd685-0567-4b69-8010-c4fb5e6bd05a", "comment": "Malware payload (GuLoader)", "value": "24cebe5631047fe2681c97e1c582fd27cfa9520e431e5212db55cd1b14b3afba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390994, "uuid": "44d752a7-a93f-442a-9b0c-d59467754b44", "comment": "Malware payload (GuLoader)", "value": "74d7e2cfe0455585c8e50bb6a1c74be75de7eb4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390994, "uuid": "e1957cb1-168f-4c20-a887-9ff9f1670c9b", "comment": "Malware payload (GuLoader)", "value": "0cee9578b84e1e1991303a9d9c063be861f6fe937c2e5801df5c9baf995595b6922a0269a47371c092be972ce71b19d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390994, "uuid": "478824df-e1cf-438c-b0bb-c3a519a7d250", "value": "T17D940111BF8BD867E422B978604EDA195EB4EE249146E347F3707DEDF576212AC2F002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390994, "uuid": "9646ebaa-5148-42ce-8b1e-78d46feb00af", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390994, "uuid": "fca1c890-2199-4f31-9973-ac6dfd881839", "value": "6144:u6bAcJvkzKmPPzS58G93IuZnB+HfWM7Zn4N9/qbry9vgrU4us2hLrc3JNZ7Yl:t7ubCHICBcWM7Zn4bib29vaULhL6Z7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679390994, "uuid": "7b9a0584-3620-4c8a-b731-25a6336405dd", "value": 433720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679390994, "uuid": "6a1245c4-1ac4-4b57-9634-3517d43f460c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390994, "uuid": "1773a072-6993-4385-9fa1-87134c26127d", "value": "FACTURA PENDIENTE2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed308cb7-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406880, "uuid": "98092035-d90d-4e52-a4bf-258aa87a4a6c", "comment": "Malware payload", "value": "e19c8e77a1e7ae5a51ae4fe7648abaaf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406880, "uuid": "147ada88-6623-4ee3-b5f5-793ff8226484", "comment": "Malware payload", "value": "24ee3950b66b09a44ec65d98d3837b5caecec3faf7a7298648aaf32aa1734f64", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406880, "uuid": "da6316ea-70a4-44ef-bf9d-b7003575ffa1", "comment": "Malware payload", "value": "de2da5c4b2aec11b8077a63ad8d676fed55b0515", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406880, "uuid": "a40b5ad9-d40c-4084-a2c6-8eb70885c9ce", "comment": "Malware payload", "value": "148c1e5dc8dffa5fd7dbfcc5395d147212a10f2debb12b2430dc7d13ed04d847baf87cc970df83b0c0cebe6f29cfcd62", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406880, "uuid": "ceac5987-157d-4ed2-9161-61e4ee97b225", "value": "T1B405238BCA91C4FE771898F2810C1367ED6328359DAB3522A2F7C527790B6E61CDED01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406880, "uuid": "2e3ef34a-9864-4386-96da-e91bc2356b3e", "value": "24576:w8oBvwBy3/Wwc3XFwWXZ4JtnixL94Kvyp2wjVNyzpoZiA/WBE:KwBy3ZclvihixB4KvHiNyzpoQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406880, "uuid": "44d2369a-e018-4459-b286-732f960a7c63", "value": 802262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406880, "uuid": "1a4e5faa-f709-4a8d-a48d-1c50eff03ad1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406880, "uuid": "16078dc3-00ec-4adb-82cf-c74bbba907f7", "value": "pago_r_E1pido_re.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba8e6a5-c785-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679361136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361136, "uuid": "350b2cb2-58f9-4056-bf14-cbaa91c76f2f", "comment": "Malware payload", "value": "38473d0fe186fc49d1df559e84489f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361136, "uuid": "f19150a0-74eb-4a04-b6a6-db0433309f9a", "comment": "Malware payload", "value": "26f0db6dd951a6dcb089a8f8e181cc8409d8dcd074961685c43e80d22b486007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361136, "uuid": "d0a61854-b314-4463-bd3d-39ccabcb8562", "comment": "Malware payload", "value": "252a22393f92d44b066c19b94a1cde28a88295fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361136, "uuid": "0c89db60-0b38-4fd8-9109-7a9ddc3843b0", "comment": "Malware payload", "value": "127c4073637d3deadb119939edd3dce5e498bef8e21ddd60210db475bfc429390103b6b3d73ace7eb2a4de15115ff889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361136, "uuid": "9b6984f1-28c6-440d-bace-9265e57af094", "value": "T1E32633D28FFF75FBFADB0630A8413575BB636A29140986D0A5C65378803FF6453A2A34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361136, "uuid": "39d3bb13-c59e-4f6d-b044-c3c5e9fda822", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361136, "uuid": "9564df8a-8a47-4d92-bfa0-4562af2afe30", "value": "98304:GS/KS5IBUUMoaswJj+QQ9tgx3NYpszNnQnAaD39n6iRsED:GS/uTCcFNszNbaD39n6at", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679361136, "uuid": "fe4b22da-f709-4954-9800-633b03d20793", "value": 4508672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679361136, "uuid": "f29a2a5b-4fda-455f-9a3a-bb07e438e2bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361136, "uuid": "7134e4cf-3a1d-42fd-acd7-86e7f4cc5a82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831126dc-c7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679394247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394247, "uuid": "05980fe7-3733-47d9-b6ff-ca892dbf1d9c", "comment": "Malware payload (AgentTesla)", "value": "9ede72a2321887dce496aa05768e7916", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394247, "uuid": "ffda2cdd-c4bf-4787-ad9f-c061892d90ea", "comment": "Malware payload (AgentTesla)", "value": "2733d7ec062a393525d941d39bd64754019d64a8bdeecb483bf2f5e666a0b731", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394247, "uuid": "54addb1a-7e8c-4596-99f4-43b59d70b1af", "comment": "Malware payload (AgentTesla)", "value": "663a9d5f90a2c79051415b34f66cb5cf2cb8fd82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394247, "uuid": "2397bb80-cedc-4e6c-a20a-ed14792524eb", "comment": "Malware payload (AgentTesla)", "value": "30434f7e75197c3045a7aa13796bc0ca2041195609a3dba0f82b409af33dc529e28a6ae5f5a3238adc7096beefe1e7c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394247, "uuid": "bc75647d-7e9a-4f78-8d33-4bb128b34402", "value": "T18905230773864A53CB3E0FB04161A28513B5D7329A03E7EE3D6574AEA7D1B8267113BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394247, "uuid": "e33bb6b9-d17c-476a-8a22-2ef71fc1d3c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394247, "uuid": "ce943355-8d13-438a-9e7f-096ba30d1795", "value": "12288:vQcQqYoPnedLMki5+1yypMWxhBoZUAsUEU1UyjeM2RXn1AbLM4y1Pc:oePvjSMWxhKZLZd16M21n1AoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679394247, "uuid": "baa7de62-5fab-4386-ab6f-61bdc8f856aa", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679394247, "uuid": "41fa8cd8-3286-4751-a412-9a4719e8bbe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394247, "uuid": "762b0387-1c96-466f-a2f8-a8f1d965bf0f", "value": "NUEVA_SO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dbff1d-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392671, "uuid": "d88dd53b-67cb-4442-aeba-ffc012d95743", "comment": "Malware payload (SnakeKeylogger)", "value": "9b171fbb0c232e5454250646657b9a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392671, "uuid": "a99807b8-399b-4c59-a9f4-d0a50267e3c7", "comment": "Malware payload (SnakeKeylogger)", "value": "280c26c26ee8fa14fecd6c866c3f4daeedfd7a48ccc501c06eded8ff096b3769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392671, "uuid": "93caf77e-cff7-4a74-920f-d12584035428", "comment": "Malware payload (SnakeKeylogger)", "value": "9d0490c1ec042a71a83bd416191f63cff233ec4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392671, "uuid": "bba9ba99-584a-4290-b2ce-996b945f69a2", "comment": "Malware payload (SnakeKeylogger)", "value": "e27d67a300d5ab8e3767685b9865e502128558ea3baa9564054e49218b43ff28db5b934a1edbff7e0aa3d287ba0c4c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392671, "uuid": "f5970ad3-e68b-43a6-b171-3b0a558f3208", "value": "T19A1502302AEB972AF5765BBE81A03156577E73A37703D95D0CB520CA57A3B021BC063B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392671, "uuid": "4fdaf2e7-9811-4190-94e7-3e09eed6ed7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392671, "uuid": "c1f03aa3-567e-4521-b9ce-c37375842dcf", "value": "12288:OJ37zh1AKe+fpAW/LBLkD80+Jn6VAN27vt6WYOhSKaJpLEeWtiSa1mGVyDrinzbd:cRmSB68tR6VYotcMSKavW77D+nzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392671, "uuid": "abc08cab-ae2d-429b-95b6-913fe4da0f7a", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392671, "uuid": "5958041c-d2e7-4ce0-ab2a-c8bf6a4be518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392671, "uuid": "fe4cae69-c81a-482a-b6b8-f77e5afaec6b", "value": "9b171fbb0c232e5454250646657b9a64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d290fd34-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392662, "uuid": "e5506456-9ae2-44f2-9083-8a12ae2755aa", "comment": "Malware payload (SnakeKeylogger)", "value": "78b01183ac8ec9f09e1fb81a5a526e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392662, "uuid": "d3dab074-fcd5-47d8-a858-167420cb70da", "comment": "Malware payload (SnakeKeylogger)", "value": "28866c34bde5da1e8e85889e6419e29a6be895334406ef8914aac18259779cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392662, "uuid": "41b9eb88-d59a-490d-a7eb-0dfbc861d7ec", "comment": "Malware payload (SnakeKeylogger)", "value": "a041b7fe32bab7d1f011c5c0f85a88c8bb53b62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392662, "uuid": "f6152b1b-2a8e-4475-9e86-95a93afbe1f5", "comment": "Malware payload (SnakeKeylogger)", "value": "46af27ce52ab70a518f4a0db8e56769fd26a9448a5b4a40f62ed00d9855a2034965b4f0cdfcc10bc16453a689ee6a80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392662, "uuid": "522f2249-5699-4fc5-a751-2c1887b4e54c", "value": "T1EB357DD1B190CC9AE95B09F1ED2BA53015A3BE9D55A4C10C699E7B1636B3382309FF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392662, "uuid": "fade2898-81f8-473c-8042-140b9cdf6194", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392662, "uuid": "a675f8a1-7451-4039-8bc6-3e892fbbcd7b", "value": "12288:GY7wOnDW+rtCID8RlihNM2ZH6F09Br+aL8Bo42FY4QV2S2mE46yv+3:RXdDXM21Cor+aCoXYfdxE0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392662, "uuid": "80fb0f12-266e-49bf-8468-616808b7936e", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392662, "uuid": "40632b49-aaee-41e5-85ad-fe641deb13aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392662, "uuid": "b19ff179-2abc-459c-ba36-e6dd3c2f9f3e", "value": "hesap bildirimi..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b950158b-c81b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1679425691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425691, "uuid": "f700db77-ddb3-42db-9441-805159d78221", "comment": "Malware payload (Sodinokibi)", "value": "af94ccb62f97700115a219c4b7626d22", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425691, "uuid": "c9506346-c629-4647-935b-176457eee5d9", "comment": "Malware payload (Sodinokibi)", "value": "2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425691, "uuid": "097c9b39-1963-4b25-901d-344882a5aee5", "comment": "Malware payload (Sodinokibi)", "value": "bb67edcfe4e5b6fe09ee96e5b8ace7a4cfe39eb7", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425691, "uuid": "f5580c70-cd1b-45fd-b9fd-6df31d3f0684", "comment": "Malware payload (Sodinokibi)", "value": "970eb56d93782470de21d0e86287e245be16b5cf63b3e853adc898f3e4fc949c339541346aa894c0f6a3f2e4974203c1", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425691, "uuid": "7f4bb50e-06ad-4cf8-8511-28c1cc808491", "value": "T17EC3D023EDE142B6C98341F3432F3F27A5BEFE324A205476D36049459EA5181FE1B627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425691, "uuid": "0f9cd708-dcdf-4243-a1e4-b3f3c47530fd", "value": "031931d2f2d921a9d906454d42f21be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425691, "uuid": "1782008f-7c58-4c7d-a608-88135e012983", "value": "1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9DIPcG5zXbwMcClFyFfjRto2C:+/LPrlAZZE0cOzbwMflEBPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679425691, "uuid": "9440a707-5925-4bd8-81f4-57378e1a4fe2", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679425691, "uuid": "ca34fbf6-ca00-4a83-b4a8-fd855e5c36e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425691, "uuid": "66b003c3-26b1-41f0-b5ec-5c70c0c498f4", "value": "DomainName.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5b5630-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679405379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405379, "uuid": "331a56dc-5cf5-4646-9450-2bbf2093724e", "comment": "Malware payload (Stop)", "value": "6da97979e1f5d9ced73a357cb86117d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405379, "uuid": "5208f548-c154-4de9-9b04-63671a17fe9b", "comment": "Malware payload (Stop)", "value": "29072290a6f224e81b0dacc13c3c61e73f558cd735719619f387bc7f9d97bf2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405379, "uuid": "067882db-2714-476b-b7d6-955528743ec6", "comment": "Malware payload (Stop)", "value": "30674c67b68c27b8283e6225c963aa42f5defa31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405379, "uuid": "e8db23de-87b6-4285-8bff-e0da88b2a8fa", "comment": "Malware payload (Stop)", "value": "ebe659200627df73f4b195370e628a32a389708e104198312cddbda0693c8cdea77362b359d166f08635eea07b0c7dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405379, "uuid": "bc41e2e4-8763-4e86-8df6-8e4c6c60def1", "value": "T17F05AF1382A23D45EA158B73AF1F86F8B64DF7709E4A7B6932199E2F14B0273C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405379, "uuid": "1d5cfc34-fce5-496b-a8cd-2fc30afd6519", "value": "86f73ba4a5b0bd6d0633bc10b0ac18f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405379, "uuid": "baee819d-3c89-4054-9279-15f4465d4859", "value": "12288:eHH6yFxMSTu+pCTZgB+TQxwsUOMkUeGmwRA65Z0U7YEIpSlzhBQlg0tyr1EHW:mLFx7K+pLSQ+mSA44YlfQlQrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405379, "uuid": "4b7140e4-1a78-42a8-b494-14018003abf6", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405379, "uuid": "ba882fae-6dba-44e9-83b5-023f5ae9dcf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405379, "uuid": "5d0bd369-58da-4ea4-9a9d-d16da07938f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124f2079-c787-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679361846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361846, "uuid": "419d1c5d-566e-4755-a482-551688f852cf", "comment": "Malware payload (CoinMiner)", "value": "2e5bc1f6ab5cd7c84c6ea49877e67362", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361846, "uuid": "f9d9e731-5072-44d0-9806-982954061f19", "comment": "Malware payload (CoinMiner)", "value": "290da00ab96d4c88bfdbec551b224e3a3d3a9e40060eddce6cc8759189bc1ded", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361846, "uuid": "1beea570-776a-4bbc-bc5a-3aaa4b2cddbc", "comment": "Malware payload (CoinMiner)", "value": "89554667ece871f736364fbf99042f6e77a11582", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361846, "uuid": "a6bce752-ad22-4783-9334-fa46a6e0466e", "comment": "Malware payload (CoinMiner)", "value": "d854d2e6a3f594deabc5b9ec7a9cf709b1bd6931bef0691f7e6dc0ecaa45b38999c089a604230cdd8212e4262536fdff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361846, "uuid": "4e430a19-9c4c-4dc8-bb3f-d9c85f6062f5", "value": "T140653370EFA3BD48D3C1D23C9EC8EAE3B536A1D401D7A3D905B452BDC6C97A924281C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361846, "uuid": "2a4d3624-ffcf-4183-b6bf-4aa9cf186b5e", "value": "98183deaf6c8f22ff075814a6379c54a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361846, "uuid": "e861181f-5fcd-4d35-ac5d-d2311042d0af", "value": "24576:ShAmRh7we9mr06DvDRRSo62tHbt4yM0y6ocrgisd5jOOYKtWvnGGamdn:/m5QxGovtyvGo/iszORbGGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679361846, "uuid": "e70f5c1c-1255-41bc-97b2-4de8abc3b94a", "value": 1441848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679361846, "uuid": "2a3e54b1-1904-46d6-833f-163b6b889f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361846, "uuid": "0acceae4-41d6-4dde-a69b-da7d9949e4f0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef8b34b-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679393784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393784, "uuid": "1e86b801-1f17-4dad-a5b6-8adcf85871c8", "comment": "Malware payload (Gozi)", "value": "d23d0664cb9a54d8621e71d714f4ebb1", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393784, "uuid": "e7b8a28d-59a8-4295-9d64-39fc12825e79", "comment": "Malware payload (Gozi)", "value": "29508f90c8052b98950bab487985e48d7a83fa420f334732471b368008ae2d8a", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393784, "uuid": "9c05106f-863d-4e83-9128-3169915e74c1", "comment": "Malware payload (Gozi)", "value": "4eb81db1cc20ea5c4522a766005c1d275bcf8e86", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393784, "uuid": "7e586076-5cea-4333-b4d0-fa3b6704bee2", "comment": "Malware payload (Gozi)", "value": "2e57494d2b624c6b9757f78ebe79a197996fb1ac635b1537270cf4957fd511e2263b6b8dbb4752796fb6569ccbdbe936", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393784, "uuid": "2a80e2aa-74e3-4291-9798-6a6f8c14202a", "value": "T1E0415F940CB76645DF45C277C3C1156B2038B59B6642D5F4540D4CAD36987E7CD65434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393784, "uuid": "b7dc2484-9b7e-4bf8-a3b7-62d145fe35e8", "value": "48:9mUMb8uW8mgDqSGMQ7zc0OGqAHOWH4B1sxjM:/Mbo5gkY0PqAuWsKxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393784, "uuid": "4ff11d90-576c-4916-b6fb-5a61a2fa57ef", "value": 1944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393784, "uuid": "586feab5-aba5-446d-b963-a8cb80a0a3c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393784, "uuid": "b2dae863-1f2b-49fd-b408-a758f106a638", "value": "RIMESSA_CASSEGNI03212023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59066751-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362823, "uuid": "0598af1b-3d3f-452c-907c-3a2442aa6873", "comment": "Malware payload (Smoke Loader)", "value": "31ad1c82b58214477fe6062d1a11458a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362823, "uuid": "8d94e2fd-4701-4275-b846-ead1ca9af956", "comment": "Malware payload (Smoke Loader)", "value": "295c685eb194d36f20d551499c6afda32b32b6bc7a2404211082d4d68599b4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362823, "uuid": "dd8a039e-46fd-4fc4-aaa5-182dfc659051", "comment": "Malware payload (Smoke Loader)", "value": "320e9bb44e1943d4c6947d5014b3172fdebee127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362823, "uuid": "98902326-2a5e-4a4c-b5d0-57b4c058bc1e", "comment": "Malware payload (Smoke Loader)", "value": "03a0f3cba92481a4e40b42aba5f2aa66b15d382edefa0abee7b338d0b73f1844f99ff90eb6f116fe9e394652889a8181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362823, "uuid": "8909876f-1543-4488-9985-591843fdee5a", "value": "T109048E139A906851E413CBF29E2FC2B8B60EF9D1CE5D6B7E22046F2F0873161D56A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362823, "uuid": "61d26f4b-3957-485d-976a-6218a6eb18b2", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362823, "uuid": "667fddd1-6c54-4f05-87cd-0f3475b1d3e9", "value": "3072:6ZPic23zXyW0+DmKMJUjuil2/ww49VIa3L2sKYijQZ:7cEk+dMJOuil4wdLhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362823, "uuid": "e29ff2db-c44b-48f2-8c46-2e2bf01f14c0", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362823, "uuid": "41f67b7e-e122-44cd-bba6-d87f677ba775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362823, "uuid": "cd55f82f-4c09-41d0-b0c6-1bff5509a9ae", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3982e86-c787-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "a72fbb80-0265-4ba0-a13b-f3a08fcc331a", "comment": "Malware payload (Smoke Loader)", "value": "2894a3487ada14cc6395f03e99feac86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "fca2b698-7491-432c-b609-b9023ddf8c99", "comment": "Malware payload (Smoke Loader)", "value": "29b8656da62ec521d4d578284483ce143119520ec6b7fec40b5ca82d3eaa564e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "22d2317b-b3a8-4c40-b4e8-d43e678fadab", "comment": "Malware payload (Smoke Loader)", "value": "43254e9b5fcb930fbdcf324510de230b0e457e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "b4b77fb3-2963-4f85-86ba-10cc9c803cdc", "comment": "Malware payload (Smoke Loader)", "value": "a2f97a34082a7943ef81a6f1f92f363586d66df502819f5dd0c2efd2b0041d4885f7632537fea040c89e16c8a12447f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "1474130f-f56c-4096-a44d-b5780f812429", "value": "T1DD049E5396A07815E427CAF24E2EC2B4B71EF8D1CE5D576E23085E2F0873162C5AE7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "51ab02d8-e58e-4409-a951-eadc8c2eb361", "value": "c7e43254116cf1eb594def3fb89b8588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "f285c09e-8616-444c-92e9-58d5643e2b09", "value": "3072:gqi32G+I0cozc+pRSv1gnKpvJXjW3JMUIYaBlZZZ:a32hTxRzQSJTNGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362223, "uuid": "8bcacf97-5b79-47d3-92d4-29668746c72d", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362223, "uuid": "2e91b497-d7cf-4362-be95-226dedfc0fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "e8ebd177-46b4-43e2-8a44-d7d7ab71d1d5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572e8fb-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679393902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393902, "uuid": "d0aa0e12-04bc-4789-a997-8fbfe72c691c", "comment": "Malware payload (Gozi)", "value": "204d41750da91d9a9d5b7e07339d5624", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393902, "uuid": "3aafab01-b130-4e94-98ee-3828e5bd2382", "comment": "Malware payload (Gozi)", "value": "29c2f57b5678d7515d81e6895dce948bd5eb820c8f27d53fe526ac738eb2b4f5", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393902, "uuid": "930f0b3a-a29f-47a4-b127-ce1e21c77201", "comment": "Malware payload (Gozi)", "value": "295369294958cb66303e15d3fc1e300ddad5521b", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393902, "uuid": "ecf554bd-5974-4c21-98dc-ca63f6e6ccef", "comment": "Malware payload (Gozi)", "value": "468a65e6e4bcc02bd6ea7fe2bd7221e85672a410d1eababe078b69b9401e0ed74b963afdbfd4ec5ec3d62eae61523c5f", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393902, "uuid": "4649ac0d-6375-42c6-8376-4cc9ea0f630a", "value": "T1BEE29EEE1F6344F4E962AFD7E9691E9C2974DEEB382EB842904CF00758276336046874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393902, "uuid": "012346fd-ba6f-4bca-aa1d-b0206d058460", "value": "768:E8uINUNJl1We/iQiFsqsysYsksksksksC:E8Lk/iQiFsqsysYsksksksksC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393902, "uuid": "b68a128e-c392-4b96-b1ee-a3875f12e3a0", "value": 32631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393902, "uuid": "b3721bbc-fafa-4f4c-a3e0-d791b9fd4acd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393902, "uuid": "b82ae61f-c660-4586-8db6-ffff1983c3c7", "value": "documento", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ea6fda-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679393045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393045, "uuid": "ff09351b-94fa-4ab7-9496-1ddca24a65a1", "comment": "Malware payload (SnakeKeylogger)", "value": "3963fc63e7f60f12b70794ab87ce54cd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393045, "uuid": "3f820a5f-dd58-4bfb-9a84-8b91df67b7de", "comment": "Malware payload (SnakeKeylogger)", "value": "2a295d2593b44e3429bb9d86b61f28d36578c6840d19cd5641fbb59cfae66580", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393045, "uuid": "c9650507-37ab-4fcd-b5b3-5f6da13d40d1", "comment": "Malware payload (SnakeKeylogger)", "value": "299bc38a75e6051fc7bb7a6880b4cd1f17792a6d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393045, "uuid": "5c322a83-9599-4dbb-ab7e-fc093ea48805", "comment": "Malware payload (SnakeKeylogger)", "value": "5f206c068aba3638ccfbc50b702da67e0600ac4c100b11870fdb231c71c778eee71c7334bea395b978c7f67b8f301c63", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393045, "uuid": "1eaa9564-221c-47bc-9e0c-092205cbaffb", "value": "T1A4350213E9C48D46D4464BB96AE379C8131EBC227BD6A2C72748770F6FB86E44A0711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393045, "uuid": "f09a838c-7ba2-48e1-9174-540cd0cb6447", "value": "24576:SLKWWQmmav30xB+MXUu9/20+MXUu9L3bVn+MXUu903bVKrFWwyvtu01nwR:SLKLQmmQ30r+MXV9t+MXV9L3bVn+MXVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393045, "uuid": "c69cc9a9-3570-40c0-85a7-ab4fa3e286d4", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393045, "uuid": "5e080129-e617-42c2-9ace-1cebc0f612f3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393045, "uuid": "04a63b88-37d8-4326-98a4-eb152f7316c6", "value": "PO_Q0149-REV1-2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfc9a9d-c7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679408408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408408, "uuid": "7a00dd10-93dc-43f9-beb8-cd4781323fe1", "comment": "Malware payload (AgentTesla)", "value": "e227fc2363d4abeff44ea89af73c9abf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408408, "uuid": "53f63d0f-bbcb-4e20-9462-996f5aa33bea", "comment": "Malware payload (AgentTesla)", "value": "2ad2d62aa262b5f0f721d8084b6e7b4bab6edbeaa12e40102ec1e87cd6c6493c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408408, "uuid": "63fee514-18b3-4231-9bda-5da5b7abb717", "comment": "Malware payload (AgentTesla)", "value": "3db57c0ca5e8dc2467c1e3b663eaafe66a8c7ffd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408408, "uuid": "f1b9e0e8-497a-4bfe-8117-a510075efdd1", "comment": "Malware payload (AgentTesla)", "value": "7a04d97f9f3b5ef9b8270da157ce0a64a6c4fbf6424d72a996bf7f46a57387867c5648d0f5185542680efeb8a42d56ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408408, "uuid": "465eec3e-94ca-42ce-931c-ddcab936583a", "value": "T1F9441300BEF8D7A6E9930E715D7644136FF8B2220E681B6E53804E4AF53B353A64E335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408408, "uuid": "55e7f772-0d5e-49be-b07f-39575e90d731", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408408, "uuid": "35b5811b-15fb-427a-9c08-c898f140a8b2", "value": "6144:DYa623GE6AmfIulVwRA8azZr42uv7MgsT9tbNEcQGfka+7CN:DYgNmffdzf5B/bNEcNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679408408, "uuid": "07db629e-153d-4eff-8e5d-affc7cc845b8", "value": 273591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679408408, "uuid": "7f1cf36f-11b4-431f-8d9a-43e6de6c93c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408408, "uuid": "18dd08b7-29ea-45c5-a3a4-ff52440da685", "value": "IMP014 New Order PO-4147074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b17b42a-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679391630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391630, "uuid": "c58ac5a4-c411-4883-83bb-a45feb521ae1", "comment": "Malware payload (CryptBot)", "value": "7923c53381886a69939a56da10dcaa42", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391630, "uuid": "553bda16-0862-405b-b1bf-66c75c5bf31d", "comment": "Malware payload (CryptBot)", "value": "2b0487817f8cf2592db53cea34fa30f2db1a06d046759f23f3e72a0dc61034dd", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391630, "uuid": "5e2c0baa-124d-48b8-82f2-86327739280b", "comment": "Malware payload (CryptBot)", "value": "a9f1879a7784933381548e9b8cf10462c3910693", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391630, "uuid": "cececcfc-da00-44ab-af2c-05b0699d8d79", "comment": "Malware payload (CryptBot)", "value": "676c55a12e19e20c47cb225c2f13212c53310ce42500596705b50f35da63dbb9d05283a373ac8f2e905983086c1f3248", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391630, "uuid": "7344c060-3a58-4f7c-9d59-9707c3920f18", "value": "T14E66236225FC1154D8978879346F3EAC72FECD270545D8B46280BECE2932EB7970798B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391630, "uuid": "13045c7b-434f-42cf-a38b-307f52052072", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391630, "uuid": "516d7607-a00e-41e7-bb0b-8e12936406cf", "value": "98304:ftyBvUTI3/T/O5JtzAE0A050xf3yhDWbMsnJfdViU7DICtzkcPLC+5HTb/hIekb3:f8JRaXQ2xfaWYsJlVdDIaL9b5fzC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391630, "uuid": "45fdb3e6-49fb-4710-844e-b03285c10834", "value": 7095296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391630, "uuid": "c4f8a8eb-f57d-4b2a-90aa-b97c5843a4d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391630, "uuid": "d2b9be6e-3028-4d70-94b3-a1bdbc6f3d27", "value": "7923c53381886a69939a56da10dcaa42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d806055-c7aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679376924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376924, "uuid": "765cca3e-f417-4e82-bdd2-a058300c2fd8", "comment": "Malware payload (LaplasClipper)", "value": "f490810b6d7b30975948aaee3c48a169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376924, "uuid": "97213d27-a5bb-4f3a-92da-53a477f33aaf", "comment": "Malware payload (LaplasClipper)", "value": "2b462e8b883b905e1a03d4c621555e58e33fe8f0b6f483c12190b3cb80d52aa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376924, "uuid": "6af1b030-ea78-47d3-9863-b966d6ca0eaa", "comment": "Malware payload (LaplasClipper)", "value": "09ba01e92c8389ac34e8fab1216dca01e21364a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376924, "uuid": "fa314115-798d-4878-9007-7ca50edd591e", "comment": "Malware payload (LaplasClipper)", "value": "627942a09070f559f1fda699eea2bfbd40938decfe51d8ab63b070995e6ea64f658f6c9ecb8d39119d1e1b6081626e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376924, "uuid": "3c7897ea-cbcc-4b4d-8f75-73f9fd50e63e", "value": "T11B262321F23218B5FA1AC531F5A67C1835826E2E965C065F86C871C72BB63F3149FE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376924, "uuid": "5f0e924b-9a76-47fa-ba32-85e7b461453a", "value": "d60779e750e6d3d18d009b2a2eadaba4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376924, "uuid": "499acc69-6d40-4279-8815-6591356bc101", "value": "98304:ZkMe9NbfC0QFZpLFD/ImZI7NczOeNA2RH2K0+8+g4IY6:qMeTiDo7Nczb62RY5D4f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679376924, "uuid": "7ffd8b33-b301-4152-a819-8a3d5d64f56a", "value": 4688896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679376924, "uuid": "4941087b-9745-4406-b5e3-bfe0a23ad5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376924, "uuid": "8db965e6-bdeb-4288-ac86-a54e58fee9cf", "value": "2B462E8B883B905E1A03D4C621555E58E33FE8F0B6F48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c18130-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406682, "uuid": "a41c0b51-0a13-4ee5-a170-94e01e44e4c9", "comment": "Malware payload", "value": "2915ff4a85b6eb5a0f9a889933cd3f9e", "object_relation": "md5", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406682, "uuid": "6e191639-1204-4536-8a6c-51725a723df0", "comment": "Malware payload", "value": "2c642cfd02efb4d79c6dd137684c3f55f7a1a8046c7c4681061b2cb21ecf7bbd", "object_relation": "sha256", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406682, "uuid": "e5f1ce21-e009-4f79-a8ef-0e265ef1b65c", "comment": "Malware payload", "value": "f22eed1a2598a0e274d1033df6a73346c8a8863e", "object_relation": "sha1", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406682, "uuid": "8980ed86-6bf4-4102-9fdc-faf5ca5bfc02", "comment": "Malware payload", "value": "57d9dd52d0975c7d78b406cbb7b3eff4c2d167fc8a778b8649f4630165edb22a8ce0fae586cd2433afab6efae4ae6e7b", "object_relation": "sha3-384", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406682, "uuid": "faa6172e-bd9a-4bb9-829e-5e5f338c8679", "value": "T174D19A36825C1FBE283631AD0C1892B321B2957B7FBF1DE7B47104A9251CB1091B6EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406682, "uuid": "b0097c33-2d27-4f47-bdbd-7b61d6f0cb5a", "value": "192:M/fnUwLR8EzDM9a9gJ3txMzXQD3NfMd9MNfPLrFaLc:dY4WADBqsn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406682, "uuid": "4243319a-cd06-441f-98d8-f44957990cbe", "value": 6699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406682, "uuid": "5bb4ce30-347c-4bf2-8043-a10822e15f28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406682, "uuid": "c4aa9126-fda8-4dc1-8756-ffb87803a14a", "value": "RIMESSA_CASSEGNI0321023_7619.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be455b6-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679397698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397698, "uuid": "0e8b7862-bb40-4d51-946a-99101ce9637e", "comment": "Malware payload (Formbook)", "value": "6561c71692329e5c4b10948e273ac496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397698, "uuid": "3ecd5187-22d1-4ded-abbf-8a5959b2ee54", "comment": "Malware payload (Formbook)", "value": "2ee6aac96667a49df963edc8384038b0859d689ab4377e74ac7f45086010c732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397698, "uuid": "cfbd7efd-db40-4bf5-a2ce-208a514fa017", "comment": "Malware payload (Formbook)", "value": "f01d729fbd8934730fd7531fa00649089e531616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397698, "uuid": "40943ae9-df8b-4dd9-9542-5ced56233ed4", "comment": "Malware payload (Formbook)", "value": "0425a0e895ab282b40a9b348d6da95a4a902fd5a7ff5700d43e8fd69c19f332a1aa880bc52ccca6b76ba4e2000add620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397698, "uuid": "3387393d-1d3c-4376-a842-9a0e8f15092f", "value": "T184F412342BAE9639F53657BDC4D42696573EA3B31B17C84D18F212CE07A37429AC062B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397698, "uuid": "fa072847-070a-4b9e-9377-90a1a4563f4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397698, "uuid": "41e77c06-4d19-4144-ab3a-9682a59e3a90", "value": "12288:i97mYMUnFW/N5b9hsF+U5u0RX4up4Aev8lZLse1bdHnL+2CzomKsciaicxJnj:i97UrIF+UloE4AevUZhniZzL2iKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397698, "uuid": "7dd2e403-ec4f-4a89-acab-41da9e71f596", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397698, "uuid": "3649659e-634d-4d6a-b85a-58ca89daca6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397698, "uuid": "623f7494-ba78-4d93-8784-0f11ac715ff5", "value": "Wilpack Food Services Baby Octopus and Squid Tube Supply Order SC-2370200323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a62081-c7ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679406034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406034, "uuid": "eb3698d2-d498-4fb2-a99c-759dee895e9c", "comment": "Malware payload (njrat)", "value": "41c865e142f26e975a3ab16f70eff9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406034, "uuid": "8b987474-3d69-4df2-bc4c-66156f1a238c", "comment": "Malware payload (njrat)", "value": "2fe4bff11a2945f868877630b07625d5867d2d332a2af2445597baa9f3d1e33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406034, "uuid": "250bbd30-6821-4c8b-81f3-2b10a422e02f", "comment": "Malware payload (njrat)", "value": "cdaa6925032e90b84f40b60dc7828f8096ada55e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406034, "uuid": "2846b3bd-4021-405f-8342-2a3d83acaac4", "comment": "Malware payload (njrat)", "value": "2dee32b616c625c27cdb568a56621d1b9831e7929d29472f9b21ef866a04861afcb4d2b34438c284dd13a1a659fee9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406034, "uuid": "c15c0931-ab78-4eeb-9083-f8ebcd84e094", "value": "T1F013D84CB694E174D5FF8BF1A4A2B2990B71A01BA802D30F99F154D94F73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406034, "uuid": "d3f1e377-53bb-4d75-b577-436ebeaecb20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406034, "uuid": "a3b7cd74-451d-431b-9730-b1b11aabf04e", "value": "384:JZyX4D4olYxOoyi0mJqg6QER8cFQPzgIij+ZsNO3PlpJKkkjh/TzF7pWnQrgreTn:L6ouIli00qTR86wuXQ/oFT+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406034, "uuid": "fbd4eef2-35ee-4c5f-90a5-f38d0e388023", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406034, "uuid": "f650f845-8e4a-48bd-a524-6a5256d08c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406034, "uuid": "2a4c058d-1225-462c-8d80-8496741734b1", "value": "41c865e142f26e975a3ab16f70eff9c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4f1eab-c81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679425237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425237, "uuid": "2f78ca2a-1acb-45d6-9861-623ae8afada6", "comment": "Malware payload (DCRat)", "value": "0e444044fdfea512ca18fc3396abb65b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425237, "uuid": "2c4db105-81dd-4f52-bc9f-784a0164352e", "comment": "Malware payload (DCRat)", "value": "3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425237, "uuid": "fb8515bb-3019-4ce6-8279-3d58b4ee5e00", "comment": "Malware payload (DCRat)", "value": "8b601ccad5b2a76967c0ca7579dc13d092307f34", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425237, "uuid": "df8d554e-bf5e-4ae3-acef-fb58e31d0596", "comment": "Malware payload (DCRat)", "value": "40207174c0d20465537ea3928046a93fcd5214ad07d71a4e54225d5d7bbc290b88ccf4cb0747612ba99948d42eece76a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425237, "uuid": "49a66298-3d93-48dc-bfeb-1841f439e09a", "value": "T1DDC5CF027E44CA01F01D1637C2EF451847B4A9526AE6E36B7DBA336E19123A33E1D9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425237, "uuid": "31974c28-5d24-45ee-8d72-5074e02e97d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425237, "uuid": "f08c37cb-85ab-4c8f-8a53-646f6eec880a", "value": "49152:bkcwlRFUh2b69Cs9MR3uh+tytRY1aLXYqIiiJd2EHt:bkdlRI3ceI1azYqWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679425237, "uuid": "11848582-e8f7-4635-a80b-11cda48e29bc", "value": 2562560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679425237, "uuid": "35417570-abfc-4dca-9416-2a63e7088f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425237, "uuid": "6ab45d5b-d04c-4a38-ace4-badbd1075aec", "value": "0e444044fdfea512ca18fc3396abb65b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998c64a0-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384836, "uuid": "80c0546d-cb76-4611-840f-0ec598a178d0", "comment": "Malware payload", "value": "20b9a8b8e4ab142de2b5e41b7cb48196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384836, "uuid": "16a467a9-f355-4a97-869b-783c6ee68324", "comment": "Malware payload", "value": "33f826f821cbc53781bd39cc1d962f268f3e0bc0d458a41b63268893f477145a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384836, "uuid": "552fb2d2-fcf3-43b6-b72b-1b5935a160a5", "comment": "Malware payload", "value": "180fa12b33e0d84ece70904ccde93b15bad7b617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384836, "uuid": "f8503f3d-6662-4390-a8eb-17770f868a30", "comment": "Malware payload", "value": "5220d99918025a369d22107ad3c7d3b13d653babf3734c1337aaa27c0611f1865caad20a6a96e6d5c5694cc8364b72af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384836, "uuid": "723ecf76-26aa-46d0-a1cf-00795d6cd888", "value": "T1C2649D127BB9C076C6A301314FD35B7AE3FDEA900E324A8373D55B1D9D358429A3A729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384836, "uuid": "f0632ba3-071c-415b-83c5-64d3ee34a987", "value": "6d71b521e12fe2879f86f585e6a44f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384836, "uuid": "d9fb2733-6ca2-413a-9f24-79eb36014f98", "value": "6144:vxtHrppmS28rT/syJnq859w36aX8wCZBbZeCkb7aQi:vzrprvsyRd59QlX4ZBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384836, "uuid": "cb38875d-69a4-4bac-9dd0-7e2171385933", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384836, "uuid": "3465473a-9c2b-4459-9516-7e907bbc76f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384836, "uuid": "581d1f35-0e6d-40e9-95a2-3bab7c01fbac", "value": "20B9A8B8E4AB142DE2B5E41B7CB48196.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421fe7b5-c7bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Panchan)", "timestamp": 1679385978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385978, "uuid": "cef1d2f6-b3ce-4e21-8152-3eddea05d964", "comment": "Malware payload (Panchan)", "value": "36606fe25eb50b340348208c5e97b106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385978, "uuid": "a0b34fd6-5d09-41cc-9800-d586a4d8f90c", "comment": "Malware payload (Panchan)", "value": "34c7f1ea85edb23700234d5cd1de1c0aa744b076cdf33194dcdd716874f49e55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385978, "uuid": "75da498d-8aa2-4c0b-b5d8-02cb570a2b52", "comment": "Malware payload (Panchan)", "value": "486d7d02bb9c93a9737f89243983f5dabc55adbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385978, "uuid": "21778a25-17b3-4dc9-84c7-f6e367e8b280", "comment": "Malware payload (Panchan)", "value": "7a691551d797ffa48f1762e0b5c9ee09e09c83a7ffd0e4bb9357a1d8a6608f3743f52aaa11557313afd80c50c9ae1ca2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385978, "uuid": "236cda63-0fc6-4f6e-970d-e6c7c36bd7b1", "value": "T184B68C73905334D9E5A88DB4D11416426DBC388B5738A3CBBAC471F667BABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385978, "uuid": "a2d4ab4f-f05d-4ee0-bf90-9678e23397fd", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnau:sXyWSpV+Wu7rI3JE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679385978, "uuid": "edb3e1a8-45e0-46e5-b5fd-f6f5e8c615b4", "value": 11206656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679385978, "uuid": "dcff1929-8af3-4e39-9830-5797fd12781d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385978, "uuid": "58261fea-943b-44f5-b43e-42b12d3209f9", "value": "34c7f1ea85edb23700234d5cd1de1c0aa744b076cdf33194dcdd716874f49e55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c44daf3-c7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679401993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401993, "uuid": "070e7f3d-bb6c-4d6d-bf38-3324edfcba69", "comment": "Malware payload (Formbook)", "value": "cb6e96983f423fde2ab5423d09b972ca", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401993, "uuid": "27e9391d-e27f-4e76-82c3-c16ee6d49372", "comment": "Malware payload (Formbook)", "value": "35dc865c22873093d1417a28a5782b40e96ac3a890b51cb57dd89bedb23f1bfb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401993, "uuid": "3a21e3dc-199b-4043-a8c0-997abb224b72", "comment": "Malware payload (Formbook)", "value": "6e9e2e979fd171f79e9fe0609d125dc859ba53c4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401993, "uuid": "3e9f8670-aea9-4e84-9726-4f7e80e01448", "comment": "Malware payload (Formbook)", "value": "cb939d9335d77c5eabb8a9519da0b45970bdc49c00b98594b5de9e3d5ae189b2a7e2fc2cc752b1ab26ff8f4599d3f7f0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401993, "uuid": "826b3b10-cc8e-461b-953a-1bf134f9dad9", "value": "T1BF356C424DBB51C6E8B70F58647B76980B38E966FDC8503B3CC8B65A8FFA64360463D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401993, "uuid": "38114626-8e49-4920-9ac7-f5acbf3fe9f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401993, "uuid": "bec2677e-568f-4214-b0a6-d34b685dba4d", "value": "24576:idz3MxbMR18gNkhuLBuwegJ3Z1UhlFe+uZfSpe9:m8A1rkhuNr93MnF8Zfce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679401993, "uuid": "a93f0bd7-97a6-4390-8eb3-7e2321cb3af7", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679401993, "uuid": "924db381-3c14-4e3c-8ad5-ecb4e38595fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401993, "uuid": "fe8612fe-ccc5-42f2-84e3-8fd80d9075c0", "value": "Shipment_notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c45d637-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1679405402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405402, "uuid": "416b4f7a-db21-4b0e-a567-bcd006d560f5", "comment": "Malware payload (XWorm)", "value": "6f3eadb0df1b0ca3e74916abfbfc37f5", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405402, "uuid": "3b014996-f0fb-470b-9029-572743ac8385", "comment": "Malware payload (XWorm)", "value": "35dcbe95b9ca79381e4d0a11561194439d554ed6e245b2e73700ece1f60fe884", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405402, "uuid": "b3dc5819-c402-4cb6-9476-b10e785f54f6", "comment": "Malware payload (XWorm)", "value": "7ddde7697b4aa24b57eda23a7741b70a7e21b522", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405402, "uuid": "894e8b17-f475-4844-a1db-7fc30a4b93f8", "comment": "Malware payload (XWorm)", "value": "948bd1d4a0b7aeedc99cd1a20de00fabec7f52151b240428c0036d7138af2a483517cbf3ae6f29d15cc95936597fb4e8", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405402, "uuid": "5a28efbf-1772-405d-b05f-622348d78462", "value": "T1115438123640DA1AC43C923C6FE1CF896631CAE46DA30797BAB25B15D9B6FEB3D05304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405402, "uuid": "6ab463be-abc1-461e-bd21-6c92be7d63c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405402, "uuid": "ee91c56d-b35a-4648-a37c-730f66486f85", "value": "3072:GBgHR3DD/SjJartwvmzzEQQ2PIbBtelpGp6ClHtVWp4+f8MMMMMMMMMMQMMTMMMJ:H3/0MrvzoQQ2emI6ClHtVWpaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405402, "uuid": "933099f1-4fa8-46f3-a8df-84d6ed75de61", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405402, "uuid": "ed6dee53-61be-480e-8557-023ca12794a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405402, "uuid": "75d6fbd8-7bae-4e02-a5ef-f249bcd91ce4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6475da98-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679398920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398920, "uuid": "dd2f87e4-b5fc-4bab-b16c-1cb2e402c7ee", "comment": "Malware payload (RedLineStealer)", "value": "4874ecb26f0d5f9d1adaeedb174e8286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398920, "uuid": "2206065a-e0ac-421c-9093-2185ab709b73", "comment": "Malware payload (RedLineStealer)", "value": "36fce48b2b1ffc052af28920e051eb56bf42a9265a60058d681dca08c2cbda76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398920, "uuid": "f6874971-34aa-4ff2-a5da-94d2b61bcc8a", "comment": "Malware payload (RedLineStealer)", "value": "b4eba97822e5afc6741d3c279e34d2f49fd44562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398920, "uuid": "ef1356bc-22a7-43bc-915e-ee3782693e44", "comment": "Malware payload (RedLineStealer)", "value": "8cf7e073b59728063c499cd92289f10543837caa07eaaa5d1b8e3ec48e474b78462a4c9d8496df998c6b202fcca38f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398920, "uuid": "2c9fba66-35b9-45e7-9b35-5eb00c1ad1b0", "value": "T11F3522C783953C56F416063A6E2BC6B4560EFC81CE48AB6BE3086BBF0C7C161D1A7B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398920, "uuid": "9f929a14-55e1-4449-964e-b3295b20c341", "value": "b6299cf22bb1b2b906c76a98a991dd84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398920, "uuid": "3bec3d82-a8e3-458c-bbee-12eb5ffbec6f", "value": "24576:iDDZTSZMPhJcfSjvS4UjFVjVDbUN4Dzm/:AZTSohufSTS4Uj/jg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398920, "uuid": "a7110865-1954-48ab-af2a-fb4ebe0268b1", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398920, "uuid": "bc6f4aa2-94c3-4510-b14c-204bfba427e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398920, "uuid": "954a49db-5c67-487e-b075-6b2cec1f60ce", "value": "4874ecb26f0d5f9d1adaeedb174e8286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d09277-c807-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sova)", "timestamp": 1679417020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417020, "uuid": "ca89acf9-7f7a-4a08-ba92-a72497c94afb", "comment": "Malware payload (Sova)", "value": "d4c6871dbd078685cb138a499113d280", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417020, "uuid": "2946af65-68ef-4415-8ecc-487071aa3bc4", "comment": "Malware payload (Sova)", "value": "376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417020, "uuid": "e4c48c07-39bd-4dbb-839a-a96bfefac313", "comment": "Malware payload (Sova)", "value": "60b64c8481f9de5b92634efc70a9ff42f451c78f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417020, "uuid": "64fff235-c833-4a38-b50e-5e59e5ae042e", "comment": "Malware payload (Sova)", "value": "be0771ce6340c935cf89b9cc74981f85b1ebd0b7c17cc5388932778414174f3188dc180d816ce16ca443a45dbee038c0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417020, "uuid": "f5215fa2-8604-4459-a572-1c11958af8d4", "value": "T192261242FBD9A96FECF3C3365736062A91068C59CB43D6975914337C18FBAC04E86AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417020, "uuid": "453b0e6c-0323-4f72-affe-40135137afe9", "value": "98304:M0C+HR25SOeU0lhoBenZFOw2QxW74PNTcG/bZ7vf0sc:jCmtO/07oEOw2QU74PNT9/t7nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679417020, "uuid": "c298b3aa-e78f-452f-bc11-07a65f58f40e", "value": 4792032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679417020, "uuid": "11df9446-57d3-4a99-8920-dbafd68c27d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417020, "uuid": "38d116d9-f58c-4776-8133-c0da3f1b44c6", "value": "376D13AFFCBFC5D5358D39ABA16B814F711F2E81632059A4BCE5AF060E038EA4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b262186d-c7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1679394326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394326, "uuid": "26382f67-66d9-4902-8e04-12636a6c3948", "comment": "Malware payload (Tofsee)", "value": "40f3453d2187ac3df970dc836377722d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394326, "uuid": "ec424d48-2263-4588-b8a8-2e3e1a424359", "comment": "Malware payload (Tofsee)", "value": "37fd2a4b5eb68d9ba61156d6bf8339d38e88119a87bdeb5c40f5913d7caebdea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394326, "uuid": "0e6e4bca-535a-4f20-8875-23af5c02b03b", "comment": "Malware payload (Tofsee)", "value": "2e9ecce17796c488663c918c6fdb4344766a2e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394326, "uuid": "0dc882c3-48ae-4a36-9d92-7140717ddd77", "comment": "Malware payload (Tofsee)", "value": "42dc4b4cf6d49c3cd37ee18829c19d7673181865a023bddfcb7f59da1f05f15af5def29553b94203455b77f44c44c801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394326, "uuid": "25b1768a-b55a-4e44-ada1-691a3c966eff", "value": "T161049E4393E07C65F4568B729E2EF5F4761FF4508E5AEBDA23486B2F08711A2C6623D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394326, "uuid": "ab5aea97-b414-4714-8885-410494303055", "value": "6149c9f35229403fdda7d9d88d405383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394326, "uuid": "cd8364d6-395a-430d-bbc6-2c594a3e7898", "value": "3072:DFyFCV5CswXoqBrQI7Kwa2SNxaX7q/KMGlOuXJa:DYCVAnofI7Kn2S/q2/5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679394326, "uuid": "84cba6f1-3f59-411c-b777-bbaba8ff6b08", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679394326, "uuid": "6d6fa5d7-1351-4374-9102-7dbe0e357ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394326, "uuid": "188a6fff-8db5-4ec9-949e-c4234cb884c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b77f6b-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679405386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "1f424282-cf2d-46ba-a80b-2ed6d6664edc", "comment": "Malware payload", "value": "fd46b618b6eea54bd5a8e119803f9000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "777d981e-3c66-48a9-b354-0b530cb9e18b", "comment": "Malware payload", "value": "383b0abb5274e9c87f8d42b0dfca92d82ea28ac940d55d25787a0c3394df6a93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "5680d212-c1a1-4a05-8e42-931fc64b42d7", "comment": "Malware payload", "value": "b634668746c78db6b935c531d666729d8864a6aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405386, "uuid": "971dc374-0880-4206-950e-7291ea16e140", "comment": "Malware payload", "value": "cc8725e07b919b171e4fa4560706d9909884bf3c8785ee7f76c55ae31f61287ef84df56e3f4023fa90828fc05e58e315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "f846d123-1561-4011-8ad3-00784539676d", "value": "T11D748D10BA86D032D97211314E78EBB6456DB9351F6149EBB3D40A7E9E302E27A31F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "1d0375ff-6a4f-489d-9db9-7cd09d74fdfc", "value": "ca661b9db96e4fe34d1ba40ea18ec8f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "02185db6-52c3-48c7-a09c-6f857ea80725", "value": "6144:m534gIeAfQ8p/hPvt1K6V1yfobdelLnoM/qq7ux+K8ONJ0JfNCHT4AONawCZu8VQ:mRceAbtPVMfobdetoM/qqaXN6JfNw4LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405386, "uuid": "a4034835-b498-429a-98c3-a4d96f983880", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405386, "uuid": "a591cb50-b643-48ed-aad4-01869efe193e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405386, "uuid": "08919eb3-106e-4626-b8aa-76dc09342a5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95995793-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679392990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392990, "uuid": "64be4235-95df-4618-a876-207b35c319ff", "comment": "Malware payload (Loki)", "value": "e93853da68637c81dac2bdbb25878396", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392990, "uuid": "5c1e68ba-deb6-433a-aca1-09f3a17df717", "comment": "Malware payload (Loki)", "value": "38bef92d00d1b2a615bf37e89783038e7bbcd56093a7e84d865784cdf123b83e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392990, "uuid": "380f5e9e-5828-4971-9335-4e3146550215", "comment": "Malware payload (Loki)", "value": "bb5438193524a2c7cee479378945487d4824eb45", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392990, "uuid": "565998d4-afe4-4b0d-943c-ab5e9c4429ba", "comment": "Malware payload (Loki)", "value": "39402a9eb60c70506b1876704d06d4b80443df3083742e026cb02234d8c2ea084c95e8aa3355e5369b9f32088ba06dda", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392990, "uuid": "42d23856-e2cb-41d9-b186-1e495c6240ae", "value": "T116350213F9C49D46D44247B96AE3B998531EBC223BD6A2CB2344B70F6F786F05A4311E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392990, "uuid": "869e137e-ffb0-43af-a7c0-f43deb4d3893", "value": "24576:tLKi4WQmmav30x1+MXUu9i+MXUu9f3bVC+MXUu9w3bVS6rhhgU4Wz+rV:tLKiNQmmQ30j+MXV9i+MXV9f3bVC+MXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392990, "uuid": "a6796a1f-3f43-4a44-a68a-4855afb16d0f", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392990, "uuid": "040e4887-acce-4b17-9dcc-05e2c2aeab3b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392990, "uuid": "94422853-ee3d-496d-ac56-16574b24ccdc", "value": "Document HAWB R129724.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e22f59a-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679398963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398963, "uuid": "038f1005-1128-4c90-a223-4d8871640454", "comment": "Malware payload", "value": "f3069168fd610a0e7ebcff766ff1227b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398963, "uuid": "66ae2ab1-2bfd-4383-abdd-bdc4f860c2f5", "comment": "Malware payload", "value": "38e4477130b076b0c023aa84fb90594244b008d8a33b5d5f5d79ca60fda8a7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398963, "uuid": "d34adfa0-a24b-4a4e-8ff4-00cb4b53c7b4", "comment": "Malware payload", "value": "d38bffc453ad83f03c2c4cb1e493d3e0f15fc7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398963, "uuid": "cb203636-7946-4b61-894a-b6b64fd7b748", "comment": "Malware payload", "value": "82386bf8669cc192074271d1a1abddfdfb37e3dad925c52f945c2c16346317a54e2d221989fe54b5ce4d8280ef8f6e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398963, "uuid": "2f2a5c63-b605-409a-a836-0daca5b7edad", "value": "T1DC1502383A7E6437F63A46BD42A43256677D57F23307DACA4CB151DD0BA7B424AC042B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398963, "uuid": "db21df46-73ab-4231-b3ee-0457747bd300", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398963, "uuid": "570dfdb3-8ac8-4d6e-bb51-880af7d3f8cd", "value": "12288:hjZ5ZbxqAG5hlaIQJsqkryHytXkYc4bKwE4WMANT/N0FbHDwHEpjRFyRIx7Y/t3Z:BXZ9kVsbNHK0sc+ANDNOr7RFw9p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398963, "uuid": "6ef4f917-067a-491c-8bac-3c49fb104771", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398963, "uuid": "bc3b5333-298b-4ff0-8563-d29ac588acfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398963, "uuid": "4482c7ad-46bd-46a1-b5e0-7e35d78b26f2", "value": "f3069168fd610a0e7ebcff766ff1227b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eae2f52-c81c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679425861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425861, "uuid": "9f8ad3d4-2df6-4cac-857f-6f49f2367998", "comment": "Malware payload", "value": "16c8b6ced2e5a69f50ed0cedd893d197", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425861, "uuid": "8bf8f1f2-a149-4489-b522-50812cf7cfe9", "comment": "Malware payload", "value": "39d4ef8a68d2427d6eb1d26574f0a0927c846047095225f993c3a13a292cd3d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425861, "uuid": "c7ab489f-1989-4be5-b715-d8e17676805b", "comment": "Malware payload", "value": "e38f9ff318081f1b31bf3197319f96b8278755cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679425861, "uuid": "ebbf583c-9a3b-4c89-b172-1f296f517554", "comment": "Malware payload", "value": "717a8649bb26403907a4f5df53e0dfe17812901de5baa5549e5e89719b3c04578a0cd92e5f041b39b206550562dd0387", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425861, "uuid": "180a59b0-bd87-4b5b-af05-de194f69b22c", "value": "T1AC8549549988D4D0B8C7AF0EF33DEB76DA363E73CFAAEA42199B50D70A77102251C491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425861, "uuid": "abade333-bbd5-49f1-9f84-4fbcfbda4985", "value": "24576:x0Ew/XgLpnH7hIYEoluDWV/m2ja6R/WrPUyaytRMInw76ARzO89EePW5Qp40PgaI:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679425861, "uuid": "6c664933-639a-4bac-abf5-d15dbce2b761", "value": 1856131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679425861, "uuid": "b7b1344a-7ede-443b-9ce6-750c38fcbaea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679425861, "uuid": "1a6d46f4-0620-4fd8-960b-87d90a3bd553", "value": "_______woff.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ead53d9-c7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679388280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388280, "uuid": "94a1522d-b4e7-4594-b56a-9c99ba534158", "comment": "Malware payload", "value": "c035bc2f0a40b574e3da53a675bd6ffe", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388280, "uuid": "2ff2b6db-7fc8-4845-a81d-9635ae576aec", "comment": "Malware payload", "value": "3ab205427a802bbe0759e6af92696e88d453910480fd0e85d89431d2cefe30fa", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388280, "uuid": "4d7403a8-1578-402f-a656-3fc9b3dda28b", "comment": "Malware payload", "value": "94e491e9763dd2726dc83e063286361396803a7e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679388280, "uuid": "fa463c4d-3983-4589-ad2e-a782e34839c4", "comment": "Malware payload", "value": "8f50f987d082a4ad4c32eb69eacd8742d9041d6c1d902f49b74297bc10902a69b841d7eacd978ccd4cae421b2231845d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679388280, "uuid": "051a9709-7d7c-4590-9d8b-ff5f58f2cd56", "value": "T1D64633369E32ED2AC664523C747F0E8C2F700E8BC058D6E6B655A8D257857B0886F5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679388280, "uuid": "16b3748d-a678-4de3-990a-a06a61833583", "value": "49152:zHSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGW:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679388280, "uuid": "e6e955f6-ec6c-424f-8329-4aef82aab145", "value": 5570560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679388280, "uuid": "694fdad0-1a85-4e30-b82e-0eebabfccc59", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679388280, "uuid": "12041e58-ed26-401d-8b39-c142542448b1", "value": "Reserva_old.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1488101d-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679415966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415966, "uuid": "89f16232-49df-448f-aac7-e84189901fbd", "comment": "Malware payload (Formbook)", "value": "023f1cc9eb6338b0c79d1eae623072f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415966, "uuid": "b636eef3-18a0-404d-8205-9cec0397a7e0", "comment": "Malware payload (Formbook)", "value": "3d48d5c44842b95d51ba49e07eafc3fd80acf57a118168dc5ea6182cdfc3602b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415966, "uuid": "e9daad46-8ce1-4c99-a39b-384d5ef79a1a", "comment": "Malware payload (Formbook)", "value": "4b5dadcca73b1c1825cac03283becafd6a56dbd5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415966, "uuid": "f4516ab9-5c4a-4faa-a14f-9ac7ce2c4172", "comment": "Malware payload (Formbook)", "value": "fad85eb494de08f020d5d929cf2ee393fffccaab653ffd6894ad678883e4f6a7ab3f089a78d5c8abfbc030eda4a810e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415966, "uuid": "3e829ee9-816d-4402-ada6-af692bda8ed6", "value": "T19974232F2B0C14F69493F566215A80A21B1BF8EC6A585C01FBC731F49DE2F697C8DD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415966, "uuid": "a4cb33f5-8c47-4b1f-97e1-cf954af3918a", "value": "6144:ENGLxmo5MIzCh60WiBP4p4OF5QkedWensASCf2HosWgZS6BilrfntLMGgNm:EMmo/zCqWsF5DoZsDdiKBSrFLUNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679415966, "uuid": "18c3c13b-cc8c-4cd5-a587-9cf32939f21a", "value": 345808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679415966, "uuid": "6fae3e18-3687-42b2-9349-1fb2434f1c34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415966, "uuid": "63100d73-78cb-461b-aa97-3d0b690cd2b5", "value": "Swift, unicredit bank_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957dad42-c77e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679358200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358200, "uuid": "0e5c5521-a0c5-4625-bc9b-348dbc11acdb", "comment": "Malware payload (RedLineStealer)", "value": "9706e56301e0fdd3c254062c66e85401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358200, "uuid": "a5a1b278-0902-4976-9fa1-9bb6c7d0a660", "comment": "Malware payload (RedLineStealer)", "value": "3d6bf7cc5812e6e98b09036586026dd9471cf3a9aa09306bd8b66a99991b3841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358200, "uuid": "c23df055-42f9-4bec-88be-2bdeba0619c9", "comment": "Malware payload (RedLineStealer)", "value": "2eb62406c7c1f07581ce5d18d4b95dd239f5e770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358200, "uuid": "a2833348-1223-4a5e-9088-63dcfacabb3a", "comment": "Malware payload (RedLineStealer)", "value": "aa57840ae1576c521dbb5635da1f66cc0ed0f73af354d6e8669141dd3acf55ccbe1bef1f2f0f0b595a797c413d11ae5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358200, "uuid": "3ea44681-99f6-46bc-be37-e5cacffe1e72", "value": "T14054C0035AE17C21F126CAF14E2E86B5AB0EF9C2CD2D279D72146E2F09B3161C5797D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358200, "uuid": "2b5b9811-d873-4562-83a4-1431dc753b0a", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358200, "uuid": "b3deaab4-61f9-433a-a7bc-16baab4d9780", "value": "6144:vYvshdhGhlsMatwPN+lY0FYCnOBEYxInLyD:gvsThA2zYWnd3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679358200, "uuid": "ac6c51b0-8561-42aa-9aa3-66ec6270100d", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679358200, "uuid": "016c3d3b-ab3d-4c09-b1f2-16e9e5cce232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358200, "uuid": "1ffc85f8-00a2-4ca7-a563-8ee9f8d0c6e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59627acc-c7be-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679385587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385587, "uuid": "2a032192-a85f-4986-9df2-eb050612bcb4", "comment": "Malware payload (AgentTesla)", "value": "00fc05e427d25c4bc6e3ab4160644c55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385587, "uuid": "624be835-8e89-4db3-ba16-e7e9dac78241", "comment": "Malware payload (AgentTesla)", "value": "3dc6f11f42af56fb2ee55b91bb0cee231365cd9bdac9ab2b5e32476118b34403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385587, "uuid": "f6ee03f3-5b88-4ef7-8c60-fe8d89a0be71", "comment": "Malware payload (AgentTesla)", "value": "b87b7e89ee2319ff7df6250f7a9b7b87c9183147", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385587, "uuid": "cb5340b8-0b4f-41a8-a900-edf4ef6e7ade", "comment": "Malware payload (AgentTesla)", "value": "db2588179c707d549b214e606b1dea7a5def4a0da7c2103a7469e29f3957df85695ae457aa83a5f9d91f79f1adfd14a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385587, "uuid": "2fb2f1b1-6161-4e88-8460-c0baa6122872", "value": "T1D8157C197CA899D3C350E677DBE2D325B3B75F9E3722C96935C213160E0E38668CA11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385587, "uuid": "bd931d40-42a6-4cbd-bc73-24128986efb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385587, "uuid": "7d2f057f-da27-4af5-b395-0cc2f9eb6f57", "value": "12288:JtCD6O9rHtPkqNSUHkLWke7ijsuZpE9S0yYRxR7GrRybpLGZP:W5Bk6EaJAs8pEB9D7GrRy8ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679385587, "uuid": "af70bb56-7e4b-4661-a0cc-ef188b68f306", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679385587, "uuid": "8e974abc-f194-41e5-a650-1bedf2497fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385587, "uuid": "d7dd92a3-7e81-4320-9d2a-e90cdf379320", "value": "Revised Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75394e97-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362870, "uuid": "820a9a5a-b79c-46dd-a623-e7504538a484", "comment": "Malware payload (Smoke Loader)", "value": "1c7980b9a651b5e74b3ecdf4bac8fe9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362870, "uuid": "c711dfb3-30e4-4614-b969-dbcde91192f8", "comment": "Malware payload (Smoke Loader)", "value": "3df0d25a6cae0e00d83e2709e21260d535d07c1d1af37b2ffe825329c6882d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362870, "uuid": "0a6f8b16-0b47-47b8-b511-b99e9a264906", "comment": "Malware payload (Smoke Loader)", "value": "4cb93580fb682d6d04accb3f8eb115e4abb63cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362870, "uuid": "9060f06e-115a-488a-b4f5-1121919032b0", "comment": "Malware payload (Smoke Loader)", "value": "47ee1b2db40810f0dc3010a136ecefd5bfa150f96573b7ad35b4bb03be0ba59677b2903c28df74a668366cfda6263221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362870, "uuid": "57abdfef-6aa4-4dc8-bc09-2260d7cc73f5", "value": "T147048D139AA07971E4278AF18E2EC1B4A60DFCD1CE5D679E33096F1F08B3261C56A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362870, "uuid": "03c81475-1527-46f0-8ee3-a909336e7333", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362870, "uuid": "219949c5-010f-429a-b3a0-7580f3e7436c", "value": "3072:4RN86sbvuEWxi70fqE8tvLDuTgOZY739vj0uqf+AKhWjZ:166rgATqMOGtvAuq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362870, "uuid": "31b56ff9-76b2-4d67-b936-e81c1651c08e", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362870, "uuid": "80fac129-be4c-4ff9-9a32-1a79d73da849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362870, "uuid": "370597d2-4c87-4dbe-a628-77b18b6c3d01", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5e1c0d-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393375, "uuid": "f2d1a44c-8148-4d60-9b34-2cb22ce4dbae", "comment": "Malware payload (AgentTesla)", "value": "233da3f06f80d70c9c0526e557c38fc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393375, "uuid": "6c771576-a1d7-4c00-8cb0-e44e84895f11", "comment": "Malware payload (AgentTesla)", "value": "3e80b8959eb43b4415db0238ad0af83be2263f3af72072f2b75096d2a6387aa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393375, "uuid": "89d9a5fe-8dbf-44fd-a3d8-774d000e2bb5", "comment": "Malware payload (AgentTesla)", "value": "295f506015647cc1f1da32964a6d946afbccf797", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393375, "uuid": "b82ffa46-bfda-4e56-99ff-9da3fc42ca9c", "comment": "Malware payload (AgentTesla)", "value": "8e509c815e468a8ade4ba361455ef362f2bbfeb8a65ef277d2d662f1ba4f73d1690fa986e38bd50949e0d0912fb33080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393375, "uuid": "7bf4e657-b9d2-4d86-825c-6563e949e42c", "value": "T1DC1502613BFB4236F57A6BBE45E42241577FA3A37703D94C0CB602DA4727B024AD162B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393375, "uuid": "edd83bcd-1e3f-4c42-bb7c-c275d2154faf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393375, "uuid": "b5bd6537-7659-4a42-bc26-328f9317a437", "value": "12288:obLwjW0kWLljJp6axnlJ7g6UY6MvSGV7kErOojxPKoNHEaIV3PBBnYv8u7H6AhTP:oUW4LJVxnlxg6tzvSGZ7yKNPv8u7hhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393375, "uuid": "dbb7f43a-a529-42ce-b7cc-45c85f0acb4e", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393375, "uuid": "08b6266e-ce95-4b1e-935c-30cee9f7b431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393375, "uuid": "e1de87b1-c217-40a8-982c-0c37077635af", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131 (8).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e786b5-c7bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679386088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386088, "uuid": "d771c149-ef90-4dd9-b82b-7e09fb9c2515", "comment": "Malware payload (AgentTesla)", "value": "a9a036ac7f582ed751241f9882498e6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386088, "uuid": "f4d03b5b-0d46-4e80-adb9-a918ae38535a", "comment": "Malware payload (AgentTesla)", "value": "3ebbdc42ed873df485fcbee73404d9a3f293e76e8cbc6477987787bd5910ce44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386088, "uuid": "4a4e30a0-be2e-4dda-92ff-1386c1ec5eb6", "comment": "Malware payload (AgentTesla)", "value": "b2499feba37bfd1d82fa361488f05b6093aeb317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386088, "uuid": "ce9c1dac-9e77-4dc0-aa95-e1bbf4252207", "comment": "Malware payload (AgentTesla)", "value": "986bfdb3d9f97f6f61f5337d8688006ef4f0ca9b3e586f24e623ccd1b858437545f20cdf1c594995c97c5215981e125b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386088, "uuid": "0e54892f-58cb-4173-90d9-427f5059676f", "value": "T1CA55125B779D9812C2555436CA93943407326C032733EB483DC9279E1A2E7E5AF8ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386088, "uuid": "ae4d56fc-b4f9-4aa8-9f56-80f3703d068f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386088, "uuid": "2e681d43-4421-42f7-a91b-9e8b65f9b5de", "value": "24576:a8zec1onug1fdAN5cAqKyLFiGmZbvjuFsuNXqayIn8T3:7nU1AN5cAtEiGmNSqul8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679386088, "uuid": "8ebb8e2d-519e-4cc9-9277-5edac040b29a", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679386088, "uuid": "ced64160-9775-4d9e-9d5e-e03cfa2099a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386088, "uuid": "cf01984a-8f9d-44f9-a162-14da3f56ca7e", "value": "zqwioujj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b878854c-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393048, "uuid": "e0e7a065-9af3-4b2a-8ab1-34ba64d81723", "comment": "Malware payload (AgentTesla)", "value": "93230a26788ff13ac29dec21fe186a66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393048, "uuid": "a8478ed4-d97f-44cb-a46c-f0471ad5f6a0", "comment": "Malware payload (AgentTesla)", "value": "3f28c789a1997e2f2d1ef119d2c0911885f51fe0836ca2032b4a863465795fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393048, "uuid": "5999c52b-f762-42b9-bca3-a4ca473910d3", "comment": "Malware payload (AgentTesla)", "value": "391f24dd8ac1a6c0db84f27a6a3db5d1a37c482a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393048, "uuid": "e58aad1a-336d-4875-8182-1e461d447e41", "comment": "Malware payload (AgentTesla)", "value": "19f2cf57b2622c7179d2d75ea3f0958878f21b9e35b129d0f1f3023372d2ee7307cceef696978882406998dab1864703", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393048, "uuid": "86c8483f-ac72-49fe-92fa-729dfe750dd6", "value": "T1F1350213F9849D4AD44247F92EE37999131EBC627BD262C72348B70F6F786E0894711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393048, "uuid": "90cecb28-b4b5-4fe9-ba20-894628d7b8f2", "value": "24576:9LKYWQmmav30xP+MXUu9ud8+MXUu9E3bVY+MXUu9Q3bVYgVF1eyn5lS8:9LKtQmmQ30V+MXV95+MXV9E3bVY+MXVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393048, "uuid": "894ab73f-297a-466a-aeff-11ba92f2c576", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393048, "uuid": "b80fa562-fb89-4700-be69-04b30da62f72", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393048, "uuid": "7b1fbae9-fc33-401a-a0fd-8e4d5a6b8542", "value": "Proforma PL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5343e88e-c7be-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679385577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385577, "uuid": "45b9e7f6-2498-4bfc-abcf-a1808c671c4a", "comment": "Malware payload (AgentTesla)", "value": "d9929eecce754b6098fb95129eb36f2e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385577, "uuid": "b79e1ce7-f4b6-4ef1-9d37-c0d61659cc44", "comment": "Malware payload (AgentTesla)", "value": "3f2a3f1f0e79c1430f025c407498c42b9fd4c8386028401a54dda9e82fa35718", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385577, "uuid": "26293a44-abce-4b2e-839c-12c117b962bd", "comment": "Malware payload (AgentTesla)", "value": "3ce639e6d1ebf434d6e4b1d565a158658183bcb8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385577, "uuid": "e1594bd9-a987-4f20-8efc-634ec970c6ec", "comment": "Malware payload (AgentTesla)", "value": "0e4102a6483c8648f0aa75302d304a5bd323aa8082fac3b1e5191dbe9909657c37095f2d242b77077cdf2041298440be", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385577, "uuid": "21b5d07d-b1ca-4a51-9d81-8b824b310462", "value": "T170C42365CAEA563A9D2C41FF5ABF341CB98CD0C7EC6AA34A4AD51349044C5D638CFCAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385577, "uuid": "03e98566-465d-4563-9e2d-70a71428680b", "value": "12288:PM13EHBKbpp5CjyUWkVqBjzuypEDSMyhGCLv6s5UvtQq5dI:C3EHB65Cux5dzDpEzN+6jlQom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679385577, "uuid": "03acb31b-f92f-4693-83ad-658b318f470b", "value": 589538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679385577, "uuid": "7ef28fbd-8911-4ef4-8212-a60a33b75ac5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385577, "uuid": "5ea1e218-ee1f-4bf2-9019-dc5957b8cfd7", "value": "Revised Invoice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6127b34-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679393044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393044, "uuid": "1ff18698-c966-4a71-8ccb-bbec00b66527", "comment": "Malware payload", "value": "5a328cddbe07c9dd990500dce7ea7c52", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393044, "uuid": "af3db13c-ee57-4ca9-b20c-8e9cd36f9b3d", "comment": "Malware payload", "value": "3f482925fb74ba9aabfee1a7fd8b16f26896f35c25ff5bba761058291935bf23", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393044, "uuid": "a39759d5-e30e-4bdf-b5ce-04024a847854", "comment": "Malware payload", "value": "f1e8bb70be6aaf487cbb5f72f01eb8881e45921e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393044, "uuid": "77ff7848-9c56-4879-a83f-f87465490396", "comment": "Malware payload", "value": "b5c36d058915b979e2c2b25e667f23bc8236bfe5cff6c2682bc4b274fd09e18641256047b452f0b91164ec79582bf969", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393044, "uuid": "4584b121-78c1-4e58-9494-3f01bf8ac10b", "value": "T18A351213FA808D06C44283B56BE37999531EBC623BD6A2C72348770F9F75AF4861761E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393044, "uuid": "75e9dfbb-b1fd-4842-a9fe-245d0e4fe9d5", "value": "24576:fLKTWQmmav30xz+MXU6DVP+MXUw3bVy+MXUY3bV/mz8yPcjp:fLKyQmmQ30R+MXjZ+MXL3bVy+MXv3bVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393044, "uuid": "66d9bd7c-6d52-4333-870a-e52a49a60fd3", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393044, "uuid": "f3d270bc-a7da-4869-a569-15196268f192", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393044, "uuid": "86c6bb5c-19f8-49d2-81e9-aa628c0a85e9", "value": "shipping document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b222c2ce-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679393037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393037, "uuid": "9819f754-487b-4e30-b234-50eca12be6a9", "comment": "Malware payload (SnakeKeylogger)", "value": "334e757302aa9a7e84aba337f1f48b87", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393037, "uuid": "87f79b67-aad2-4a47-916d-58ff402edac5", "comment": "Malware payload (SnakeKeylogger)", "value": "3f85d9333aebdfe5db43f45491cb034967bb749b67f7121fb9279dd40b6cab3a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393037, "uuid": "7a854da4-3cf9-475a-bebc-3bd898e655c2", "comment": "Malware payload (SnakeKeylogger)", "value": "4408fc675527182bf2defe7dc3352ace641f9371", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393037, "uuid": "a55ef522-e053-4c6c-9b3d-429c9778b7fc", "comment": "Malware payload (SnakeKeylogger)", "value": "4688418b8673f104b8abadf37f7d94b9a319c542dced91ab9f878067ecc6781b775e7c5820a43c0f2f3f3d2f64592a10", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393037, "uuid": "48952a33-ba39-4b04-94e9-2864bdcbd425", "value": "T1A0350213F9858D46D44247B93BE379D8231EBC626BD6A2C72344BB0F5F78AE0864711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393037, "uuid": "febcb923-fa2f-41b9-9481-92d808b6a07c", "value": "24576:XLKGWQmmav30xY+MXUu9/t3+MXUu9V3bVA+MXUu9G3bV0aCgm3+ifIVO8:XLK7QmmQ30q+MXV9p+MXV9V3bVA+MXVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393037, "uuid": "ae1bb7e1-9dbc-407f-b956-c4ce011c20a7", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393037, "uuid": "bf142c4b-a57f-4713-9ae7-a3312583ea44", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393037, "uuid": "d0734b91-1d99-4f72-a8f6-2d59da3486d2", "value": "Remittance slip Ino000003373.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f97ec2c-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679398858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398858, "uuid": "2910dab0-7c81-4033-8a5a-25cdd3e07da8", "comment": "Malware payload (AgentTesla)", "value": "9ac1667bba770eb7bdcc2ed5445be1be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398858, "uuid": "1f764b8a-840d-420e-a5a8-fa2a833953c8", "comment": "Malware payload (AgentTesla)", "value": "3f9a3906d05707bc7faba452982b42c6f8244b99e906a9009fefdf3209ab83b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398858, "uuid": "c1b477bb-bcf3-4c84-9f0a-3282bfebd41d", "comment": "Malware payload (AgentTesla)", "value": "266181cebc398d52331ed0b5ca7bdffeabbbd9b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398858, "uuid": "d135ad71-b80e-4055-8c14-200577e5b716", "comment": "Malware payload (AgentTesla)", "value": "2997d5f1aeb118cd04b6368b63ed395ff4c6ccc37a8d5b4925357887a82d61da93a73c4fee32b4b0057b5d61f4f60505", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398858, "uuid": "f04ae38d-9002-4ae7-a814-39aba9d80055", "value": "T1D11529425DBB5085E8B70F2C547B76980B34E953BDD8903B3CC9B61A8FFAA53640A3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398858, "uuid": "bd3a5111-a7f6-4fc3-81e1-1665c62e2829", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398858, "uuid": "0d919668-dbe0-41c5-b540-8501adb968fc", "value": "24576:Z/6g0TKuwMauT6cOU0GwRYCkym+iVhLm2:xUsitboYCpm+CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398858, "uuid": "9f69f03f-1cae-418a-aa5f-52c832aa5583", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398858, "uuid": "669fede8-ee7c-4190-bf9e-cdadfcff70df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398858, "uuid": "02dd1e0a-6c68-48c2-9b94-3fe8a7755280", "value": "9ac1667bba770eb7bdcc2ed5445be1be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c842a5cd-c7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679394363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394363, "uuid": "8dde8e7f-5eb0-49dd-8cf3-f29072ed22b1", "comment": "Malware payload (Gozi)", "value": "e8f17a3011cf011942a5ed07c7aaaaf8", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394363, "uuid": "4712cd4b-7b1b-4fd5-8113-c45fde00aea4", "comment": "Malware payload (Gozi)", "value": "3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394363, "uuid": "6ac652c0-9ca6-475d-8e86-2160df14235c", "comment": "Malware payload (Gozi)", "value": "fc60327c142041f4486a6a814fc2c8059bc9042c", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394363, "uuid": "c2a5e75b-b032-4fab-80af-cab7034b238a", "comment": "Malware payload (Gozi)", "value": "b0f07ed2b6653edde7afbb7e2ed98863b8167f2d0a8de6522a39698286fc131b0752e2f36425c66d0eed380714117867", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394363, "uuid": "3b7c320c-8aca-480a-86a5-4e6965768fdc", "value": "T1C0243744DE375DF4D9E306731146FE3AF6365C829B2A4FA8F742AD33E86592930046E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394363, "uuid": "bcf23eda-a19d-481c-b81e-ffe35e958aae", "value": "d43c0ee666438620f4b82edabd94a02a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394363, "uuid": "f5feed82-4603-423f-92b3-3b1ff4294dd8", "value": "3072:7XFEOXctZScgJKooUngEKpXXaAFwxokUiZQxvudEGyWGKYu:zF5apg8LUngEKp65okUiZM0yWGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679394363, "uuid": "4e25da81-d216-49cd-8c9b-1b995fa3fa1b", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679394363, "uuid": "39af7e55-97f0-475b-b070-754dd865ce7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394363, "uuid": "cb0201f4-74b4-415c-9918-12bf1cf34786", "value": "6419861983e7f.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b649f93-c7fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679411253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411253, "uuid": "fb90a416-d185-411a-bded-00263e61789f", "comment": "Malware payload", "value": "6f6da3bc4cc87dd83034fb22f8624e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411253, "uuid": "0c1bc87f-9f59-49cd-87d4-689044cca4e4", "comment": "Malware payload", "value": "40394d59165291ed94e661ad0e54f7eb27012351b69303fb906b2051ab2b957e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411253, "uuid": "8ee45dfb-beb7-4a52-8b50-de1df23ccbd7", "comment": "Malware payload", "value": "26d9cbffc1b19230a22d6a43783a3a3d248ca1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411253, "uuid": "f6958550-7b72-45b3-a1c3-b4e1c68ad426", "comment": "Malware payload", "value": "628d62b2d02725ca3b666ca8ed6a50a2c4331afb06f837f097102e3d4e1c8ba9f0e52049b72cd7b714fe41b25fc1af65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411253, "uuid": "380e1168-f93a-450e-81e3-e5a8de416e75", "value": "T13F26EAEE64D14FB8E119653506E3CD81A6F0729209F0E0732BB49921AFE9470DDFE939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411253, "uuid": "075b7b35-56d9-498d-83eb-ecae721016b0", "value": "34501e35d57a84daf7089cd24390cc89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411253, "uuid": "7c00ae26-3436-4a11-95f0-6d8e2e79068f", "value": "98304:UGX8qQUVZT9rvU5yserDCXi4SiVy/qME4jbBVlK5oLz:UGXzQUVvTUoVrDH4n1M7bBKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679411253, "uuid": "0ebe3cc7-04d1-4219-ac85-c2cbb559d5fc", "value": 4622848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679411253, "uuid": "15006369-0fa8-4ce7-a001-f284c2d0c615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411253, "uuid": "f3ff568d-b548-49aa-8724-9645ec689192", "value": "5db7d2b6cf9ef34d9f66caa5e435981fdf2e9e5b583f1ccb34202bbc1d319050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba427441-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393051, "uuid": "eac99ea5-511b-4b01-93a6-0b4267b80940", "comment": "Malware payload (Loki)", "value": "8c20287ffb91ed531f61e93cdfb04b77", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393051, "uuid": "63042f75-4876-4280-b2f0-f49a02b11f4e", "comment": "Malware payload (Loki)", "value": "4077612b4f4de09f0d4b78a8d2ed7eb672089c02bbeb4e5f85c5216ec2bd2703", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393051, "uuid": "e6e21ffd-4675-4cee-937e-32393396371d", "comment": "Malware payload (Loki)", "value": "abe96a647fdcdfec265e10e464c8bcf2a4b62b59", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393051, "uuid": "f345415a-df1c-4a69-a291-9506ef2eed1b", "comment": "Malware payload (Loki)", "value": "192cd89068e9bbb76db52c0498b488c692e962155dc16321c8b0f6c54062e541386e7008e5268353eeb3b76a7e0b5ef9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393051, "uuid": "137706aa-64e8-4cdf-9e1f-a26ab9e21b8d", "value": "T130550213F9C54D46D40647B56AF379A9532EBC522BE392873348BB0F6FB86E0490361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393051, "uuid": "4d6215db-5485-4ce8-895b-1b732665bf7f", "value": "24576:aLKPWQmmav30xp+MXUu9b3bVt3bVh+MXUu9N3bVK+MXUu9f3bVTI6T6UGjBmh:aLK+QmmQ30n+MXV9b3bVt3bVh+MXV9NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393051, "uuid": "f1d89549-49d9-4add-8b91-76b8340aac09", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393051, "uuid": "f7d6aec3-122c-421b-941b-901f113dd4b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393051, "uuid": "96cb9a93-8166-46ec-8bc6-f34c0b44e2dc", "value": "Maltrans SOA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39392919-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393694, "uuid": "b9e4eb52-93e5-4802-af2b-3940ad9521a5", "comment": "Malware payload (Loki)", "value": "b71a4bdb90b6ceda352e6af974f9f99e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393694, "uuid": "1edeee01-2562-4c2f-b03f-67050ea538c2", "comment": "Malware payload (Loki)", "value": "40af6c34d71ed4551d5e2722939e7b40fdeb4091744b83c3d0af843ff2719bdf", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393694, "uuid": "5fb94bc5-589c-4af1-9e1b-b750be1b0655", "comment": "Malware payload (Loki)", "value": "f7e4ca2216cf4688420c9b648ed44ba4a69707d7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393694, "uuid": "e64b5185-65ac-4588-83af-a6e871d170f7", "comment": "Malware payload (Loki)", "value": "61122cf4bf5f292cfdc29f4c4f1b1384b7b4f48225f86249e676c0325dd5a3b3bc22aa8840d34dae977c7ab88b75ebaa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393694, "uuid": "a7483dba-2559-4234-993a-d765619b82df", "value": "T10342B06538231646B002BEAE945E5739BC1722AF043574722C2CB06709C578CEBFBA7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393694, "uuid": "86d30d09-ad4e-4678-9cac-b117a3efcb99", "value": "192:ZTDZV0OWycTeCmYBpWh+EHRYyalb+Y2RGMfFyg4zraU:pNWhe4Ah+EHeyalZwy0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393694, "uuid": "0a33744d-e350-47ea-90d8-732707c6d1f8", "value": 12879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393694, "uuid": "5e70b114-eb0f-405f-863d-d579812d7cbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393694, "uuid": "6df1534b-af0a-4c0a-89b0-e3491e50f967", "value": "orden doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec3a9a9-c7d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679395287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395287, "uuid": "910ed385-5665-47d4-ae65-2109c141e68f", "comment": "Malware payload (Loki)", "value": "f751a273c61b7b0f58e92e5e28f08d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395287, "uuid": "5531e3ce-d91c-4beb-ad49-6f5a4ca76e3c", "comment": "Malware payload (Loki)", "value": "410ac5c6ae8518b18513c6ca3695e5099648f159f6365a604bc6026f55f28a04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395287, "uuid": "6794ec5a-3183-4e2e-8f0e-ec5c57e708af", "comment": "Malware payload (Loki)", "value": "85bfee8356a0a0da556cdcc8c2c0991fd3279888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395287, "uuid": "2e8605e7-e40e-48bb-a3f2-0f69026eaef9", "comment": "Malware payload (Loki)", "value": "5958580936dad20b4128b7b7f05e7a0916822a90175fed315db7a2b41c3684045190826520d9c3af5453eb4353a724c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395287, "uuid": "85a45148-623b-46bf-adf4-4b4451ac5e9f", "value": "T1D2E302009BE4C857ECF16A355C325BA7BFFAE1166878971F13A05B4CBD87A00990FB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395287, "uuid": "1a4c98bb-93da-48d8-b162-4d9cea99a6ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395287, "uuid": "4ed29ca2-eca7-428a-92b8-f1bcf76e8f23", "value": "3072:HfY/TU9fE9PEtu+fblvD8XrXUtY/yn7Ho+L4HeZXGBqoV6:/Ya6W5D2Q6Y7HzaeeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679395287, "uuid": "aea1cc2c-c71c-4bb6-aa0c-e2b1d6b0dd8b", "value": 150181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679395287, "uuid": "5e1c8a79-af2b-4504-a18a-2cf0d21b226b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395287, "uuid": "955d4a48-51ae-458c-86ba-f189790d956c", "value": "f751a273c61b7b0f58e92e5e28f08d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba1b0b7-c801-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679414555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414555, "uuid": "0289339b-48e1-4329-bf56-07c59884dc04", "comment": "Malware payload (RedLineStealer)", "value": "1f960244d6633963951711b840d6c4b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414555, "uuid": "5f5ccc73-f384-4b3a-9cf7-0a8026cbc83d", "comment": "Malware payload (RedLineStealer)", "value": "412f9524bb80ba008cfc01edcf76440544e441b3841be2103578553a0fe3c847", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414555, "uuid": "334a9e9d-6bc6-49ca-81d5-561b9bc1ac8f", "comment": "Malware payload (RedLineStealer)", "value": "eff617be72999228401b7db19905f58015e4f71b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414555, "uuid": "daefab85-675b-463e-8cb7-e3c9f3961f6a", "comment": "Malware payload (RedLineStealer)", "value": "b13335bf993de9c3626416f492cd522ea11d621db30b9d748883da245a0f5e2855412be0ed7f78925c74b833ae660545", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414555, "uuid": "f7c4035b-cacd-43e1-a154-5a64dbbff849", "value": "T1D655E00382A27D45EA658B739F1FC6F8B64DF2709F497B7532199E2B14B02B3C1A3611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414555, "uuid": "c734e5c9-ec13-47c6-bada-ed40bb9576a9", "value": "a1987c4dfef703391c65547d45eb7acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414555, "uuid": "7ca66f72-1db3-45ea-a6b7-c2139db1d338", "value": "24576:gP68Q0hZGglqBXOSYHjlRNTeM1YCXLlW//bVyFqb:gVQ0hrlqB5YD3+nbgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679414555, "uuid": "c343e365-a024-42b2-a9a8-a84f17d83cf5", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679414555, "uuid": "6dfbb528-1074-48f7-a652-a78b7ae37a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414555, "uuid": "d00ee65f-60c7-4075-bb2f-49b4d54339d1", "value": "1f960244d6633963951711b840d6c4b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c64b8d1-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393672, "uuid": "0bdda61f-10b4-497c-8c00-0a88494a2497", "comment": "Malware payload (AgentTesla)", "value": "fe95221e29e2860c90f9bad7a4a3f167", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393672, "uuid": "63d9e8af-677e-487c-8714-07be8c3455d6", "comment": "Malware payload (AgentTesla)", "value": "4183418e07e669ae967e45459201fecbcc2ccc5abea44b1300dae5a9841e69bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393672, "uuid": "e4b2b19e-318b-4117-a2f1-51a9374f9648", "comment": "Malware payload (AgentTesla)", "value": "8fb3bb33bd81d9128e1ea029afeccf2cc80e113b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393672, "uuid": "e27c5477-27a9-44fd-880d-dab7e89d9f36", "comment": "Malware payload (AgentTesla)", "value": "91b74627d10117dcc1ffc9556dab02b4cbb599e411d1343b25cbe8c4f1a575adb6b67d9e560fe73ace79bc2e8dfc839d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393672, "uuid": "2c7f46b6-a85d-4a0a-993f-769217087294", "value": "T11364E1503AEA040813E2A6534FF7FB9D9B3BF1E6C53A1D5E64CC094BB2DE5014A22BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393672, "uuid": "53760c91-0c96-4856-9673-e03612b3e5a4", "value": "768:hCtFGWI1kd7m076S+tW5i81SRVllu7VDuW9:hCtFqkd7m0cW5i8czsj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393672, "uuid": "0de8cf70-86f1-4f44-9a0d-e2afc56cb384", "value": 334014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393672, "uuid": "966dd8cf-073c-4561-8bb4-4d409b7ef8ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393672, "uuid": "31614884-fed4-4230-85b4-b6d04acd3b1c", "value": "\u0391\u03bd\u03c4\u03af\u03b3\u03c1\u03b1\u03c6\u03bf \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98caa133-c78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679363789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363789, "uuid": "e3650380-f441-42cb-891b-123b2755f4e2", "comment": "Malware payload (Rhadamanthys)", "value": "bc5baef4c3444b0c7aa172f5f036cca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363789, "uuid": "9307332c-a0fa-4727-bc74-b883d2ec6aae", "comment": "Malware payload (Rhadamanthys)", "value": "419600d0508516026569e661e54e5e7a5d17d47d18cb8f427932bd728d9bc743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363789, "uuid": "87ba8642-e928-42f0-8753-4b84f699394e", "comment": "Malware payload (Rhadamanthys)", "value": "8ddd5a0ba54d35318ec0ec89c438ea33e86027f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363789, "uuid": "f8051652-4046-4973-a4c9-e62663937534", "comment": "Malware payload (Rhadamanthys)", "value": "8a5833646e1276711cdb664c0d5e6ebee4840fa74bb209727104dc3d92b3e1033654171908b686b2e709dad25c8e1db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363789, "uuid": "b50ec63b-e48d-4aac-94de-286ab024f40b", "value": "T1B544CF1356E07812F716CAF14E2EC2F4B61EF8D1DE5D676D22045E2F08B3162C56ABE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363789, "uuid": "a82fba47-58cb-48bb-b1c7-a2377d781e84", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363789, "uuid": "f0c62f3e-0118-49b0-a340-ad45aa439d00", "value": "3072:nn1BiUUXDlIyNWPUiN3cIGJTgfAvyK43kC1hNp7CTamBywBdXrAnVeDu9DOohtZ:nOUmPZiQvyK43kcheTamPrAgD6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363789, "uuid": "c37b2bd4-d72c-4893-a4f5-65278cb4f2d5", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363789, "uuid": "c4faf60b-6d4a-44b3-b456-58d5640fe41b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363789, "uuid": "fd4f08c4-41e5-4d09-819d-f0d989d7f2ff", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8345cf-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679397513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397513, "uuid": "61702113-2ee9-4891-9c3b-997edd2bcc9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d90d42631511b54444b9cc592e5a4aa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397513, "uuid": "1bd15083-f089-4562-8a0f-ee91c10a1eed", "comment": "Malware payload (SnakeKeylogger)", "value": "4218d4a03fb87124e33562f14b385c28ea9ef1085b2f389d6da8a2c0dc20ce22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397513, "uuid": "cbeecbc9-21d2-46aa-9c00-660a005d9732", "comment": "Malware payload (SnakeKeylogger)", "value": "0dbd67813ffe59903638e01af41b8517ec6a8459", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397513, "uuid": "b5eb1393-2cfa-497c-ac57-b640bea94e19", "comment": "Malware payload (SnakeKeylogger)", "value": "1e6b0e927b267fad13bc94b2083010ec5b422bc80bc58ababce19763832da7e37ff80af65cec27433dba5c8993b2517b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397513, "uuid": "16fad36a-6129-4a5f-90d8-b5fca96fa009", "value": "T17EF4E450FAA8971BCABE26F6507163600FBD9416B256F3CBC685B1B10CB2360BD1D35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397513, "uuid": "5c8c45dc-cc3c-40e7-af6b-61a1c1e159fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397513, "uuid": "a89689a0-8ed2-4b4d-8a7a-c40ae3eb66e7", "value": "12288:bwV+t09IZrnJtERjxSvfe0+qvwlqxQlUDruQ:bGW09IZrnjQVSvG0+qvU3lU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397513, "uuid": "14978782-b9a6-4adb-8235-db06b40b10c9", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397513, "uuid": "538fe43b-e140-4936-bbe8-fffa544cf332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397513, "uuid": "eebaa43c-c845-413c-8c59-808b61276bc7", "value": "d90d42631511b54444b9cc592e5a4aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f8941c-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679398845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398845, "uuid": "06e09a3d-6de5-435e-8eeb-e9b557851f88", "comment": "Malware payload (AgentTesla)", "value": "708be0d87c2de77618729c3c886e1d51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398845, "uuid": "7eb0b604-f31c-4168-ba7c-930f1836354d", "comment": "Malware payload (AgentTesla)", "value": "431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398845, "uuid": "f5fb2752-2777-498c-ba7b-b58876742218", "comment": "Malware payload (AgentTesla)", "value": "68b7939873e7aba3112e6b51a3cfd2b8b43a2749", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398845, "uuid": "35ae3a32-8188-4a6f-8985-b52958d6a96d", "comment": "Malware payload (AgentTesla)", "value": "63891fe8f3a3152372a2cc0cb2aca13787b9ee2f1e51061b50e111f6aa05c3ed33ed577884889981080fe5fb11e9090e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398845, "uuid": "c2396f58-6fa8-4686-9b4d-2b2c46495295", "value": "T1F405016ABBA46A42C31E2A72C1E75530077158476773C7097EC916892A0E3E69C4FFCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398845, "uuid": "d560b923-ee13-4e1d-8e39-5793075f1b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398845, "uuid": "a0d30882-4f27-470b-850b-6bc1097de7b8", "value": "24576:ie01vNe4sKsFWhjcn5vH2CQzagk1bMOn3qfjt1Q:iGaVhI56Ogk5Habt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398845, "uuid": "5945f96a-b9ec-4b1b-864b-c8ce970a3e70", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398845, "uuid": "4a349942-0f59-492c-b3cd-e0427cdc1de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398845, "uuid": "d2f31227-4bce-4176-8eec-5eea366a5fda", "value": "708be0d87c2de77618729c3c886e1d51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1d192f-c7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679398742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398742, "uuid": "efe8744b-3e93-4749-8861-945b3bd86739", "comment": "Malware payload (Loki)", "value": "db040d4c606d8af91329bfe03cda801a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398742, "uuid": "684b5e27-39da-45fb-b5ee-758ccfdebd11", "comment": "Malware payload (Loki)", "value": "4526f94530978413010ef4567c6e093679aad9d0451d0d74400426104f24a0b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398742, "uuid": "91c325dd-9bde-41c1-ad5b-4386c364765f", "comment": "Malware payload (Loki)", "value": "b768b6583e9255cc0db2b77f240596e0556b88ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398742, "uuid": "8f59ad83-20e3-40f8-b4a6-913a22cd8f95", "comment": "Malware payload (Loki)", "value": "59dabc848d54b46c1a53500fcf49811fed80cc25524aa5546aca2de9dc30d2b3ef116b493deb28390a16ca38191669b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398742, "uuid": "563e3992-784f-4fdb-a471-b75a7cb532c9", "value": "T169254A424DBB11C6E8B74F5C647A76980B34E966FDC8503B3CC8B66A4FFA61360463E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398742, "uuid": "a4ab9f71-b689-40f3-a3c7-a5f051133b42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398742, "uuid": "11af104c-408c-4a54-b9b5-6407505724c8", "value": "12288:p3NWNpm1fO55SU5qQTg52BPJ1I2HpLRpmBc8XOWhZVraVdIO0qEsM9YE7LqEY9OG:+mM55v5qQTe6I2J1pQXLxUdIxJlnVx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398742, "uuid": "8740b5c9-1bb1-42c2-854d-b71c66428547", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398742, "uuid": "6d482029-7c43-4e50-92c3-93761d91ab76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398742, "uuid": "97601c61-03d4-4718-8afa-4af0b24ab8de", "value": "db040d4c606d8af91329bfe03cda801a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed30b38-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679405380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "24493360-e78c-43d4-a285-afbcbd4af31f", "comment": "Malware payload (CoinMiner)", "value": "15db9f43813112507a5cbd9b4f5e1fe9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "e0e7cc7f-9483-4014-9c17-305fe6b7e5a6", "comment": "Malware payload (CoinMiner)", "value": "4531e904b29a577272454de8f8084d86fbe2903f16c00d2fa63d1ffe5244ecc1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "c9a722c5-6765-408c-8f9c-a5e17aa3d9dd", "comment": "Malware payload (CoinMiner)", "value": "1a8ff6cc9c572e1d52b2e7db582178a9d5208e17", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "df4c03c3-2dc7-4ac1-996c-0c65d8f5806a", "comment": "Malware payload (CoinMiner)", "value": "2736aab2cf4d60d2f36fd13fe1ccd1b5d865b239410c333431b464467a1bd46cdad7246eb2b5ddc25b78ca8dd5e27405", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "c87e7a96-a84d-4f7c-85f6-3999ae9bf469", "value": "T1D9733900F280813BE0F681FFEBFF56A9192C9FB4534594D7A2E1689F56346C6BA36053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "1097ee3a-da22-4c57-900a-d2c62cf2a9d1", "value": "6880384c7bfd2a14f2b2e2e50f940ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "d45c6bdb-7add-4e3e-a9cb-4510e3d2f038", "value": "1536:T3Mz8YI7OdQZ16vXROFon3rXMOnfF+OeeeeeeeeWeeeee:4wYuIPROKnLMOnfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405380, "uuid": "4e5da94c-8a63-43b6-a235-23d883cb3c9c", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405380, "uuid": "a679d785-d2ea-4484-abce-123f6e0600a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "5d220b22-0977-463e-b2d8-729d67cbeac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324c438e-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679398836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398836, "uuid": "8e5f3996-c5c4-4c10-a0d1-8ae34fb21488", "comment": "Malware payload", "value": "72d8093725ecac5eaeffc86d1762061a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398836, "uuid": "1e8de06d-3b8d-423d-ae5a-c46ae92c451a", "comment": "Malware payload", "value": "4544daf2f477d6ba4aa26ed5c63875c237defaaeee06e86bbc8e18867d7d3778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398836, "uuid": "598a0692-bb37-480e-a317-1ca2db79489e", "comment": "Malware payload", "value": "81c808254fc02ecaf204bb0facb67373b5801057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398836, "uuid": "e07c61dd-0ca7-4ba3-aaf1-48ce8d0e8293", "comment": "Malware payload", "value": "bf016d24f71ac6dc1e5d68b5bd1b3d1416b8da697470461d3c29efe77c5e742ba590d2fe5519d910d317ae041a162aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398836, "uuid": "f5d744fd-14e2-4d96-bdd5-71ac04fc9e2e", "value": "T14C25339CB2FA2DA1D07BFF21961307B17E5B9B78982FCB74C12759188AB0C424D711E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398836, "uuid": "78bf2d87-d3b4-4645-8e06-6c145428e042", "value": "24576:GK2d0GD6D16yMB3NfSzle6q0r0ehtzQZCp9e6Mzz1AXVT:GrhOD1vMrf2l3qu0CtzQiJaz1ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398836, "uuid": "149ec7f6-f782-439b-bd63-2a71fe5d7090", "value": 998536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398836, "uuid": "0fe73be4-313f-4c63-b42c-0a7abdb7f1b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398836, "uuid": "94850ce1-b403-4f11-8871-349e35d67e5a", "value": "72d8093725ecac5eaeffc86d1762061a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b9b852-c81d-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679426433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679426433, "uuid": "07ac89a0-42e9-4687-aecd-649707e9081d", "comment": "Malware payload (njrat)", "value": "0fe9db2d2771eeec1f3596dc025453cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679426433, "uuid": "f08d814d-0113-4b17-a63c-c455d742120b", "comment": "Malware payload (njrat)", "value": "45a62f1029038d019e1949acfa94d281e14db00b1a2b344b8dbb0676dd2c4f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679426433, "uuid": "70e3a279-d1d4-4022-a95b-241a18eed2ad", "comment": "Malware payload (njrat)", "value": "1ee2f8c16efff031352c11c22b908fd6f94a0fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679426433, "uuid": "cc44cad5-0705-4f87-9b9d-a103cf1736fa", "comment": "Malware payload (njrat)", "value": "2d6c364c9284187a092cf7ac23440539b36298f2f4b5615e0b45f39cbb078807c9fe7fba5fa4176431e0d4fa7b78fa13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679426433, "uuid": "67e3e8bf-d591-4db1-8d08-207409267c6e", "value": "T11113D88CB694E175D5FF8BF0B492B2890B71901B9902E30F99F154D98FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679426433, "uuid": "e13d2743-ee9c-4a2d-8d50-2f9dd19ea0fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679426433, "uuid": "94ddb5d5-0572-45e4-93a3-23442fae8a72", "value": "384:DZyk04i9jTk7Vqb08yGLws3esM9tGHJIhYb69D9O5UE5QzwBlpJNakkjh/TzF7pA:t7Y5A8Y5Gksu9snvQO+P4+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679426433, "uuid": "9b012205-5b07-4aab-b4a9-f385ec0bffb4", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679426433, "uuid": "88a2bd70-c9fc-418b-8e6a-f0dc6a34fa72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679426433, "uuid": "5c5ca3e5-6750-45f1-8363-5e99d8de2977", "value": "0fe9db2d2771eeec1f3596dc025453cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3924e2-c7bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679384198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384198, "uuid": "904ce172-579a-4ba6-b315-d55ea700c89c", "comment": "Malware payload (RedLineStealer)", "value": "bbd2bad9eda5d61430ee408191e63fac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384198, "uuid": "2db0603e-6906-474d-8138-c1aca6e171f6", "comment": "Malware payload (RedLineStealer)", "value": "47fd89d46ed1b1d7cac0e63703aa3d2e37d073b02f1196820f398013fa76cde6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384198, "uuid": "375409ba-a960-4060-a164-ffaf7a38e229", "comment": "Malware payload (RedLineStealer)", "value": "6e3d04be4459656d3ca8443e8db5c21c72cee78a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384198, "uuid": "eeeffc7d-cf70-4c11-8b9f-e20f052595d5", "comment": "Malware payload (RedLineStealer)", "value": "f9a93213bb5c35ff7522d3538e3f99f9c688b15abd863c0fdeea01dd56f8d216510c55de731f379366ae45ff8e7e14b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384198, "uuid": "690ef22c-ae79-447a-a7f7-02d3296a2196", "value": "T19245021382A27D55DB1ACB729E1ED6F8775DF6308E49775632086B2B0AB13B3C223711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384198, "uuid": "59355935-e0e5-4895-9f18-da9601816d74", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384198, "uuid": "d05a0da1-9efb-418e-8b51-c783cf0dec55", "value": "24576:Z1x4Y79vRMcmZBqkztFhjyDcLrai+hEmWF6:Z7469vicSBl8f3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384198, "uuid": "6fab0da2-805d-4777-8ec4-11dd61d8fba0", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384198, "uuid": "d6781463-af9d-4cb2-b313-8c937f0de6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384198, "uuid": "1ef94229-f6e7-4bd4-8354-f5ce0755a3b6", "value": "bbd2bad9eda5d61430ee408191e63fac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db33ef9f-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679405562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405562, "uuid": "0823f698-aefe-4295-946f-27475edc1433", "comment": "Malware payload", "value": "983a0bf99b9f078bcab5c0cedbbe1135", "object_relation": "md5", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405562, "uuid": "27733e29-c8e0-4326-868f-1317f6476a46", "comment": "Malware payload", "value": "486f346471c445aab050b2f6d8770fd7eb335cc4078459a94ed358249386bb4e", "object_relation": "sha256", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405562, "uuid": "3935f09a-e213-4fe7-9901-2fd9010113c8", "comment": "Malware payload", "value": "a4f122f71a069b144b3bfb62994a0eae73458f5d", "object_relation": "sha1", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405562, "uuid": "b817b339-ed46-4dfc-ac1c-db520433365a", "comment": "Malware payload", "value": "50fce2a955b217aeea2c3c28bd347c4edbfcaddba3c81aa43cc9261172cfd61fd5fc88ec11474c5606c290b4230e457d", "object_relation": "sha3-384", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405562, "uuid": "ce8b93a1-ad99-4cce-9fc4-41b5123a5c14", "value": "T1DEE31250519FE84DDC0892A2E52E76BEBB9F77A270C420D5EC5F956ED0C0E01E80BED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405562, "uuid": "e7819f0a-4798-4368-9b18-ac7c5db034b6", "value": "3072:mXZn4WiOLVM25WPqPyk4fCWvmKNzr7D8hzkvm666NwJdw57ftCYw5w1:gZJid25WPqPx4vdxr7DJm6666JdkTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405562, "uuid": "43efa915-252c-4a42-8a87-15e415afda35", "value": 150652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405562, "uuid": "ed530ced-3eea-43d7-8e16-e05bfd698f47", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405562, "uuid": "86e36619-e2ca-4f15-a3d5-4b173af3fbae", "value": "RIMESSA_CASSEGNI21032023-8608.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e2d4a9-c7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679401984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401984, "uuid": "d28e02d2-240d-46a1-9101-ab0eca0b27e2", "comment": "Malware payload (Formbook)", "value": "aeb4e4b3b806fef6e51ee31c375ac1d5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401984, "uuid": "6c7c7c73-2ae7-459d-95f1-8b4a132485c1", "comment": "Malware payload (Formbook)", "value": "493f0383a996540e99a3cda3eccb328b5fc59b0a51598f80234f97451b9043a6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401984, "uuid": "354ae4a6-f958-46cd-80af-049d824ba777", "comment": "Malware payload (Formbook)", "value": "9d7aa112500dced390557c425a0fcc16336a32f8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401984, "uuid": "3d0e90eb-b1b6-49ef-a187-225350439d8b", "comment": "Malware payload (Formbook)", "value": "7c5038837fe7c9784f6011a19ecc89af26b02e12988ca339e1dc2ed55657aa4098e14978deb0b744552cd2e213add1d6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401984, "uuid": "f818f63e-04e4-415f-be5d-0b4a52b2a07b", "value": "T10E1533957A3C84EE2FC9E28D92E8B4C46C62637C45B0C1F97025A47477B727D6A63A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401984, "uuid": "ba515cd4-b6fb-4362-8bbb-cb2b8e59113a", "value": "24576:Uf1sOIneCMJhH9c2pijgEC80LrQYLkwg5nM7g/nLu:Uf1sOIyzHCWFE8IWg5n6sna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679401984, "uuid": "cc83bdb7-edf0-45e6-9e5e-5422c73f5b3b", "value": 912907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679401984, "uuid": "10ad2532-8b1a-47da-80dc-f40c7f087c0e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401984, "uuid": "ba0db3c6-be37-4ff3-979e-8f83da7368eb", "value": "Shipment_notification.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db18ff8f-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392677, "uuid": "c0f8980c-cc47-4419-9cc3-ae793035479e", "comment": "Malware payload (SnakeKeylogger)", "value": "75b95fcf95a20bbe263b3008adf6f8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392677, "uuid": "a7ecfc57-c945-4f50-bad3-9b3cb99d6c27", "comment": "Malware payload (SnakeKeylogger)", "value": "4974ef66f5f6fb9341fb229af375634d8827e32da5c8e6f47d9d8f3656827836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392677, "uuid": "fe99c018-5edc-4cfa-ab05-c7b0317f8be4", "comment": "Malware payload (SnakeKeylogger)", "value": "9bed08a540f42bf347ddb91fa9401c6b2a164d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392677, "uuid": "b09a9bed-7ee7-4982-8e09-58045478c738", "comment": "Malware payload (SnakeKeylogger)", "value": "8172da79e529de36217549f037a01a8a55d9eefca557edb9e01925d8f63e3b7d8f2203c998ef1b45b977b0055743d2d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392677, "uuid": "3485409a-c2c3-4f06-ae33-2a84436640d2", "value": "T183D4BD826375CB1CC5A857F7E9E085F807622C65E16EE24B7DB4BCDA3A36BD00910763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392677, "uuid": "be16cef4-998b-4ccf-9499-e685e2cf1094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392677, "uuid": "f1deacd3-6d1a-4339-85d1-8a586008d9f9", "value": "12288:NnSDDIW2XW2XW2XW2uoGk2FvKXsMndCtphWzL10:d6U7X7X7X7uoVOMndCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392677, "uuid": "d208cd18-bef0-4082-8732-56b13276a494", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392677, "uuid": "b2a0a3d3-a76a-4422-8b69-b96952b7a52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392677, "uuid": "838882f3-da84-4e35-8c3e-6ea11acd8541", "value": "75b95fcf95a20bbe263b3008adf6f8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b0c956-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679384821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384821, "uuid": "1d85ae60-daff-4efe-a671-623cef0aedc3", "comment": "Malware payload (Heodo)", "value": "1a735386254a7e8daa52869537af2418", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384821, "uuid": "1cbf9b1b-f250-4a0f-af13-e2b7b01f562d", "comment": "Malware payload (Heodo)", "value": "49ae152256c665234a656129c1076ecf8c693506ceb333c78a74876885ca8a56", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384821, "uuid": "9a2d01ca-f2d3-430c-bdd2-b3ab2f1ff5b1", "comment": "Malware payload (Heodo)", "value": "bd5ed3a407915e103a95b441218c2c3c4d67e854", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384821, "uuid": "41a2b703-6241-455f-8acb-e1e348a0a50b", "comment": "Malware payload (Heodo)", "value": "1f1239f4c6d36c68c83167e6de627b46c4a4782b9220397455c0fec39cc3caadd13b60d14b2f2f13b6675dd3d6634d6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384821, "uuid": "12494077-f101-4d79-880b-a7aae8f9d43d", "value": "T1A325E0AC74B5BA5AF5C4837FC6C52CB6DB3CA540D7A93D9B8E2001577D8310E1FAA860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384821, "uuid": "c8425fb5-54db-4f1b-8f4e-3746ae240f96", "value": "6144:XPdXQBxb0BK5Z6lA8UKN7daEUhFRLinfmfjffdPmLNAMB7oj+uUsF:cxb0BGobUKNBarhW4dQA6oj+u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384821, "uuid": "e79b5f0c-ec15-4212-8e0a-5e7347addc28", "value": 974130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384821, "uuid": "810ec8bc-039c-484e-956c-cfc59fbd4b65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384821, "uuid": "1f486e80-a9eb-4479-a4cd-b12dcda0d9a2", "value": "77A45B550B5C42B08118FB7B5B79A1F7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71064851-c80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679418698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418698, "uuid": "99c8bf94-79d7-41a4-9935-3c0217142a69", "comment": "Malware payload", "value": "b226896ce66e62e9ecfd50050d7eeed6", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418698, "uuid": "feae2232-a8cc-487d-ba67-e8fa90eda2fc", "comment": "Malware payload", "value": "4abcf6581532ec5d97ebabc8233ff2ff944f1a758b5a06d7b91a0c8ca36f673a", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418698, "uuid": "64b45b62-9b77-41fe-879d-9cc4c82ac55b", "comment": "Malware payload", "value": "db842830d3950e5952dd8cf68f9ec4d8e9a5693e", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418698, "uuid": "d2e59b52-6564-4674-89e3-11266b928582", "comment": "Malware payload", "value": "bd8e0c8e1e15b7b24174c1277e00d053e57da452a5b5a30be045301b899bf1e6e92e5c3ce929a27daf78cf994d2c556e", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418698, "uuid": "94212b63-4d66-4a33-bb99-8a638a83b572", "value": "T1E0563B43FC5045A8C2EDD270CA798252BB61BC891B3067D33B60F7B42E76BD46AB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418698, "uuid": "2ec5a98e-6014-4275-9eaa-a8a60aa7b801", "value": "98304:8AUFX6WORjUneG+GvMnpizfxQYe/f6ZaN9EqSGkife:9Q63Odl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679418698, "uuid": "81671162-627b-41aa-94d9-bc9fe46d133a", "value": 6380752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679418698, "uuid": "0ace2f2c-4aab-4059-a63c-e04d3c1c0aa8", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418698, "uuid": "b3ee65d5-c607-4b7a-9977-194b5dcbd05c", "value": "dosia_app_macos_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4befae11-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679364090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364090, "uuid": "b10b6a96-3595-41cd-9ad0-4f9d9a4876aa", "comment": "Malware payload (Rhadamanthys)", "value": "502a6f2e8d520a7e91f025f9f2ae46c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364090, "uuid": "991b4691-a505-4bc7-98c2-b7ec6e40364a", "comment": "Malware payload (Rhadamanthys)", "value": "4c8efbebe269a6ccc55f1d34531a90f1ea81c4fc834f1791b9c090e6e62338e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364090, "uuid": "a3605298-d0ef-4fe9-af73-385f9be6fc94", "comment": "Malware payload (Rhadamanthys)", "value": "a6fb04b8be261f9874c2bdf3d95afdc874f705ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364090, "uuid": "e2bcc002-e8e1-4edc-81b5-bd2620a0b207", "comment": "Malware payload (Rhadamanthys)", "value": "1f039a3a95611fc865185c0f06b4f4304076c53e2d2eaea05141ba3c375e72b9ae9f91c866d410d7ced2433ee2149569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364090, "uuid": "e3e81b85-3f1a-4f67-88f6-49d69f351612", "value": "T10444BF025BA07865F026CAF19F1EC6E4B61EFCD1CE5D276D32046E2F08B3261D9A67D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364090, "uuid": "41ba1b4b-5ddd-4d39-9676-c5eec2ce62c3", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364090, "uuid": "a76e42bd-b438-4200-ada3-fa7357c50586", "value": "3072:0u1B0KUX78t9NWMq+XG7Wm5nmSy8VmN+osVjvPVxCE6Cvuv/LR+LqMhJcHdcbvfm:9gKmcNUmSy8FxCVfAhJcmDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364090, "uuid": "fc3adbae-6db5-4205-99e0-dbb34a44ddb4", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364090, "uuid": "9687115a-b5ce-490d-bd31-7b61819d9442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364090, "uuid": "ad07ac5a-d0f7-4bb7-b349-9d08025f3753", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c4deb7-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393040, "uuid": "80bafcf3-2e73-4a9e-ac70-1ac05663c73d", "comment": "Malware payload (Loki)", "value": "e0ae5ff08bb276b3880bf806145173e9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393040, "uuid": "dec836e5-d8a0-4eea-bdca-07bae104790f", "comment": "Malware payload (Loki)", "value": "4cacb52f372bdc9dc46a91380afbaa9ceca455695a54dc7a512ec9614d460167", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393040, "uuid": "dc50be0b-7094-40d2-93f0-407eecc03b68", "comment": "Malware payload (Loki)", "value": "b07b611dda0d3a72ab545aa472b29aea73cb07c5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393040, "uuid": "9c86ae75-958f-41f6-a188-f2358fcc6dc3", "comment": "Malware payload (Loki)", "value": "cf62da1b3afec19a63767c41193d72a43d0e3ff7e4cc07a569d7d6a0338ed421f2f7b8c7a49df995f80bd8fae4c95a7b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393040, "uuid": "6eac171f-f32d-4641-b9c6-bd4be0dfa922", "value": "T1B7350213F9C48D46D44247B96EE379D9132EBC627BD2A2872348B70F5F78AE0864711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393040, "uuid": "de2bfbff-84f4-414b-9917-2aad5102024a", "value": "24576:6LKqcWQmmav30x7+MXUu9uEZ+MXUu983bVI+MXUu9h3bVbmzFuTafbQ1l:6LKqxQmmQ30p+MXV9T+MXV983bVI+MXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393040, "uuid": "f97e0c2a-543d-4121-ab36-7ba227ed961d", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393040, "uuid": "368c61eb-905a-4085-82c0-940d597938fc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393040, "uuid": "a312fe28-936d-4140-93c2-2be23a8bb158", "value": "DRAFT SHIPPING DOCUMENTS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e8dbfa-c80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679418738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418738, "uuid": "3c542b4d-2ec9-4720-83ed-461820a49f38", "comment": "Malware payload", "value": "e9b7f02bb4830ae9c7d130421081f79b", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418738, "uuid": "24015515-c43c-40e4-b625-9c623aa61d4b", "comment": "Malware payload", "value": "4cf377188ef147c4c85c5c6c407f5ae439eb3b730296c4db28b7f2a3b0ca6300", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418738, "uuid": "af1145aa-83d9-4de0-aa0a-43eab4413b5f", "comment": "Malware payload", "value": "8eae8022cda303f3c6b3727d5b7ccf9c0aa057d5", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418738, "uuid": "24c906c0-6c0b-49f2-b882-482cca7cfed0", "comment": "Malware payload", "value": "087fd74532ac48ab3de98d39549570740286ccebd2a025b6de59ee0cdab322f1b96f051ad7f7ed31c02cdfe4761989f1", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418738, "uuid": "0bb834a3-d7e5-4924-8c8a-90898f0b7b84", "value": "T1A4462A47B8914A82C0E43676BCBE81C433A75EB99B9B52576D04FE3C3EBE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418738, "uuid": "350a12ca-e531-4d5c-b54c-014177980944", "value": "49152:JOWlXVOvShmyIe0Q+WL/fPrR+v6wFiNrNuE+b1K:JOWlWHvfyNrND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679418738, "uuid": "13b47b76-74a0-41d2-bb9c-fac374930215", "value": 5832704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679418738, "uuid": "c2dfce53-4030-42dd-92cc-22e1297abe97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418738, "uuid": "9e193bd4-8f28-46fe-9f9c-13a5f475a7ec", "value": "dosia_app_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25253130-c77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679357582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357582, "uuid": "04413309-fa61-4f85-977f-8b808188e62a", "comment": "Malware payload (RedLineStealer)", "value": "8f74e052eb02727ed39e63a1557ac713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357582, "uuid": "629fa5f1-93ca-44d7-9a44-59614b6d2569", "comment": "Malware payload (RedLineStealer)", "value": "4d7e8e7b0c21b5dd2ef783d3ea962c09623c1c2aa05318958476f8959e3e45f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357582, "uuid": "a8a74ca6-44a1-440f-8dc9-4df3eb444a15", "comment": "Malware payload (RedLineStealer)", "value": "0c3b2493aa3aa271ff458f6a939a959d6a8f9c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357582, "uuid": "2451f763-4d94-4c24-a008-5b5714c95818", "comment": "Malware payload (RedLineStealer)", "value": "9da141db4b1437ed9f091e1814672be7a3642a4c853a57a9b929c43c0c6394404127921fe1d82cb81b0f5b7c71364e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357582, "uuid": "5691b487-d3df-44ca-b2a2-15c058b88110", "value": "T18854C01397A0B855E512CAF14D2FC2F4AA0EBDD1CE6E6B5E22046F1F0873161C5AAFD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357582, "uuid": "2955c159-9895-4864-a488-8ed4f48f0286", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357582, "uuid": "7f4e18e2-afe8-4ae2-a3af-e34d1f8484c6", "value": "6144:c0QMCUk3bnxElf8vg0jMEi1t9ZfbyRA8Qd0b0HSa:c0QMuFEqvHMEihZzyRAlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679357582, "uuid": "f9cc6869-ffa3-43f4-bc57-6c2dd1093e8a", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679357582, "uuid": "2ab937c2-7b4f-4c89-9db4-dd01f43614c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357582, "uuid": "c7043cfb-79b4-44da-ba26-148adfaf7ac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55235838-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1679392881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392881, "uuid": "689df1b2-b526-4a49-957e-ff9d919e74ff", "comment": "Malware payload (Socelars)", "value": "d1640c20e4e0141d32b5d128e22e226e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392881, "uuid": "ea936bc3-ad52-4849-8fa6-ec16959b9850", "comment": "Malware payload (Socelars)", "value": "4dec69640a0d3c7d0ca9f42efab87f512407e5c61715e7939464a4eab03b5d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392881, "uuid": "acc62ca6-891c-4778-a274-0aaa7e19c067", "comment": "Malware payload (Socelars)", "value": "10d840e365742b18dc8cedc89ead57f03f43c550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392881, "uuid": "2207f8d8-0457-44d7-9dfb-b53e97f0ad14", "comment": "Malware payload (Socelars)", "value": "75a076aa648fcf80a2108f867f98e2e066275105f5388e64cba68e7917c31e2a308c3ff22a9641302062ec8ad75f8c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392881, "uuid": "ac5190bf-4610-4cf5-a592-13805cac4078", "value": "T1B3658D21FBC26032E8E310B745FF66BE9D3C6A11470894D7D3C81D999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392881, "uuid": "984355d0-b7a6-49ae-9791-9c736b3787a5", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392881, "uuid": "f68c11ed-74f7-4ca4-b647-621e17595826", "value": "24576:gGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRja5hQS4:7pEUIvU0N9jkpjweXt77+52x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392881, "uuid": "d26737de-3e1d-4e88-acb4-0d88ae0c83b3", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392881, "uuid": "b7011c08-5340-489b-b415-493bd9639733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392881, "uuid": "75a20e5a-11e6-457f-8541-b77a90a2d50c", "value": "d1640c20e4e0141d32b5d128e22e226e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c556b6-c782-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679359763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359763, "uuid": "bdec132a-5b50-46a3-b112-3d58890ec5e5", "comment": "Malware payload (RedLineStealer)", "value": "041364203ba3cb22af8bba7920fac6b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359763, "uuid": "fd1dc030-5428-4f46-b1df-9d3a75071f02", "comment": "Malware payload (RedLineStealer)", "value": "4e7c64fcdd545844b34fd2d1f6eb6a39138d6e5245dc400ab51d0c4abff8d57c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359763, "uuid": "0baac0e3-2db5-4e5e-adb8-acfda7d8853e", "comment": "Malware payload (RedLineStealer)", "value": "432086b76b31980f3970c12d558d574d26d4e947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359763, "uuid": "bd80524c-7930-47fa-ac15-1d307464360c", "comment": "Malware payload (RedLineStealer)", "value": "08b6f199223e9f8c2c777ec2f95dac79fd37a512fce961f93d2d51c759bb023e24d3a7c9d535ba437beb2879f67e9b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359763, "uuid": "4cc0708c-b4b4-400b-9de7-c7cf1bfcd0c9", "value": "T19815090FA6B99DD6C6184736C4DDC53286B48E06AD42D75B18D22AA730437EECC0FB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359763, "uuid": "a1b93f64-d0c6-46e0-bac9-d088ba4a6b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359763, "uuid": "ede9ea81-119e-41e8-b216-8f438cd09ecf", "value": "12288:xagXLVbmKyvfLXjvbnz/rl7hQYdjagZa6SRa75KGeFPvMUbePjcBwG2:UgXLVE77jbxKfU1Pj6wG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679359763, "uuid": "63cccf69-9518-40cd-8e37-0d60181910e0", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679359763, "uuid": "9df7c9e4-0a0a-4e74-8e95-519d216f444e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359763, "uuid": "f9e1cca4-329c-4029-8279-4d9e64059cc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27918987-c7b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679382927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382927, "uuid": "9517b8c1-39a5-45bd-b031-1b41c7a4c619", "comment": "Malware payload (RedLineStealer)", "value": "f8e0e6946af017037e8bb4d5455d4e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382927, "uuid": "1650617f-903b-46d5-801a-31649f3e993e", "comment": "Malware payload (RedLineStealer)", "value": "4f8e88f1d2bf0817faa0627fa1c9b92715b13015bf7f38d7fcc6d27a4e511d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382927, "uuid": "a3a465f6-194c-458e-bad0-aefea2e66020", "comment": "Malware payload (RedLineStealer)", "value": "6691a0d551c3991fbe5f18147711e829616099bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382927, "uuid": "e363423d-bff9-4362-b8da-e5af908add67", "comment": "Malware payload (RedLineStealer)", "value": "1c0f90398cbf63a8f72a4f0e1b2e8195820a3316fdde58ed4ffc09d723de8a159c290ef9a877307835d70d73d0cd628c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382927, "uuid": "8ae1b245-e349-41d9-bdef-325b738ac635", "value": "T12F7409887670FD9EC857C47F8A581C24A6636466570BA203B05317ED9A3DB9BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382927, "uuid": "f2f24ff3-f98c-499d-800d-baa4eaddd8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382927, "uuid": "5c2ff9f9-0642-4eba-baf6-5393fe40710a", "value": "6144:/9iSw0wGzCUaIgYH/BwjL4rEwgGCHNUqsVwMS5ZVU3mgswg1st8WDx:/9iOZCUaKHFfVwMS5ZVU3mgswg1st8W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679382927, "uuid": "60af316c-6c3e-45c6-bf1e-fb13bf290288", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679382927, "uuid": "57967736-e200-473b-af18-cebcfb318ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382927, "uuid": "c2f71c70-a08e-4c59-a2ff-7944abdab5d8", "value": "4f8e88f1d2bf0817faa0627fa1c9b92715b13015bf7f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e731917-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384844, "uuid": "4baada40-a7eb-4253-818a-e3b206c07cf6", "comment": "Malware payload", "value": "8078246938d59f48d879c6d0a8db4416", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384844, "uuid": "dfbc3fd7-304a-4ec9-9ac7-db8b0f999ba0", "comment": "Malware payload", "value": "4fc4b99ad6664f7221aacf24369c6e0be89d34a712a17fc3cd63c22666f37b3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384844, "uuid": "1cbc6cdb-bf7a-4f61-889a-d0f94fe5c040", "comment": "Malware payload", "value": "6eefdd5ea166b858e0a7e1658182dc2685c48135", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384844, "uuid": "d5963d9c-8281-4922-b3b8-d431b0703b5c", "comment": "Malware payload", "value": "b9d7e8e150358975f6557c87caeab5a72ee8d756467c01e3187ad559c9e6409e362ee2461be23b15a98bc8b75648f298", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384844, "uuid": "5c5dd014-aac5-4e42-80e8-0153b398a15c", "value": "T100643A61F905D0ABC86798B1F025B2DA1506AB394FA0DEDF5F090C38BE71AE1943536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384844, "uuid": "4d4b6eeb-5c5b-4ca4-b215-010160f2fe13", "value": "7c909d2c1a359d08be876ff2ab33db0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384844, "uuid": "9825c48c-c342-47e1-bc8e-df9bb4192ba0", "value": "6144:3+XVCHEt80q+0i5DSbr0xgusBwzBuOOhq6o++T4keUH7iwLhECk6DGZNEu:O4HEP6o+O4kzH7pLhECONE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384844, "uuid": "a95bdc34-b8f1-4157-82e7-eb567dbb7cbf", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384844, "uuid": "e70472d6-6df1-427a-88df-fc3d563faa6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384844, "uuid": "f0a30dbf-80cb-46dc-bd51-3de3b186a446", "value": "8078246938D59F48D879C6D0A8DB4416.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b72068-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679406871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406871, "uuid": "43f63d33-6572-4365-a0fc-c9e5af5a0b49", "comment": "Malware payload (RemcosRAT)", "value": "718851e3f679d37e670918ffd078961a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406871, "uuid": "7188eedd-0674-42f3-8369-2bb02af8eb99", "comment": "Malware payload (RemcosRAT)", "value": "52062e748f2857bf6bc3161cdfade85ec042d45093673514ca1787f7216a70f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406871, "uuid": "f45ef625-b876-4e7e-a62c-d3f9b75d80cc", "comment": "Malware payload (RemcosRAT)", "value": "9c10c66b026582d97290c470b551d262e86d42a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406871, "uuid": "9cfda3db-50e3-463f-b036-ee173c7ca3c9", "comment": "Malware payload (RemcosRAT)", "value": "8720d7fa2e84eb4b95279fecaca0820f815e4f245767f8df755c54acadd11c959e5cc453aa0871ea891e01da429d4d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406871, "uuid": "2e911efb-1104-4fbe-b6b5-d51bb11eea43", "value": "T16E45227CFB01D752C22D1B7E68B1602083B76F2A4B55E2ED9ECE48E5296270C8594FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406871, "uuid": "5623735b-4536-4879-8003-47d2d57e517c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406871, "uuid": "93488a0f-0d49-4499-b32e-ee84b71663f0", "value": "24576:r1QV+zUQjIdnYfnj349Nt+krzbholb28DMx//CN/k3BRfBZ+:rmszUB4nb63n+lb/DynCN/k3BlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406871, "uuid": "58cdd1c9-0742-4b70-8860-08e4d8f6aeeb", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406871, "uuid": "056ce7d0-bbe8-482a-a7da-c7d6910ef17f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406871, "uuid": "098485f1-b853-47a0-9d9e-6850669d3f85", "value": "New Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716eb029-c790-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1679365871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365871, "uuid": "eeea364b-777f-4f32-9662-212a157071aa", "comment": "Malware payload (OrcusRAT)", "value": "4309184cb5cc16c9d398559f0488664d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365871, "uuid": "2e366556-0e91-4663-8673-9af3dca6b486", "comment": "Malware payload (OrcusRAT)", "value": "5280de06cf2d668bceb7144acfc93125f97344c62891e49c319f5a6da6534789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365871, "uuid": "21f15bb8-6d48-4daf-9030-4403a01a432a", "comment": "Malware payload (OrcusRAT)", "value": "8e9eab97272652afa19b858a8722488388f68968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365871, "uuid": "5bdc7cae-ba74-4099-a006-189d9a6733c5", "comment": "Malware payload (OrcusRAT)", "value": "3d8a3285345da0aa2068f73f6400547d7fd8005976e04f5525994a899390b19179dabf744386af996e940cbe6d76732c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365871, "uuid": "ec16cbc7-6ce5-40c2-a02c-539a07657605", "value": "T16715BF013FACBD07C2BE3679B7731ACA07B8E90A6052FB4E095451AE1D9BB01BD15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365871, "uuid": "156498dc-831c-4424-b72d-059d624544bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365871, "uuid": "3cc95334-d29f-4d99-9466-3fab09b34bd4", "value": "24576:ZVWC4MROxnFj31rkxrrcI0AilFEvxHPNbyooI:ZqMi1JqrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679365871, "uuid": "aa9288dd-be99-47f8-9cd7-19e53f88ea8e", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679365871, "uuid": "2973d6ba-eeee-44d4-9db7-4dc3e0b06779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365871, "uuid": "74619ff4-b6f2-405c-8ca7-0b83e96a5d3d", "value": "EXECUTE_FIRST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b9fb77-c7c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679390055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390055, "uuid": "e2357c5c-6f86-4e2d-88ef-60ce40fb37e5", "comment": "Malware payload (NanoCore)", "value": "702681c442d61dc4a9719bd3e377dc17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390055, "uuid": "be5a98eb-14fb-48bd-962e-54df98a905b0", "comment": "Malware payload (NanoCore)", "value": "540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390055, "uuid": "aa8f1c9a-09e7-42e8-ba50-847cd74a631e", "comment": "Malware payload (NanoCore)", "value": "7d191d6a62e3abdd7d45d5d50fcce0abd421ea9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679390055, "uuid": "c00de116-5a94-4690-8f2d-0711aa858d4d", "comment": "Malware payload (NanoCore)", "value": "3e54d4e9400a9986e94bbd14a4a4b922775824c76a3726706381d420f8826e83101df187e1861a6feb04eb41c6e5fbce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390055, "uuid": "b2c4212c-b36d-422d-8b46-ab231123cea2", "value": "T1C514CF2577A94A2FE2CE86B8711251129378C2E7A8C3F3EF58D455B78B627E507070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390055, "uuid": "53d83709-c7dc-4056-bfbe-a27ef001f4bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390055, "uuid": "c14b97ce-8400-414c-9acd-cf09e9ffa81c", "value": "6144:sLV6Bta6dtJmakIM53n/kAflqT1une7R0s1e2:sLV6Btpmkc/FU5e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679390055, "uuid": "d87ca536-4a8c-4fdc-b72a-1b6a90d30c86", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679390055, "uuid": "416845dc-e76b-4752-8d6d-5a4bb6c3154d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679390055, "uuid": "d4f61777-4d93-4294-8dd1-e59f04961eb1", "value": "EMVSERVER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39433fed-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1679392835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392835, "uuid": "2aa9dea2-b6bb-4b51-b088-6a5a8d745142", "comment": "Malware payload (LummaStealer)", "value": "bbf51befc3845103afe1886b87cb83f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392835, "uuid": "c9603678-3291-483d-99c6-2f24e11dbd7d", "comment": "Malware payload (LummaStealer)", "value": "554dbb9a2d3a6a1ec7059dff09ae50968142b1edfd12114a966b0c940987e212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392835, "uuid": "c326dc00-8377-4b91-a6c8-e12a7c0ac207", "comment": "Malware payload (LummaStealer)", "value": "bb46030f8cb631a931b5a9abc402128dee658df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392835, "uuid": "f77cf90a-6972-478a-845b-2e1bf28577d6", "comment": "Malware payload (LummaStealer)", "value": "6f06de5b11bf56f6ac1b68a49ff1e963c9f3aceb6b3d7ad077e1cad84754907957874d2645076c265b361398d8fb01cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392835, "uuid": "e97e084c-8f49-4df7-9b09-ba42a3563f53", "value": "T1911512029BA0B8A1F51685F38D6DC1B47B0FBD81CE8D6BAD63046F2F48B30A6D5597C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392835, "uuid": "bb38f442-59c8-4a6e-8614-648f7f720c9f", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392835, "uuid": "8860c105-fd40-4b65-b2dd-c82c96fd84de", "value": "24576:3+jKVyjN9tiqrIySjKQ8msZasS8fU3wfi:3WjN9ti2wj8ju8Mgfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392835, "uuid": "855609a4-3b6a-430d-abd7-687cc0f4467b", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392835, "uuid": "40d2a0e8-6fd7-4045-9421-4563642f9ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392835, "uuid": "bbeef856-beb7-436f-b16a-ad8398575dae", "value": "bbf51befc3845103afe1886b87cb83f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70bfcf3-c808-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679417527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417527, "uuid": "8d59d539-07e5-400a-8551-45698ef7c98e", "comment": "Malware payload (RedLineStealer)", "value": "e72241b9538d5beae453794f0254cac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417527, "uuid": "78b117c9-f191-4ae4-b8c1-9f8b447536db", "comment": "Malware payload (RedLineStealer)", "value": "5680e5b13f1438b75f821d18c5c3fecbfae97a3d8de8597e5d23d58673120a16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417527, "uuid": "04b87555-a46b-47b9-927a-ccdec03b5b59", "comment": "Malware payload (RedLineStealer)", "value": "f579d50b10928a2f399083429b076f136ee05f97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679417527, "uuid": "17f415a9-6c49-495d-ab94-cde6770648eb", "comment": "Malware payload (RedLineStealer)", "value": "2748001b932c6fe5dd617e4385c2ff0e236bc659813a1dd7faa900adc7813068e7d5b8227834b825e16d7848c7018d37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417527, "uuid": "5a557c0a-ba50-4952-9b30-b1b3d2dbd768", "value": "T16755D05383A23C85EA158B739E1F86F8B64DF270DE497B6532199E2F14B12B7C263701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417527, "uuid": "75319d16-f70f-4d25-85cf-72454c37a8f6", "value": "a1987c4dfef703391c65547d45eb7acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417527, "uuid": "8c81bc7e-8094-4e62-b059-8b77d339415b", "value": "24576:nhAWkyf2B851faUTBTh3xRhgRY8aTmkrJIsb1ehDmrU9PKgtNFuFM3p2JQj:nxj3FdhaRYDLrJLyq0PK6+q3o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679417527, "uuid": "33303825-280b-4d64-ae5d-8ee3e339d616", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679417527, "uuid": "e40277de-419d-43e5-a5bb-4cb24b14069d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679417527, "uuid": "b9387526-d3a7-4183-8cde-d4365825b74a", "value": "e72241b9538d5beae453794f0254cac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84db619a-c817-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679423885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423885, "uuid": "90800aa6-4e21-41d1-a28a-ce7b13cafb0b", "comment": "Malware payload", "value": "2a3625e3f9229406bc60d111ca7a648c", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423885, "uuid": "37536311-505d-402b-8cef-e190bd38d574", "comment": "Malware payload", "value": "584c7bd597822f806b5fd30ee9c07a9d09f2fd1d9195e462a33656f3778ef1f4", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423885, "uuid": "a1a45d4b-b35a-4019-b54b-2d235661c03c", "comment": "Malware payload", "value": "d37a172c7721e1a8073fe3adfe8427679e1ed543", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423885, "uuid": "2c135dbf-f35f-4336-9354-557e26f41e03", "comment": "Malware payload", "value": "e6a0da12e83fb692a64715d3148bc0ce91a0a02eb4cb33c50df0495bb9ebf3b00dce4e489bf30bf86c16a2decb21cc3a", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423885, "uuid": "be4a196d-4aaa-4f3d-af31-90ec256765e7", "value": "T17675E070F711BD08E96D1A31CE77C28CE725B41853E3C70968843B9F9439349D9B6EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423885, "uuid": "7f2d606b-75a9-4d48-9434-c7f2eaeb8634", "value": "24576:Fw1451SrVD+7AB7L+Kgyrrrriq0BBnl26A6Mlpsglm4xF+XLQJx:Fwe58ekODyKn06JApBU4L+XLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679423885, "uuid": "b5264722-17a2-44a7-a43a-5d277e706727", "value": 1659392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679423885, "uuid": "3c4e53bc-c40f-4990-8760-fa6aba4eb0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423885, "uuid": "61fd7933-7b0d-4cc6-991c-d99cc4862776", "value": "2a3625e3f9229406bc60d111ca7a648c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fdc2d8-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679392720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392720, "uuid": "1961c3f6-dfbc-42cc-ad3a-c8ead7f61e26", "comment": "Malware payload (zgRAT)", "value": "6594b3f3d0776a45e40d5508ec8f1647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392720, "uuid": "128024ed-02cc-4a61-9fc8-bad0c0e96bf1", "comment": "Malware payload (zgRAT)", "value": "592f1c8ff241da2e693160175c6fc4aa460388aabe1553b4b0f029977ce4ad27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392720, "uuid": "83d0175c-6467-4a15-a5ae-0ec2b334a094", "comment": "Malware payload (zgRAT)", "value": "d1d013de46c35bcc2751cc87d90b37f007f9a9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392720, "uuid": "7d6e956a-aae0-406e-b3bb-1c644fa6566e", "comment": "Malware payload (zgRAT)", "value": "7c87e51836bced6b7da4584ebbd7bf0ee7d07691d1f3af942e1ebe64d39e16f75b83f76cbc5de4ea5ca954121f7ea0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392720, "uuid": "24025450-10c3-4895-a891-9ab2901901ee", "value": "T10EF5AEB22293FE92D76F2E6880042A405C2058A7966DD7CCFCC925D75BE5620EF5C7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392720, "uuid": "0d070cdf-8e06-4094-b6a4-14c8e03da6e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392720, "uuid": "c6889960-f35b-4862-a061-20cd8f489768", "value": "49152:GV6K4QqqbMe3dXeMpTfFBmuDuZSEySv+FdtZ4uU/jJg7:GV68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392720, "uuid": "c0d6aa8a-4ee3-4e82-8c89-571a29c6b800", "value": 3483136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392720, "uuid": "5b3c30d9-b1df-4f04-a5c2-9420f76d5a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392720, "uuid": "b4c855c2-3910-421d-b1c0-760e95492488", "value": "6594b3f3d0776a45e40d5508ec8f1647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009b8cf6-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389304, "uuid": "2d020c97-8db3-44d9-9533-25c493fc5609", "comment": "Malware payload (Mirai)", "value": "13aca229d6775cddd8edc7c92a571de3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389304, "uuid": "64e77951-a482-4c41-a9e1-5515e1646162", "comment": "Malware payload (Mirai)", "value": "5a8461200c2da94418083a98e156a3addef5e1e231ded2a3e23560ec0bccd4f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389304, "uuid": "707b27aa-0e78-44d2-ab27-0f61a53b6552", "comment": "Malware payload (Mirai)", "value": "bcb2e600c5105412410d4eba0acec16e1ead37d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389304, "uuid": "af05ec0d-c19e-4ab6-a63e-e443ada757b2", "comment": "Malware payload (Mirai)", "value": "0dbca0c60ee09b96098b48d33c560cebd8dc18479a8d1355d735899ffe1b7678c80190f187a837032f5a32dca121bcea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389304, "uuid": "e514ad56-dd74-4b0a-aa73-5de54d4d6c2c", "value": "T1C2B31A33A61C0B43C49B55F02CB76BF24F69AEA313A611C4A609FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389304, "uuid": "fa695bac-269b-4f32-8850-0410c407ac74", "value": "3072:hgQM4M0fjC7QqsZowd8hOJTmm/QcuLmHniPNb:hgQjM0bC75sZok8hgmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389304, "uuid": "2bc06347-2f3a-497a-8252-62446fdc3c79", "value": 116858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389304, "uuid": "93e2be4a-e6ee-4083-968c-ab9e132f27a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389304, "uuid": "134c33d9-52d3-405c-85b3-0f44489fdb49", "value": "13aca229d6775cddd8edc7c92a571de3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb86a7c-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392653, "uuid": "50cc9965-8d10-4209-8eda-9d975ea0ac53", "comment": "Malware payload (SnakeKeylogger)", "value": "be35dd04185524c015f41d590348eb7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392653, "uuid": "c9bc1d7a-214a-4710-bef5-5b9f20b2427f", "comment": "Malware payload (SnakeKeylogger)", "value": "5a8e8f9efa980cc9f2e722e7ace2b003b428267fb538e088a4e6d479e40aae23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392653, "uuid": "9e24914b-f989-43d8-a7db-95474d7d0d47", "comment": "Malware payload (SnakeKeylogger)", "value": "c34f2ccef519c8531bd887cc85645174b26f4c3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392653, "uuid": "8fdaa778-9947-4b97-a811-765abfe56793", "comment": "Malware payload (SnakeKeylogger)", "value": "6d61646410011cedb57259e0c5c84fba965b7572f7310245fed6f17d3f832ac8f9b40ec9f071867e65202b82e9c61067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392653, "uuid": "d0c1bdcd-b7dc-4578-9cfa-86247e6ff8f4", "value": "T157F4011AB39DE817C2D99574C0C3011417B1990B3B76E6297CCA16460A2E7E6ADCBFCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392653, "uuid": "16a9a71f-3a61-4139-bae4-d6b697989159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392653, "uuid": "1af6f7bf-cd76-416b-80d2-a0796d7dc592", "value": "12288:hUvCCD0lmuARs74BHNwT2QxYcXk84nnv8kVi3AMwfgq7IsMPxjVL90GNiYfoyMM7:a6O0jURQmBnkkbMwD7wdVpNiY5MMMDMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392653, "uuid": "45998ae3-89d8-4580-81dd-1e83c641b85b", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392653, "uuid": "c9298821-632b-458e-8f25-f66d462a667f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392653, "uuid": "9712066f-ede1-4057-afe5-f9e20fe42c24", "value": "Purchase Order 002920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad53316-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679393347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393347, "uuid": "06ffabaa-2d94-4430-bb64-192aa3704ef6", "comment": "Malware payload (SnakeKeylogger)", "value": "26cd2369019e0dcadac5f15401a93c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393347, "uuid": "8ef94797-08fc-4fd8-b431-0b1a5f1de795", "comment": "Malware payload (SnakeKeylogger)", "value": "5ad97cec0cfff89e5357fe1635cc6418784ae83359f3aa2e2031c66c7ba8a1f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393347, "uuid": "12c40714-84dd-41c1-bb42-4dc0ab10e620", "comment": "Malware payload (SnakeKeylogger)", "value": "0971c72a02a61500e2aac7b7f73e74903c64adfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393347, "uuid": "068787fc-399f-46c8-8aa6-39d783cebd1e", "comment": "Malware payload (SnakeKeylogger)", "value": "d0f2ff06d1ffa82641800b40d18d257beadaad6eef2364eb430aed2f17a025b83e13b28fa477cc0839a3e3902ee25c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393347, "uuid": "7d6dbddf-dc9f-44bb-a796-eab1339dcea0", "value": "T1AC358ED1F150C8DAED6B09F1AD2BA53024A7BE9C54A4810C569DBB1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393347, "uuid": "47a7bf51-f641-4b2e-931f-ec1255771a34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393347, "uuid": "ed822fc4-c97e-41c5-a7a7-b6229a6286dd", "value": "12288:bxc8qYMcG64hSGhRCTgY5P+ATUfcqvwUoy/E6gDrHdPgcJ+Z7e3v:FGlqmCTgYR+AoftwUoy/Enpzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393347, "uuid": "ba6420e7-11d9-4ff8-bbe1-7a3a1d76774a", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393347, "uuid": "ad992fa2-b31d-417a-b00f-41ab6f751ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393347, "uuid": "a16a1b97-c357-4cc1-974f-73c3c4026446", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8f184a-c80c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679419256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419256, "uuid": "fe6f6003-ecac-417d-8f5e-3dea27473862", "comment": "Malware payload (Formbook)", "value": "4ff264c2efd8c0bba69030aa6a5fe31e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419256, "uuid": "77cc6c74-0bd9-42ec-ac10-7b1ff25f491e", "comment": "Malware payload (Formbook)", "value": "5b2e65ed209acd3ee8ccb08afa456e4672aae7e3b61760cdf9540cf38ec13994", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419256, "uuid": "336af32f-63ee-486f-a8ba-fadfe2f140fe", "comment": "Malware payload (Formbook)", "value": "67d1da5490277818ee07faaa22c6e0314a80c2ef", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419256, "uuid": "b69e772f-6272-4e5f-bd23-c25c3ef25d33", "comment": "Malware payload (Formbook)", "value": "ed08ee9a5a2e63317d4ff888fe9cf09246eb8b9222f4ea249f98c178f82f813f9ae86641181d96564976ea087dad5ced", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419256, "uuid": "7ed78da5-8d91-4dd6-a207-c15e6a6e85c1", "value": "T116C2D657F79D03B9079511B3621E0AC8EF3EA13E3361549178AC926433ADC2D47BA6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419256, "uuid": "1c6006df-ba9c-40ff-87ab-dd2ac4bc4c02", "value": "768:pFx0XaIsnPRIa4fwJMR6/gj65uwo4CguXl:pf0Xvx3EMRV65Lo4G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679419256, "uuid": "70102dc5-264e-41a0-9fe4-35886801a49b", "value": 27505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679419256, "uuid": "2835a49b-3642-4112-a8c9-675027c0c408", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419256, "uuid": "2f5a0446-1701-4578-80b8-847158890af1", "value": "PROFERT SPA SCANNE..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaba92ad-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679416325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416325, "uuid": "05bd1721-2ed9-4e2a-83f6-fd63239a5b92", "comment": "Malware payload (NanoCore)", "value": "73b4985055e9ef42df1d630218d484c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416325, "uuid": "8bf74f0d-e970-4152-9de0-2c1a0c681529", "comment": "Malware payload (NanoCore)", "value": "5b68e9707ce610dc2f8684699473b677b7d9ee8893d8030716cc091fa8763b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416325, "uuid": "377dd8fd-0d0f-41ec-95d9-07b9886edd26", "comment": "Malware payload (NanoCore)", "value": "e444a3e9f2a2e86afed479d01ad217ecaf17c625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416325, "uuid": "e0e71f3e-8802-4c22-adab-ef30fe3bb946", "comment": "Malware payload (NanoCore)", "value": "3aa0e015140658b233f7c3c0b48dc46121a8541e8fdfb319e123be149a284478737af28c88d84f472058cbdff10e3781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416325, "uuid": "9f62003a-ccf0-402e-9d0c-2207b1d5560a", "value": "T1A704AE1637B84A2FE2DE85B9612202538379C2E3A8C3F3EE28D465B75F567E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416325, "uuid": "b9f2a7e9-5096-4e11-b5bc-8bce755eb227", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416325, "uuid": "936a8621-479e-415f-ab70-4cea642bb7ce", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HILUgSHQkID1wP1e/0:MLV6Bta6dtJmakIM5PwjS17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679416325, "uuid": "168a81b6-5d19-4d81-8141-c6669c985083", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679416325, "uuid": "80d26eac-0c49-4ed9-bf57-9b62830de3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416325, "uuid": "33753547-a354-45f9-baef-885e37394452", "value": "cracksetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7616e2b8-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679405392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405392, "uuid": "5fc4d923-042f-4569-8de0-237966d52fd2", "comment": "Malware payload (Smoke Loader)", "value": "d4a502f59f4673db01acb5ffdb6ea80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405392, "uuid": "e9409a75-c46b-40b4-8011-ee8c84776995", "comment": "Malware payload (Smoke Loader)", "value": "5c4936aa17ee366a15911c3e094a6a1f22b7e114c4f3b0bab932c1060d3a74db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405392, "uuid": "ce44d4fd-17ee-4bd3-b653-dea1ab304b07", "comment": "Malware payload (Smoke Loader)", "value": "652517343e272028cf03419d9c0f5cb5578be2c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405392, "uuid": "85432cd2-6b42-4144-baf2-ce5c9e87e271", "comment": "Malware payload (Smoke Loader)", "value": "459cc521bef3f5ad4c731be4183d088185383ba8e2a094894f3d5f6ab234323bed2eec3b342f37dc1c33fb40535a7fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405392, "uuid": "abd2f580-461a-4e58-937b-0dbb674f7143", "value": "T1A564B55382E27D44EA268B739F1F86F8B64DF2708E497B6532199E2B14B0373C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405392, "uuid": "118c6b65-d1e6-41f3-a697-f473cd205f5b", "value": "86f73ba4a5b0bd6d0633bc10b0ac18f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405392, "uuid": "f4381cee-5e24-47e2-913b-e2117551d235", "value": "6144:DkfBLNb/4H9ZMouLZaCcFJDgejWw4W90:DkfBFQZAazFJDz4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405392, "uuid": "63e7743c-18a0-433e-abbe-17639fecb011", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405392, "uuid": "6750683b-1732-4bd3-89e7-214974e9298a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405392, "uuid": "e3a96b95-8da9-4d85-b1a9-928c253bbef3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99bad20-c7d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679395278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395278, "uuid": "e5637409-080a-4c41-8ede-3dbe36550b4c", "comment": "Malware payload (Loki)", "value": "55aca393f1147b8ad1b2abc5a3c255e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395278, "uuid": "f0d144df-f45b-44d1-9c8f-12d2291040b0", "comment": "Malware payload (Loki)", "value": "5ce7cc92343e4b35138948556755b62597fe7a10de071f0429eba2369a986483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395278, "uuid": "70012884-0a42-4bf9-84b5-6c762df2c1d8", "comment": "Malware payload (Loki)", "value": "e235c78f3f700f91385855b92911a43b75380a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395278, "uuid": "cb944aeb-07f2-45da-9249-3b1c24fa0d54", "comment": "Malware payload (Loki)", "value": "e83ee21369298e5ed993a03f0c94f51505edc6159ca0dbd8af07197ade54436d00c0a796ec1178c6f5e4e776ce56e685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395278, "uuid": "c11839b3-8837-4497-9623-f08b0a2efc09", "value": "T14C048E0356A07861E1628BF15E2AC6F4B61EFCD1CE5D675D33086F1F08B3162C5A6BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395278, "uuid": "a93a9e9e-bc0a-4022-b7ba-9bb25e187357", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395278, "uuid": "d51ff971-b2ad-4d6b-b533-1ba51e5a345e", "value": "3072:ZB13MC9/v5BRNWpPbTqSNTd/zNMqiX0P5Dsopd8amTw1JZ:nmCtJ23qSV4+sopya8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679395278, "uuid": "1bc4e44a-49f5-4bfd-b58b-c8eeab12c860", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679395278, "uuid": "453ca40b-9bc6-49d1-983f-ec6de28f6d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395278, "uuid": "c6ea40c6-8ed1-440d-bcf5-092595453b10", "value": "55aca393f1147b8ad1b2abc5a3c255e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c38bd53-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679364036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364036, "uuid": "27407b50-e548-4b90-8a2a-6d8a0f296330", "comment": "Malware payload (Rhadamanthys)", "value": "2a7aaf0b7ed9af90a111dd74ad9aa1ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364036, "uuid": "5c13ccf2-9a08-4e28-9e2d-494da66e3108", "comment": "Malware payload (Rhadamanthys)", "value": "5db892a52fbebbf0298d3b5b2cf0c3ed7f9612a9d337c56bb168be336d28cadb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364036, "uuid": "0bbb07f7-e10a-49de-9208-4891b28f744a", "comment": "Malware payload (Rhadamanthys)", "value": "562c4849728b795a971d755e0c1af872c73aaaed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364036, "uuid": "c430fe1d-ea52-4b26-9bd4-2d6110e8e7d7", "comment": "Malware payload (Rhadamanthys)", "value": "3b8076cd14527394126feeca17e5816e1ed0c63e77312b1358abceb5568decd509ed659e2a93aaa2e778c2a634018dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364036, "uuid": "6d0c291b-547a-4876-8666-4dc55b9af4c1", "value": "T12704E118B2D1C0B5E99B023158BCCA7729FD3E5B8BB0DA47779C19C75D312B896292C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364036, "uuid": "b5fe6f6d-92a4-4ee3-9379-cf11db9cf045", "value": "f214c5f744673db93dec4b219265fbc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364036, "uuid": "acc60250-7371-47c1-b2c9-76b6799b2203", "value": "3072:bwevYpKTDMDU0fuuE46lC4PQyfHU6Ig4cjnjFRpbll/XbqefxlS3ETgmBN8vqI5L:sevY8m/u3wB4HzlrzPOefxoEBK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364036, "uuid": "747ccde9-ad3f-43d8-a06b-26e0772842d8", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364036, "uuid": "f1a96aaa-bf19-43ac-a694-bec41367f63b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364036, "uuid": "0ed1efc1-a68f-4d3e-9829-96e9c8b8f228", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd924c87-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (MassLogger)", "timestamp": 1679392654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392654, "uuid": "7ee838b3-a55f-43bc-a2e4-ffcdb3caa8c2", "comment": "Malware payload (MassLogger)", "value": "5ca79baddcdfeb79bb4a2779c5a2f0c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392654, "uuid": "38c08a50-02f8-4f38-a568-90856a31370b", "comment": "Malware payload (MassLogger)", "value": "5e46b27a0da622e495de07db892615de8a1d91204b657402f85d1bc0bb00d349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392654, "uuid": "3bd7de29-8343-4fa6-abaf-7a1e83320707", "comment": "Malware payload (MassLogger)", "value": "809e66575bb1fd605fe9798427bfcb345a2f97fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392654, "uuid": "5cc465af-c917-4892-b39a-54f116c64bf0", "comment": "Malware payload (MassLogger)", "value": "2d7fe910e083aa4219794c7469ebf36eacc127a6d3f011d74f878580821ceb94bf79fa453934bbf5a2ad8e1a1a9903c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392654, "uuid": "e1530d66-6361-4d15-902d-49997a892354", "value": "T1193412F46764CAA3FC7687B11A3D86677AF6B8231895AB0F1B502A9D3C74401D69E303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392654, "uuid": "ce3bb315-987a-407b-bcf3-8de6903d9f79", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392654, "uuid": "4f362274-5286-4a12-9aa4-c55ea08fd953", "value": "6144:pYa68XzgUQbyY1KVjGSby6ECh1hzj/0u+wo76NotMLQlnJi:pYOzgoY1Kxtby6EChXP+TztMInA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392654, "uuid": "3577b045-9cb3-4f1c-b691-bd5409d77425", "value": 236587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392654, "uuid": "a3323f6b-8b19-4607-bb4e-a5d862c514c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392654, "uuid": "0fe1df5d-c7af-4c0a-8561-f6faa0c3aaf9", "value": "SHG098765445678.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702e010a-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679393356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393356, "uuid": "50732612-2987-4424-ab28-8fa5389e3b4f", "comment": "Malware payload (Formbook)", "value": "751555f7dc728acf20ae1c0c82bfb49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393356, "uuid": "5804e044-338c-47e4-bd11-47213b004efa", "comment": "Malware payload (Formbook)", "value": "5efbfab2a58f8e0b0c7d135fc020b123234ee1c56d81ecb760b3bae95db34e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393356, "uuid": "d8570352-8d3d-45d7-8071-5871a9211e07", "comment": "Malware payload (Formbook)", "value": "badc9a6e21f7436a87ce59c8c403c8f7238a2c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393356, "uuid": "9d50526b-b54b-43a4-bd58-4ea8e67bd3be", "comment": "Malware payload (Formbook)", "value": "75333d64155594f6ea4fb11e1aa5f5a41d0e02ec493ba05e5987769ffff01d499c949e103a46b1afba761b3139965169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393356, "uuid": "cbab9165-4686-4e5e-ba8d-909d9ba599f2", "value": "T1F874F031774CB4B2CAC13A314DF96AE329D61D2A2A35820E57D0BE4737356F2D90B61E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393356, "uuid": "81195c26-cc70-478b-9cbf-8d5364a4f3d4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393356, "uuid": "c37b26c4-3215-468c-97c1-de4b0eca4785", "value": "6144:8Ya6YMc9O7tXxXD9YF7g/0jOaYXoGk+papuwJAYTmZk:8YmD9wXxT6a0aX1pJLYTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393356, "uuid": "d2e6f52b-cdf3-4ae8-bddf-9c09c92caf2a", "value": 360648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393356, "uuid": "605175d9-4c2b-4311-81df-aaf8f63ae343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393356, "uuid": "50f54d4f-41e6-40bb-bd2c-0bc693c25761", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30be12a-c80e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679420178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679420178, "uuid": "8bf82084-0813-4e1c-9f9b-22f50e5d1d78", "comment": "Malware payload (Amadey)", "value": "6822fac3074bb8c2aa7c5620fadd4343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679420178, "uuid": "0aea5f4e-eb3b-4581-a9dd-845406e40b65", "comment": "Malware payload (Amadey)", "value": "5f3fa200c828bd0e18483a43d1cb7b5ae89451a365dedc6f3c1993f057a1cb19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679420178, "uuid": "57e8d250-c88a-4ae3-976e-e98f00516a22", "comment": "Malware payload (Amadey)", "value": "667a7575660baddef8a75dd0755c51a6341dadba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679420178, "uuid": "5b7081dc-0f77-4874-856c-08c3ce569bc5", "comment": "Malware payload (Amadey)", "value": "be9a688070c15c0074cc94194d516888e789cc38122e8db56bc6bc925477cf65a779607d994c6ae224044426680d135b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679420178, "uuid": "fa5e4ba6-79cf-4ae3-ad9f-3bae686c83c7", "value": "T16655D15383E23D54EA258A739E1EC2F8761DB670DF4D7BA632189E2B14B12B3C173611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679420178, "uuid": "d774909b-bdbd-4239-ad10-507fe663cf7b", "value": "abf9812c144b37aad537ff6f220c83df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679420178, "uuid": "5a1fc0b3-bb3b-413d-9401-d94961d4ec95", "value": "24576:potPC0g7RqtB09YBRwA/IJdqoKs/3eqc56RN0+f/gGrv:pCg7Rb9YLj+LGrsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679420178, "uuid": "e3c9a7fa-eee4-445f-81ec-cfbbc24e2f93", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679420178, "uuid": "871828f8-eedb-492d-b3f3-f66b92cac88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679420178, "uuid": "b7f75ccf-eed4-42f2-96b6-6e9a39897d49", "value": "6822fac3074bb8c2aa7c5620fadd4343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6ed248-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679405565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405565, "uuid": "2f4e9356-a89f-40cc-b7eb-27ac611739f2", "comment": "Malware payload", "value": "ec0c8b6d5a4a3784f72d686649db7313", "object_relation": "md5", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405565, "uuid": "a370bf01-ccfa-48ee-b5c7-0ba52e4007de", "comment": "Malware payload", "value": "5f6c6f15482b852c69d68e3e73426add7a5c85ff50b5dd375f1cbdadd434b9e6", "object_relation": "sha256", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405565, "uuid": "c38222ca-c25e-4f7b-bc9c-d2aa967f75d9", "comment": "Malware payload", "value": "8fe186356e41f25750922213d05805620fa64ae7", "object_relation": "sha1", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405565, "uuid": "d86b2f9d-c049-4779-8b98-a02d55c772c2", "comment": "Malware payload", "value": "b6c6f22e7ab75d0ed64b2bd97fb97a5eb98c18154e44315220110aab23bdd42b32ae3eff6c3cdc01beb83d0bd1f806df", "object_relation": "sha3-384", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405565, "uuid": "9e84c328-5df1-4e1d-b1f6-58d79e4b3a43", "value": "T199B2CF785974C88DC44547341A2F372E6BC8F56242E668DE04B8E2B0B09BCBB7D45A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405565, "uuid": "9cc12cca-c8c5-4096-a0cb-0c3202fee781", "value": "768:hgQRouzcyTgJb+5B2VVmaHsviiv9VXquAN07wFFN:mQR7zG+5sUaHsviS3aaWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405565, "uuid": "87ac2057-9fc8-4ce6-8583-6b55edd5a99e", "value": 25038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405565, "uuid": "8f3baa57-1258-49d6-b34d-2058117db6cc", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405565, "uuid": "ecab43b2-310d-42a3-91ea-9bac6a541c15", "value": "RIMESSA_CASSEGNI21032023-6969.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8419e6c2-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679398973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398973, "uuid": "f1c09a90-a015-4358-be54-a0759e5c04f7", "comment": "Malware payload (AgentTesla)", "value": "d085774c1d0954cc9de2730feb617c3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398973, "uuid": "18fd1393-b0f8-4f3c-921f-a306f10757d3", "comment": "Malware payload (AgentTesla)", "value": "5fc747d77faaedb0459b4e9fb8dbef1912f6fa91ad088a3ec016c749ecd83022", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398973, "uuid": "6294d788-6fed-410d-808d-a11d9867c3ca", "comment": "Malware payload (AgentTesla)", "value": "e045643adddfd15d638f81095f015b912c030604", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398973, "uuid": "b79a4437-40c4-4633-b426-5f318ee25b75", "comment": "Malware payload (AgentTesla)", "value": "88f25934d697eafe9f0e6b4524c240e5a78ed19b51d78f91567e6de7d1ade28cff5ada9024f517eae85e719a94c1992e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398973, "uuid": "84bff78b-e36e-4f97-b37a-3762a051d547", "value": "T1DF854BF25293FEC4972F5D44D0083A409C0018A797BC965CFDC96997B3E95A4EFACAB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398973, "uuid": "311cd1ae-8149-4449-b183-8b874343283e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398973, "uuid": "46d87527-cde7-4630-89ce-7d409da7974f", "value": "24576:dZ8qSa4G6s2ny/v/LtGZsYjot0YV3bLGkWNaBZdTdKOwnymUqsekgUKe0z05t2/C:dRK8rLGs03+tR3+otD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398973, "uuid": "faadd346-318e-4509-a806-21296dc20551", "value": 1747968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398973, "uuid": "d2de0e36-9988-464b-a091-9e5c0cf9ea63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398973, "uuid": "c14a0a98-7357-44e8-8f66-f1c13f6633eb", "value": "d085774c1d0954cc9de2730feb617c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609ac311-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1679391612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391612, "uuid": "0359ed8b-2e98-449c-8590-96b5f7543665", "comment": "Malware payload (Guildma)", "value": "d2fe1655108c20adf94eb55c39fe6d8f", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391612, "uuid": "69c828d5-2a24-4b0c-9940-cd9b22e326f3", "comment": "Malware payload (Guildma)", "value": "61176d7613bb4172728aef39b770ecbffdfb010cb5471268b178914eb0641b89", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391612, "uuid": "e6bf3767-cf3a-4d5c-9951-813a2296dba8", "comment": "Malware payload (Guildma)", "value": "b95cc5605bc1fff607a381acd9368b2861940d09", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391612, "uuid": "524a3719-9f99-460d-b155-2493c37716df", "comment": "Malware payload (Guildma)", "value": "b658b3399deb7bf1dd0f69cc2a614961928aae0c449b1ab6587d86b595f39a596ff85d92a6efd2ef3544799a5b0f0f08", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391612, "uuid": "44751494-2a0e-46b7-9089-d4181b075f74", "value": "T184F0AB8CB072DF92D17C54B6C8426B012C48FA920F4021B289CD03DA86F0E48FA2A6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391612, "uuid": "7d761638-d418-4bf9-8161-9aafbeadf648", "value": "12:8rflM8OBE6ZGFgkvVO0jdTlVL5Ombsem7u9Vd4Fpv5Vd:8loGFFvV/xL5OKm7uPd4X5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391612, "uuid": "b8bfd55d-f4d5-4404-98c4-d0ec2234358f", "value": 485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391612, "uuid": "c110fd5e-c628-4cf4-98f1-e94316fa59a3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391612, "uuid": "51c579ec-aa14-4fb8-9743-0d6d4e8a6619", "value": "27671221_961.42167489.905779.46094.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4527408-c7e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679402893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402893, "uuid": "c57178a2-697f-4191-afcf-2c088a6ae67a", "comment": "Malware payload (AgentTesla)", "value": "303cea223e16a4649cad0d2130262997", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402893, "uuid": "2bc25a0f-fecc-4db1-8a2b-a37a712caac9", "comment": "Malware payload (AgentTesla)", "value": "615b9cfb19070c6aa8ec0f8a80147335bc5b276c135f1fe133544c2de0efe83f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402893, "uuid": "61927028-5db7-400a-83eb-aa72cfc67304", "comment": "Malware payload (AgentTesla)", "value": "2a8b0e7ba4d3868f309bec3f55f5777f6b6fd2cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402893, "uuid": "cd0cae8a-bb2c-4124-8cd5-25aa40bd8fd8", "comment": "Malware payload (AgentTesla)", "value": "a8c2ccb491de8cbbcb9e6324f7f647160cd398439d8e4fb0a1381b90a08994c97a9d643eac8d8188d369fa48499700ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402893, "uuid": "1cfdaf7a-c639-4404-9f73-aa1551239641", "value": "T1AF355B424DBB1196E8BB0F5C547B76880B38E966FDC8503B7CC8B65A4FFA65360063E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402893, "uuid": "bb0975dc-4758-4c34-818b-0e3f35d601d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402893, "uuid": "6984a1f1-9345-4993-a911-faab7bb0a1b5", "value": "24576:IL2cUnY74sbp9gwHSquDtPNCqrCM9obmbk4jN:yUnW4sbP3uRUFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679402893, "uuid": "952cb4d1-54ed-4992-9107-c251644cec00", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679402893, "uuid": "80dc035a-9609-4008-8431-8cd233a2e815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402893, "uuid": "9cb286eb-0d8e-4899-9c23-76e6a3257556", "value": "z50Iowk170GoWzS24q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775f57a8-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679405394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405394, "uuid": "458e9b1b-3202-47a5-96e9-04af8958af29", "comment": "Malware payload (RedLineStealer)", "value": "3e4ec6141136fcfe29a320203260d3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405394, "uuid": "33b9280e-3783-4f4c-a140-3a01b1e7b8fb", "comment": "Malware payload (RedLineStealer)", "value": "61637284a377f83960494bbda72d9a6990efb7ca0b770e7c0678a0c500c82b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405394, "uuid": "28f0e474-46b0-4c25-98ca-9ebc8c0aaa13", "comment": "Malware payload (RedLineStealer)", "value": "d45275874fb5cedc1d2f86719f6f07cae6649183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405394, "uuid": "d3bc79e7-ff65-4e49-9cf2-e7c2b10e754f", "comment": "Malware payload (RedLineStealer)", "value": "98e74da12bfe832f1881ef0f855d191a5558f255ded3fd3d265a4a00e7a7a8a24a49771b336258c870a9c6d558175ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405394, "uuid": "4c24b795-1947-4da3-935b-255b0e70c8d5", "value": "T1D4352383F7D94072D9B427B18CB70BC306327C529DB897AB2B06A81E1CB17A17975357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405394, "uuid": "2a421e58-d630-41ba-8bcf-fc6c37f58d13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405394, "uuid": "9c0ff4e9-d4e6-4402-8d9e-dc7fb7513810", "value": "24576:tyVb7FAOvAygeISwbaEFAVkDOls+/69C4v6s7PkosjD+:I57YvNgkDSJ69VvrDkosj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405394, "uuid": "a3a9c916-ac40-437b-b4ba-658792cc446c", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405394, "uuid": "dcc99e4c-e19f-4aae-94fe-aca988906304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405394, "uuid": "acdc9d24-4891-420f-964c-fdd0443e5bf8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81562fce-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362461, "uuid": "2a610084-4263-4aa5-a234-42ac4139f4b8", "comment": "Malware payload (Smoke Loader)", "value": "2a236aef0c1084668ad33b92002588ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362461, "uuid": "e29df87c-4934-4944-b1bb-f73e242c50bb", "comment": "Malware payload (Smoke Loader)", "value": "6186e7fa3b6101df3ee4a721a5f5b8609f90dd8d39159a501c91a485ca406d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362461, "uuid": "bf5a07e1-b682-4b06-8002-d9cbb3a1ee5d", "comment": "Malware payload (Smoke Loader)", "value": "0307db9045cce9f2c216f4a342ef85ab4888abb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362461, "uuid": "21268114-6de3-4720-b8ab-70a0591a4d2b", "comment": "Malware payload (Smoke Loader)", "value": "69bcbed9aa6d752623e891516d5292e137dd1ee1d72410c8a50f4a86328b23d7e12fea46aa6756b5507769ef63b2dd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362461, "uuid": "c38c4e9c-da52-4e4b-96c8-13230b2beaa6", "value": "T1DD048D235AE16851F513CAF25E2EC2F4B60EB8D1CE5D676E32086E2F08B3161C5667D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362461, "uuid": "4a5793c9-34bd-4fd2-8c1c-fd9f5578c26d", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362461, "uuid": "4fbfd075-761f-4bf5-b536-5f50583f2f81", "value": "3072:C/pCg8R8j2JGWTClVWvVkNVSgsl4cuXPftU04M9S8fCIjSpx4Z:lg8CMY+VCsldcqHz8fCBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362461, "uuid": "b632bbb9-3ab0-41de-8c2a-39f2c0a9b5d8", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362461, "uuid": "3f91b0f3-4225-4f2a-8eef-331660ddb492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362461, "uuid": "a9c9df6a-9fce-4959-8929-1b7f210fe315", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d96ad4-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679393495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393495, "uuid": "fccb3309-feaf-4370-8954-65c4542daec9", "comment": "Malware payload (AsyncRAT)", "value": "69217e37a891c3aa3c9ccb9d115ef51d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393495, "uuid": "508476ed-7205-479e-9f47-35117a5ae459", "comment": "Malware payload (AsyncRAT)", "value": "621192a2ddec59e4abc0239e7d091535acfc98ceb60fd38069fae06af9af8d67", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393495, "uuid": "9f3f26ae-66da-4fd1-8975-b9883f1198c2", "comment": "Malware payload (AsyncRAT)", "value": "9d16ee0f7e6af6fc2f6bf5b1a4871d7f74eefac5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393495, "uuid": "97ccf5aa-4436-403b-af3c-e53dd3b32d8d", "comment": "Malware payload (AsyncRAT)", "value": "704328a1c5c4fdd66b63c3ba6080c33e2865854e0c2bd02b3f06a020d232bc4abaa18d77f98a982df80f5f770afc7c61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393495, "uuid": "2fb532b6-63ef-45ca-924f-b5a80281c919", "value": "T167035A2BAEA76CB1D80845490EF60E6DDC797E3B55B150BB5D8D86E06EC204C3DC98F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393495, "uuid": "617f0221-fd2f-4d91-a1db-7da00df144f8", "value": "384:XIIIIIIIIIIIeIIIIIIIIIII2GIIIIIIIIIIIlIIIIIIIIIII6eYIIIIIIIIIIIj:pTi+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393495, "uuid": "d90b1bb9-d1a7-49f2-bea0-d8e7f3bde167", "value": 38454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393495, "uuid": "12d304e6-80e0-4565-8de9-5f0334a7e9ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393495, "uuid": "05b708e8-555d-420d-8479-9f416f8ee3b6", "value": "Statment 493605426.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18785e2-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679389681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389681, "uuid": "5ea6c6dd-16aa-4f27-8164-7ab27d185bba", "comment": "Malware payload (RedLineStealer)", "value": "eb6f4c38c941b900f61f09028bc34c67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389681, "uuid": "f3447e1b-01dc-44c1-be9a-01906eea3db2", "comment": "Malware payload (RedLineStealer)", "value": "627b68487de96c7bd1aa1a6f89aafc1497005352f59c842839da16fc3adf2fb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389681, "uuid": "3ccf8cca-85c5-4f6c-a409-1a74c8c05d2d", "comment": "Malware payload (RedLineStealer)", "value": "925184206ffe92c3e61063327e7e46bbbe2894e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389681, "uuid": "e58c482b-3946-45bb-ac33-aace97bb3966", "comment": "Malware payload (RedLineStealer)", "value": "f7fb376ecc35b705e74f6b0e4fb10337e3aa7db9f6741e2e043deb8ed1b789f0778a5134b7ecce739e7d2f369006502c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389681, "uuid": "0282a9e3-01fd-41be-8b28-1c97172d1c7c", "value": "T11B45021347F2BD55D7268B369E1F82F8B60EF5704E282FA532295B1F11B42B3D263612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389681, "uuid": "50897dc1-0000-406c-8310-4172a143dfb9", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389681, "uuid": "b7c55c81-8e31-46e5-9eaf-0ddecf871fc4", "value": "24576:5kelb42zRjy9IredilsAVM4uU4zCuTMI4iWqbInGHpV:5WkRbrewls8SU41YKbCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389681, "uuid": "6e9fb2e8-dd34-4d39-86e3-6d2c1c2310e5", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389681, "uuid": "40e5b706-fd0d-44b1-b4a4-dbe52df00528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389681, "uuid": "8f1e1d05-ecb4-47d6-87c6-0e140fcbf00f", "value": "eb6f4c38c941b900f61f09028bc34c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610db896-c80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679418671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418671, "uuid": "46dc6d0b-04aa-416b-897f-6d09b6356bae", "comment": "Malware payload", "value": "aab56745dfab4960b5d1865e4634e375", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418671, "uuid": "3c865d86-31a6-4223-982b-100ae4f2ae4c", "comment": "Malware payload", "value": "62fbacc70c7b00faaf1f5a0a77e414d404137f5a1ef2d23ed14382eed130795a", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418671, "uuid": "6c0b1d04-88d1-48c0-b156-bd6c2c6529cd", "comment": "Malware payload", "value": "c3cbe021981d37696fe5aa8d572686ace7315210", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418671, "uuid": "338b9bd6-e7b0-4ce8-a61f-c8dde2efd832", "comment": "Malware payload", "value": "8c1c53b232c4969624dea84b0f9bfff9bf5576a26a7451144c43850ac0445bceaf2fd9c5b1c51a2c07f1a7efd8651a60", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418671, "uuid": "f373766b-e00f-4aec-bbc0-a69c13ca9e6a", "value": "T157562947F85051A8C1EDD230CA669262BA717C884B3473D33F60F7B82B76BD46AB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418671, "uuid": "3ff1b540-4a6a-4aba-8ee8-67ff37e52f07", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418671, "uuid": "e0c99757-cce8-4398-b7d5-c883bf6846fa", "value": "49152:uTDUVe5WZP3cm9rb/TNvO90d7HjmAFd4A64nsfJepEiGRry5N+bdMVKMjSMLDqQE:s03c2gg5NENyndLEMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679418671, "uuid": "7a140436-faa7-4e99-809b-3d9deca5eb97", "value": 6209024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679418671, "uuid": "c84a47b4-cb85-42d0-ada3-16642c22e0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418671, "uuid": "d70fcb1d-9570-457f-b700-4a9f267e18ea", "value": "dosia_app_windows_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5d1044-c78e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679364921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364921, "uuid": "169cee59-ef30-40cf-8d69-edb33234b59d", "comment": "Malware payload", "value": "f427d39b88826ca90461861f5528e6d7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364921, "uuid": "56eda5c7-08ed-4ff6-b571-e2f1925af36e", "comment": "Malware payload", "value": "63141fd14148ff8e6bf8f9bde95a84af28f1bec69c94c4d9442972bdffad6c92", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364921, "uuid": "dad8faf0-15ea-41ed-9072-031dd6869d85", "comment": "Malware payload", "value": "e4bb8b13131801a81880bbb34d684176abfbc425", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364921, "uuid": "7c472a5f-17d1-48bf-ae33-9cd38c8445c7", "comment": "Malware payload", "value": "8c24b81175558748c5e8a8f053bd7474441ef3b99872ec42d179ee7853d968f11060a1b8e3205429fa4a84ffc6994e43", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364921, "uuid": "5619ee00-77d8-4c4b-a720-13595dfb7d94", "value": "T19EB6128AF769DA2FC4B73072089A6631525B4D168B839787684C3F1C38B75E80F5DBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364921, "uuid": "361565de-f9b2-404a-a07d-65608ee9b036", "value": "196608:0I6udiAl5Jhui8hQHRdbuz55ykgXEIQg5HQUuq7be86EePBBLi3i4Y:ZXHl5JDnHavyDfhuq7bR6EePBBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364921, "uuid": "00977833-3415-40ed-8633-c5d41f73fc99", "value": 11181622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364921, "uuid": "ddea45ca-26f0-47a0-88c5-ebe06f109d38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364921, "uuid": "b2a71052-8a71-4b63-8941-17829933b4d3", "value": "Update-8.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf6fb2d-c7d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679396679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396679, "uuid": "7f5c36a2-d163-44c5-a545-a6146b2fbc1a", "comment": "Malware payload (Gozi)", "value": "5e3679f687797e3bdf5534b64a5219ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396679, "uuid": "b5f02252-cd39-4014-b0a9-9efb425765d5", "comment": "Malware payload (Gozi)", "value": "646ab5eb6224824f04f4b78b80f47e2b7251c8ad9af55d806f7a016403f2fa45", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396679, "uuid": "13bf7c53-3298-46c1-8ea9-b57ceb04829e", "comment": "Malware payload (Gozi)", "value": "e2b6875ed9b55f75db73dfb0cc55477ab9bd0345", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396679, "uuid": "1ff00c05-1fc0-44cc-ae7c-8f1c23e303ce", "comment": "Malware payload (Gozi)", "value": "82577ddf637acb1f1b0097699a239860418d686fbcf2f20679526b97976ddf268d73031d1a55a90d322a3f7c19c5d149", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396679, "uuid": "100d42d8-4925-496b-bc60-8f2dbeaf4f20", "value": "T1DF33AF577AE640B1C7E745B2672C7BA8A7F98B20523961809B1498CD1F8880FF27D3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396679, "uuid": "7c83e874-e594-4eb0-b2c1-472b94c56c02", "value": "1536:3+Jqy7X7/0YOq6bTdtGpRJc5dMbD1Gcq:gqy3V6bTdIgdMX1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679396679, "uuid": "e8be407b-a350-4207-9d1d-a26a0e88dc68", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679396679, "uuid": "155fcd46-e34a-4b78-9e77-3e075f9f03e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396679, "uuid": "a2525d6a-ba80-4c4b-8c00-9786bb71484d", "value": "unpacked_gozi_sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca852ca7-c7f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679408111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408111, "uuid": "b8a81b27-da4e-4d7a-8683-9265b8cec7ad", "comment": "Malware payload", "value": "e127d634c99a20f73166937d71b2e94d", "object_relation": "md5", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408111, "uuid": "c21b4e33-4687-4250-87fd-7e76e3769051", "comment": "Malware payload", "value": "64711984f0f1bc542b7800e41666e2ca9c06f12b22d9040dedc4850eb131f959", "object_relation": "sha256", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408111, "uuid": "da5dc734-94a7-4ff4-a903-9a30564a1e90", "comment": "Malware payload", "value": "81a0d053530d486003f4a57295f92f29cd13c358", "object_relation": "sha1", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408111, "uuid": "e1a227e9-9dec-4d6a-a245-3dd4d722bc41", "comment": "Malware payload", "value": "c8f2f7a9694f437ec0714150e3120b33ad054a274bebdaf2e32722e9cdf1992ff57f75eb3a32f7f5d4bc31689704fb15", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408111, "uuid": "c24503a7-4733-4ffb-a0b1-7370c0ad5ec6", "value": "T10B012B116F29EA4C471149513C5CE898AA3423BDA639EED4B2C35C24D519AD533B375C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408111, "uuid": "050b9a64-d3b4-4a7e-8efc-82f344069cbd", "value": "12:XS7HLgyacwVwQEKIKF2J8mzLgyacwVwQEKIKF2LAzLgyacwVwQEKIKF25AzLgyaF:iTLDwOQEKIKF2JlzLDwOQEKIKF2LAzLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679408111, "uuid": "4fa7ecf3-ab17-4518-97cb-802550f45531", "value": 684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679408111, "uuid": "7ece2617-a364-4081-aae3-57ba2de3978e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408111, "uuid": "0ebc4bfa-f641-4df1-a5c1-c455b804b670", "value": "zdcHzAXK.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0410aed1-c7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679374277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374277, "uuid": "84295aaf-ffd8-4d6d-8b8c-3a36ea674c74", "comment": "Malware payload (Chaos)", "value": "a22b913df0a1c94854c39590febc51e5", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374277, "uuid": "2b8e5d21-867c-4723-a858-bf9986ec1531", "comment": "Malware payload (Chaos)", "value": "64a1077ebeaa3008da1068c71dfd6e148d5dafd4e3aefec858cd29efa7b0030a", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374277, "uuid": "8aa68b00-19e6-4175-a4f8-d98c9e443fa5", "comment": "Malware payload (Chaos)", "value": "4ae2e400e634abaa15b3930f0d575ffb72b74495", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374277, "uuid": "3e1456bf-7c5b-4e22-9fc6-dd0fbd3adfdc", "comment": "Malware payload (Chaos)", "value": "ea184be1f67e329c631037b58654331e8dfcbbe1053ed3ab07072b9058ea75d68bf708e53897ea4ea697fd8b0f7fc12a", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374277, "uuid": "a9dd0933-22e8-4e8f-9a21-9d58abbf5233", "value": "T1B4B2D51867FA4A38FAFB1F7C2DB210515775B956EC3DCB4D188A008D0D22B9C8D61BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374277, "uuid": "76acbf8e-3d2d-4cd3-9e43-2860ad0bbe6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374277, "uuid": "b736d568-890e-49d4-894e-9bb7e573b520", "value": "384:GZMg/bqo2mcxtivpgDKF+98AJ1r91CE2Oxb5set:Wqo2ptMpgDKNo1r952OxbSet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679374277, "uuid": "b1e8f2e7-7117-494a-a2d0-1358e51f6fe2", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679374277, "uuid": "d0e019f3-080c-4049-aaa7-44e823bad4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374277, "uuid": "bec4b332-6f9e-4bbb-8572-128a91fc4adb", "value": "2023-03-20_a22b913df0a1c94854c39590febc51e5_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfcb8ed-c7b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679382343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382343, "uuid": "cd225938-77c6-4122-835d-5462266e5bc7", "comment": "Malware payload (Formbook)", "value": "771508cf2751f6dabe05758e4fa25fdf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382343, "uuid": "6666f9a0-9a9f-48b0-a69d-f035ace74834", "comment": "Malware payload (Formbook)", "value": "652948efee89fdc5c6d3dc7f65a16aafabd0d224c9fcd55e5f86573f1b2c4aa1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382343, "uuid": "72d9ecf5-644b-4dd5-946b-3c0d0471dcfe", "comment": "Malware payload (Formbook)", "value": "f6d7d33b6a340d2c370ca31a6f9677a2e5306486", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382343, "uuid": "daf0afa4-e03d-4315-b4d7-3011279bc07e", "comment": "Malware payload (Formbook)", "value": "07c55dd9e29333cb8b9d83ced53df2c3089a33585a76f360232bf177d12b770f810911bc682576ca92a98bdd540851c3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382343, "uuid": "5ef827f6-366b-45af-a592-1346068c723c", "value": "T16944124847E4E0BFE4A246701DFA62BA5BF4B52E9475410B63C02B697E726B15F0F332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382343, "uuid": "9c28923f-2d35-4e38-8053-6fa245f7d27b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382343, "uuid": "831fbe57-c955-47bf-8a50-e50777225ea6", "value": "6144:/Ya6h4vRbB2TXukTFPqjpsaKncVt9l7GmmEE09z:/Yb4vRbB2Ldgjua2cplymmEE09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679382343, "uuid": "4ebe3cdb-178d-4b84-9eac-a783ed181954", "value": 255238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679382343, "uuid": "5cdefd24-6124-4f5c-b641-0153c3ee4a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382343, "uuid": "f6c2541d-6449-43f3-9e95-98d3d476454a", "value": "DHL Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aaebb4-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679397686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397686, "uuid": "a37ddbfb-4f88-474e-8a6f-c8bd9c8991f1", "comment": "Malware payload", "value": "2d6cdddecf19beacc7834e57a53677f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397686, "uuid": "b81ec7a8-f460-4854-8b12-ad4467a1ed47", "comment": "Malware payload", "value": "65359db484b7dfd06a20d4efad49bc53efa394de91ee88b3e42d337f57db644d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397686, "uuid": "e0b16eec-6472-4427-b1a8-ca6860fd3e80", "comment": "Malware payload", "value": "bf321690c587ed97637849f2556ccb85f6ff7ef8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397686, "uuid": "0e88650f-8b8d-4618-877c-12434275c9e3", "comment": "Malware payload", "value": "5550110e7166782222f8ec04209009eb58874055a9a45df7a02221b9b16b9f4d728cd1393b4a077bdcd01c906d308bbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397686, "uuid": "be398a45-d6c5-4652-be97-6c64992b6e04", "value": "T1892395608A42207B2A476FE7162E5000867D6F664E85B12BB5DD7203EFCF58CC6F4EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397686, "uuid": "968683cc-b95d-44c5-bba9-bc01527b105b", "value": "768:8ONXdHoZGjRQSJcoYHiNw5rfnRNAW0LKAypP+2riARrAB1y+h6ygG9lKjnJMN0sS:LNHBjKh5LfQt1y+1KjnJKa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397686, "uuid": "bfdf7ff3-6c40-4eb1-9bc3-9d08045303fd", "value": 45659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397686, "uuid": "dc8a0fdb-ad7c-4a02-82f5-2504b728aaf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397686, "uuid": "7fd1ac7f-958d-4026-a23e-a16ffb5a2a7a", "value": "siG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5540a6-c7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679373920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373920, "uuid": "4f969eb8-7494-4f89-9e34-af170947415e", "comment": "Malware payload (NanoCore)", "value": "caa35d8656af01b746c1b48efc5a4c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373920, "uuid": "65f2cb6a-c013-4d70-8e5e-7f66b8d92e19", "comment": "Malware payload (NanoCore)", "value": "65aea62e82a1406b5c58fc887e3ee42221d0c81e4ea8a2e5d99ea9ce46c3e47b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373920, "uuid": "dd95b3e3-b433-48ad-96d0-9196d9e7d416", "comment": "Malware payload (NanoCore)", "value": "02e442710e327249716dd8b4be9321081e7b4fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679373920, "uuid": "ce72fd68-209b-4641-a5fc-03d47ca785b6", "comment": "Malware payload (NanoCore)", "value": "a9a24d0f01d5508103ecd73fd4aec961941c9dd74134e8f2f542361f663fb69cfb075ac502fa44be61d151302254c506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373920, "uuid": "cbe7b8b7-7d8e-467c-aa97-f03534001914", "value": "T19844839C726072DFC85BD472DEA81DA4EB6178BB830B9203942725ED9E1D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373920, "uuid": "c2878a0a-b51b-410b-95c5-5e75e30f7604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373920, "uuid": "3a923636-44d8-4be8-bc5a-bc6092def9d3", "value": "6144:b1pXaTw4V4g8veSMEh6i64HQPAUDbjuCcGLYiO5C3e6s7338vS:nXYw4qg8veSMEh6i64HQPAU6uYiOS1kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679373920, "uuid": "d26700fa-4346-4419-b6a9-cc6dcbccc237", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679373920, "uuid": "afaa14ff-2135-4436-b8b4-90f14200c291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679373920, "uuid": "4db6b5be-23cf-4132-8e9d-57dc1466b9dc", "value": "65AEA62E82A1406B5C58FC887E3EE42221D0C81E4EA8A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a6af14-c7bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679386089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386089, "uuid": "560d70ab-bccf-452a-b3e6-a31888744659", "comment": "Malware payload (Formbook)", "value": "f296a60e1568722b060de70b46357fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386089, "uuid": "88afbe43-0149-4808-b738-b987964aec5a", "comment": "Malware payload (Formbook)", "value": "661f40c3448fa2acbddfd8297c54733b9f2d9c71e15506a4fba876a25d279e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386089, "uuid": "38b2022b-4811-4f02-982c-1f9021329869", "comment": "Malware payload (Formbook)", "value": "e24c65bd02d435c6b5705e9a01442e0447b77e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386089, "uuid": "8294e05b-ef6b-4534-a253-e5deba6205cb", "comment": "Malware payload (Formbook)", "value": "68d0304872b43abf93f58e491469a0257874a16884af61226bacf8e695c18db8d1b7d7f5a782b400daf52539c131f8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386089, "uuid": "0dbdad52-854a-43d7-804a-9b456889f371", "value": "T1BFE429707BF89717C5BF6B72E0B9B25847B4D466A216E78B844D52F10CD2340AC1A3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386089, "uuid": "c01e94b7-28e8-4576-8d75-9997ed4dcbda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386089, "uuid": "8e869923-bed8-462a-abbf-899723cd3f57", "value": "12288:xTyShIKgMyx0SA4sZm4hGFJ4eCPBh+C3:xxhI+zSAdI2GFJ4Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679386089, "uuid": "e1a4587d-e862-4db4-a902-0eace929cea2", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679386089, "uuid": "6db3e6e8-fa9b-4393-a0dc-0b6f9b89cc1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386089, "uuid": "f786c9f3-d76a-49c5-a0fd-8c870b9c70f1", "value": "SC_0017384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659dc0b0-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679392480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392480, "uuid": "23666ac6-e8cf-4b61-82a7-851843c33661", "comment": "Malware payload", "value": "f70358c0f33c793ff763f36ab0f94d89", "object_relation": "md5", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392480, "uuid": "db902616-0e55-431e-b59f-0494db54303a", "comment": "Malware payload", "value": "66a73b1b3b51a1c6a56db2d20cff9af3d1362b989989b5d9543d2e9b92ac9a3d", "object_relation": "sha256", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392480, "uuid": "fc103963-d871-44b2-9f2d-1fb827bc8a89", "comment": "Malware payload", "value": "3aba103f2d243af44c0ab715956d2c0d0a9a58d8", "object_relation": "sha1", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392480, "uuid": "d5ea2f72-47cf-4742-95e0-fcd2b7978a96", "comment": "Malware payload", "value": "650376da4b685f2fedd11c346d9e9cc38227e41c51f24fdc7e3c90508ac17537b1935f784448c2532e4477b13b5e122e", "object_relation": "sha3-384", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392480, "uuid": "ede1d7c1-d89a-46a1-aa74-f8e06254765e", "value": "T16B93C30367068051F3591BB21466E7E696BAAD3A07A5A6EFE3747F760C30183DA3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392480, "uuid": "da424a50-752c-4a71-9c1a-db1738492f0b", "value": "c1ca1f9ac695c5c8d553144626b992d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392480, "uuid": "10da0b9f-8938-445c-836b-50076ec3efdd", "value": "1536:2lsl4TOYh5dJgZcGOwFQ0HoWkwN2K6O2OFkxBuke:2y4yYde7by0He3OFkxBuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392480, "uuid": "89360ff4-a7a5-4d8f-8856-d529214b5b00", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392480, "uuid": "8e365ca0-8eb3-482a-8a88-908410683891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392480, "uuid": "7da618ea-beb9-47fd-b23a-9f4b06487c8b", "value": "66a73b1b3b51a1c6a56db2d20cff9af3d1362b989989b5d9543d2e9b92ac9a3d(exe,jjwappconsole.com,2023-03-16 135336)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da834e5-c7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679404116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404116, "uuid": "104076f6-bb07-40d1-96d5-1dc343610f2d", "comment": "Malware payload (Formbook)", "value": "b3c87476205dddb0116e65ea556c0162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404116, "uuid": "ea0e86b2-773b-4c84-8de3-8bbdb2368820", "comment": "Malware payload (Formbook)", "value": "66cb83b03a810acbd9b08071efcfb055b272da2df721695fc22624c6bb6cadd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404116, "uuid": "1f130349-71d4-482e-a564-534952a8945d", "comment": "Malware payload (Formbook)", "value": "925aef2b8e7666f04fb06c2de30aae3445ee929f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404116, "uuid": "c9e44622-bc7d-453e-ab86-60d7aec43e8e", "comment": "Malware payload (Formbook)", "value": "b1f4d123f5a5f1f16b9b4643058aa27ef26f5756e7aebac4ab95c59027fb8c7c1b5e8bb23510c74948654b8f356dad89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404116, "uuid": "75735d02-1eba-45dd-936a-f31dbb1b008f", "value": "T13844123837F0E053D82353711DBADB192971E7222C6197AB37A06E1A3E62255DD0F35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404116, "uuid": "b61bc570-fda4-44d9-9269-29e5f306c521", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404116, "uuid": "583b1d47-3f6b-4883-84ce-096a969671e3", "value": "6144:PYa6BCwFRtYQ88xkN8Q1UMbyBloNkxF5UDn+oNZdTM5:PYrrLtJ8I4xpNkxF5kn+IPA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679404116, "uuid": "d63f3e69-394a-4e00-97d6-bac280a538ef", "value": 255086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679404116, "uuid": "62438352-646e-466f-a020-b529fc3dbadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404116, "uuid": "6912d66a-d43b-4318-8b54-ba88ea99578c", "value": "rReferenceNotice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f94d6c-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389311, "uuid": "2df06a93-bb8c-4aac-b619-f6184c135650", "comment": "Malware payload (Mirai)", "value": "ace320259c780d5df2e0a9838314bd81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389311, "uuid": "98f8b3cc-e9c4-4f8e-904b-8f26e885a3b6", "comment": "Malware payload (Mirai)", "value": "67faf51003dc0673a29b7ab0c2ae543dede92da783268ed5a118cb18f7a69baf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389311, "uuid": "6185ed5d-6efd-4f5b-a721-db0c074256d3", "comment": "Malware payload (Mirai)", "value": "8e4b789b18e4fce265cbec00d1ded69dd7a4d4a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389311, "uuid": "6001ea68-96df-41cb-9b4e-eaf1082067e1", "comment": "Malware payload (Mirai)", "value": "1d54ebbdfba7d6a1c6bf4239fb2b0a771e1cf98df47cdfbc64db956e15076a08b9ba0363164306a26c3812a14a44762d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389311, "uuid": "5c78209e-0767-4080-bca0-608ee98a0fc9", "value": "T1D0B31977A4655F73C041A5F125BA9E310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389311, "uuid": "8a6baf31-b53a-47cb-8f96-dedece10e375", "value": "3072:UD1LS+zrTiX7RIJpdP6+nmH1cuEgvniuN/:UD1++zrI2xP6+nmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389311, "uuid": "b3dd1efc-4caf-489f-aa3c-06e160f3ea8c", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389311, "uuid": "fe7cbc94-9b7b-4518-9802-07d531b2ac5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389311, "uuid": "7ba2ac59-0745-4e02-9209-53d5c0881aad", "value": "ace320259c780d5df2e0a9838314bd81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1d0648-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679405401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405401, "uuid": "1cb797cb-b740-4330-bc0f-2f3061f86c2e", "comment": "Malware payload (RedLineStealer)", "value": "77d4f243f50b304206f181e511a37e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405401, "uuid": "3f608cd6-88ba-46d7-a26d-b86943fd2bfc", "comment": "Malware payload (RedLineStealer)", "value": "683d8c3d82966d880d42cc8472ef8b96b1cd476fbb2feebf6c5f07af15a666a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405401, "uuid": "12d2a9c8-5b7d-4124-85c2-7dad86985a82", "comment": "Malware payload (RedLineStealer)", "value": "91b9d9c1f6e970820ab424f76380aec3a83528af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405401, "uuid": "25c412a0-4bde-459a-add5-644a9549ed99", "comment": "Malware payload (RedLineStealer)", "value": "6920b51ac994fe60588267a613f66099053e8d0c2a7652d9332cb899cf7303ac897f8fd19d2a2888ec9636a848528d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405401, "uuid": "e373c9d9-aba2-4774-848b-8746a2e5fa79", "value": "T10C440795E0FEE9B3C211C03DA468EE861D2C22859870D53DDDBBA6C90633AEED4D4DC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405401, "uuid": "d602955b-94a0-41c3-b91a-473cf654b235", "value": "f553b8ac04465266a97d8a15318f0208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405401, "uuid": "a6c15126-daab-47c9-98d9-0763b7cecb88", "value": "3072:+dMxd2VPsyTIjw5fygppMQIue2vVrUPOjSjvMYbNjCivm4Eiw6gas:tT2VWjsfygppMQje26dbbp5vm4qPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405401, "uuid": "d19f9853-fff4-48af-8710-316af1bf44b5", "value": 256952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405401, "uuid": "dca4dd90-9c58-42c1-b9a2-0efc72c834f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405401, "uuid": "577db7aa-e4ac-4729-9401-3b3554a10192", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43109fd1-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362357, "uuid": "6fb78d66-39c2-4f18-9b21-c690bfa4d2ee", "comment": "Malware payload (Smoke Loader)", "value": "15c3ad7d20547cd15d2f640ba40bc921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362357, "uuid": "37b8cdbf-20d7-4b71-b454-9e2eb0e51ff7", "comment": "Malware payload (Smoke Loader)", "value": "68a2fdeaa58986a4c6d274bb1f5c921c7fc799a267666c2557854174d967a5e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362357, "uuid": "f0d0fc00-5102-4803-9eb5-d736e088d105", "comment": "Malware payload (Smoke Loader)", "value": "61ce3ace7f3eb875ba6ca546b23fee384741b5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362357, "uuid": "2a31537b-6924-4849-871f-88f15fb0f27a", "comment": "Malware payload (Smoke Loader)", "value": "4936fe0fc6463f9d59e191737bba206e449dc6004940fb06e9462a3fc2a77bb5c3c215b8e03ced17132ae521a38789ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362357, "uuid": "aa3ea7c1-abdf-49d1-9e64-5f94dfecf093", "value": "T156048E139AA07C65E522CBF18E2EC1F47A0EFDD1CE5D676E22046E1F0873262C5A67D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362357, "uuid": "1994c4bd-358f-49b9-a5c8-ba3b5bea3ca1", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362357, "uuid": "ac1ecbaf-eaa6-4eda-9ef4-d6ae578baecd", "value": "1536:I7RvopqoQdEoGxSyPcYgReBJPskwNWrnjCoVmS3L4NU5enPUbeRCKdKCf0ml+Zx2:I71ozDPpB6kwNWrnRP3Q3j0DeTOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362357, "uuid": "d329d700-0485-419a-bb05-23bdd1590e37", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362357, "uuid": "01803cc4-a5ad-4842-b913-60d8f6bac7e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362357, "uuid": "b671b6e9-4bcd-41dc-b61f-29665f965435", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26389f6-c786-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679361738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361738, "uuid": "388d2bfc-15eb-4401-9887-2e55377cbf2c", "comment": "Malware payload (CoinMiner)", "value": "e4f87a460e69c82d2e6c77814e36e729", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361738, "uuid": "d40537b5-5622-4276-9821-2e420e94e77c", "comment": "Malware payload (CoinMiner)", "value": "6979da2bb18e014dd847a5e35aaeac328193d1843c6e834ed63e5b8785e9b80c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361738, "uuid": "54500704-c84d-4e89-adc5-8fc281658979", "comment": "Malware payload (CoinMiner)", "value": "e587afad6859aaf144266ec80c837c396f06e8b5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679361738, "uuid": "b4bcc159-bb70-40bf-b51f-d47dbd29166e", "comment": "Malware payload (CoinMiner)", "value": "1b3ba6a88437b6cda891a8432d708b7c74fc233c864830cd304476216569a9416bf2edcea22524e04e9c417b8cb01613", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361738, "uuid": "f0b0f49e-f1e3-4ea8-a07c-16567ae80253", "value": "T108653370DFA3BC44D3C5C13D5EC8EAE3B536A2C402D7A3DA45A492BDC7C97A524681C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361738, "uuid": "899c9bc1-45b7-4448-b2c8-041ab5b34d9c", "value": "98183deaf6c8f22ff075814a6379c54a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361738, "uuid": "e4862c06-35d4-452d-8309-70bf03cc133e", "value": "24576:DhAmRh7we9mr06DvDRRSo62tHbt4yM0y6ocrgisd5jOOYKtWvnGGamd0:Gm5QxGovtyvGo/iszORbGGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679361738, "uuid": "acb65748-b754-4120-b5b4-8e048feb2524", "value": 1445120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679361738, "uuid": "3e2bca8e-ad0f-4aa8-b686-0ccc2dfe0960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679361738, "uuid": "555247f5-a5f7-4480-8450-a7553e3ce64d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2092d837-c7d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679396659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396659, "uuid": "8aac0442-347a-470a-a004-c7fd04028210", "comment": "Malware payload (Gozi)", "value": "4984b442edb1cf12523faec4ad99c4ef", "object_relation": "md5", "Tag": [ { "name": "2ndstage", "colour": "#20BB45", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396659, "uuid": "36e026df-a83d-4c2a-9acc-940ed04c3a71", "comment": "Malware payload (Gozi)", "value": "69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8", "object_relation": "sha256", "Tag": [ { "name": "2ndstage", "colour": "#20BB45", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396659, "uuid": "2e212a7a-3c12-4a3a-9993-26a7fc7da196", "comment": "Malware payload (Gozi)", "value": "5387e3fad9ee5d4e894f9ed8c6867c341f6dab11", "object_relation": "sha1", "Tag": [ { "name": "2ndstage", "colour": "#20BB45", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396659, "uuid": "d79c045a-2e37-4778-98e7-619cc2b0a9d8", "comment": "Malware payload (Gozi)", "value": "f5658fe55db36c00c68a7e47bb309354c255ed10c76d542b5f16e745e22a103e5353616a61984d7b6f523ced91659a23", "object_relation": "sha3-384", "Tag": [ { "name": "2ndstage", "colour": "#20BB45", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396659, "uuid": "5a1d1f36-3f28-41b2-8491-9a3198de6172", "value": "T1DE03E14A9E210DF7E90898B08239E76F8149F2915D35EC48E7973ED95AED94A4C3C333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396659, "uuid": "b315efe6-a89a-4e60-a9fe-ce171a7cbbdc", "value": "3e85858f9f91b022a15a56437fb6f7c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396659, "uuid": "2b29d8ee-1029-432b-bd5c-50b639809c47", "value": "768:A2SGgWkKlrFv+y5NGQgGoKItuFe666yuwyF8sj1YsFVOZd43HmIt6J:MGtkKlA2oKItuLn3kfsLs9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679396659, "uuid": "c05bc49e-7817-415f-892d-9c0bb19b6ec4", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679396659, "uuid": "f9470358-5233-4d8f-aac7-9d12bf7d4ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396659, "uuid": "3df6bbd8-a3d8-4f9f-b53b-b61b49227ee6", "value": "stage_2gozi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2dcd7a-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679393455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393455, "uuid": "9c590180-aa0e-4578-b5a9-9db38124ac9a", "comment": "Malware payload (STRRAT)", "value": "622ab0fa10fc6006c19c8e7818362c44", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393455, "uuid": "e81e9e12-ce1d-4c19-b710-3ae1a036889e", "comment": "Malware payload (STRRAT)", "value": "6a16f1c7e386d1eab76b63b56b04e32268c017854f9598e27a279f89f8f5b194", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393455, "uuid": "2aaa7863-f089-49b6-b3c5-6897a74ef964", "comment": "Malware payload (STRRAT)", "value": "d6bb7fe0a48ac3408c744a7857f74a82c8e20114", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393455, "uuid": "323d1625-cadc-416d-985b-babab8b6438c", "comment": "Malware payload (STRRAT)", "value": "3d2363a35e885fb53764d8cb3ccb439834019518360759e2cfef16f9e731b669eb4d79c0e34122ec5f175d3f2fbc79b0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393455, "uuid": "1c9eeb38-6938-4d0a-b734-0752f020eabf", "value": "T1C924016E7E69C3DDE41B4836001CD932BD4E4279D502AA3F55FD68081838DADEA42DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393455, "uuid": "279581cd-37e6-469b-8003-976725bb8a62", "value": "6144:lVwT0oyh+wIvPAqfZqcaGg+bMCGSwROMIoenO9RFFw:lJYwI5Zf1gQRM4qDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393455, "uuid": "ff8166ef-7871-41a4-9927-cdb4eb4042fc", "value": 225125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393455, "uuid": "16d8fe63-36f9-47cf-b47d-17f93334d11f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393455, "uuid": "b6187b83-b262-44c5-bc88-4e411dcf0986", "value": "Order 686879 for Wilh. Becker GmbH Co.KG.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da320a7a-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392675, "uuid": "f6684d1e-9c66-44f4-b8dd-2412ac5920ec", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac80fe83f6a53b079c3588b696e3c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392675, "uuid": "65017f18-a32b-42b2-9ebd-074746b1419a", "comment": "Malware payload (SnakeKeylogger)", "value": "6a78d551d6ed87c0c169d757b5cc28d2869d109f5ebea040d7240d0e50f422b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392675, "uuid": "5b4cc2de-687b-4d5f-bd28-9ba23f65e28f", "comment": "Malware payload (SnakeKeylogger)", "value": "266d0d7fe64f75c32e22f3ffe15297c21f73402c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392675, "uuid": "d0b96230-6383-445b-95e6-ee2128eefa8f", "comment": "Malware payload (SnakeKeylogger)", "value": "74a8faf37cd3b08945f4a61f1cc5222546bbb1f28920ae42649330bf3fa58c81e6aeadf139d4306046bdbfaab80dbc9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392675, "uuid": "149febf7-38dd-44f9-8054-2005e90563a5", "value": "T13C15F1137AAE436DF6394BBD71781170936AAF532203D64978F1EDDE0676B0E0A402DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392675, "uuid": "28376544-7716-42e7-a670-5b2629f61cbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392675, "uuid": "f01c18a1-bfb2-4677-88b6-d0c70ae6db35", "value": "24576:sdKaPCww5qAzD51hYwEJ75/yJ3cU4X9p9YpIeZM:ja7aBD51mwuF/yJsUKYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392675, "uuid": "2257bf35-ef1f-4361-b9cf-2e089c7c25b9", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392675, "uuid": "da3f3b32-951e-47a3-a72f-a74ba2f8f622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392675, "uuid": "776f2799-1f86-4f77-94c9-ee7bf9dd83f5", "value": "Img.price-list.20230187349931062023PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaccd4c-c7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Arechclient2)", "timestamp": 1679376623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376623, "uuid": "8410b133-a172-478d-9157-43d892691890", "comment": "Malware payload (Arechclient2)", "value": "f473ff1ba37b4f1ecbf113e0a03979cf", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376623, "uuid": "a7257a23-b0c7-4b14-805f-d5c6c3fa3d0a", "comment": "Malware payload (Arechclient2)", "value": "6ad791a223ab8bb728d8d27d371ae1f97ca419948af4bd660d4f84b1d34dc1a0", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376623, "uuid": "410e2f72-1d31-4de3-b062-22d0c3deb162", "comment": "Malware payload (Arechclient2)", "value": "9600f413fa59744941bdf3635c86faa9de7689c0", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376623, "uuid": "b46c58bf-5c97-4c6c-84b3-7fc5b7bd80c1", "comment": "Malware payload (Arechclient2)", "value": "e2d094bf6f7773e8058339405a0bcc0ee6c698dcd46df7d55f7074b397755efb4d4ddd31606b23a4147a5fbf3f034e65", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376623, "uuid": "3156c81c-598e-473c-9456-c08a42bd456d", "value": "T19295E8B464FB48E5E40FCD8016BCFDE611B672F3ECC60D65036D76045E6AEA87E8460A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376623, "uuid": "017dac32-99d2-4f3a-b737-78ca9281e08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376623, "uuid": "876aea59-c826-43b8-9da0-349d5677fddb", "value": "12288:LQqdWF4mPTWRETEK8zukxzWBvEqQnUbz7nqIVvu+KWzbCU9aMpIhO4RlWUNNGqR+:LdQDFV3V+SdSO4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679376623, "uuid": "1bcb69c0-e69f-49bc-b657-ed348085723e", "value": 1991168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679376623, "uuid": "d3ba5974-5040-446c-a642-8a2a986ffd3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376623, "uuid": "30c0b62b-719b-4bb8-b949-aee8cb6a635c", "value": "6AD791A223AB8BB728D8D27D371AE1F97CA419948AF4B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feae74a1-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679364390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364390, "uuid": "5387a801-e0cf-4fd6-8005-58cea984563c", "comment": "Malware payload (Rhadamanthys)", "value": "7f808edcbbcd7035475da81476402264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364390, "uuid": "2910ef42-9024-4016-ba15-5d7c6e96470e", "comment": "Malware payload (Rhadamanthys)", "value": "6b30a9e2970db8c1ee23e6337c427889b132c416a26ad99c61d2a11791ee79bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364390, "uuid": "ece9b79c-cde7-43fb-af5e-21b7c8dc74d6", "comment": "Malware payload (Rhadamanthys)", "value": "6214f58579db0872f3a251e29809f0562468c958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364390, "uuid": "21c4a242-a86e-4aec-b708-57948791c10a", "comment": "Malware payload (Rhadamanthys)", "value": "c536f38e3391aec08f6bfd3ccffe0b7ffef615ac572a0f9a9132c144798b754b0f15f3dbe787ba5cd12834ab806b4bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364390, "uuid": "8b12257a-e040-4eb9-aab3-4edba875694e", "value": "T1AE44C00397A0B865E4168BF55D2BC6F8AA0DBCD1CF6D676E33046E2F0873162C16A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364390, "uuid": "594d6847-e065-486a-a1b7-406977b9ee84", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364390, "uuid": "312f38f9-09db-45b2-8113-096e5abb77f0", "value": "6144:R0knNjNnEjRAx9SRpnTQpd5h7iwVQ64lCE:R0k1NnCixiTQ77o64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364390, "uuid": "e6f942e0-5af0-4aab-af1b-f46dd3e724ea", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364390, "uuid": "a7977d4f-4e93-44d7-82c3-ba374ccbf32e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364390, "uuid": "cbb49b78-52ca-4f1a-93eb-90325324081c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12392e47-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389333, "uuid": "8f870024-6170-43d0-bff4-039fc05293f0", "comment": "Malware payload (Mirai)", "value": "59ea437b784c4234569a4d6d83b4adfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389333, "uuid": "71259cc5-6088-4a46-911a-12d3a8fdba13", "comment": "Malware payload (Mirai)", "value": "6b85e399e77505d83169e3e2c2c0b924cf5d4dd13f3e3e0f58dbf507f718dd7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389333, "uuid": "e66066d0-07aa-4d36-990d-3b06b9b86477", "comment": "Malware payload (Mirai)", "value": "a39432bdb0e09738ff9fcaf879da29f4695d455d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389333, "uuid": "5b603f68-8e87-4d16-85cc-885d9fefd875", "comment": "Malware payload (Mirai)", "value": "03a71b9e917c769e6f110c94aacbfb55dac5524908b8d73d3f07922d2139404e63e19e0e6c46d2d4815890b35e7889cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389333, "uuid": "a0f9a56b-5e37-461f-8801-f3aeeffafa95", "value": "T1C2A30972E646CAB2C4430AF201A79A670D21BE7B0A7A5E86F32C3CB09F334C57555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389333, "uuid": "7d656b64-a98c-4144-abe1-f37205da104e", "value": "3072:CHVdtMmUKrlJqE0d+aRxzmmFVcqq0GnDZT:C1dtXUv+aRxzmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389333, "uuid": "0b771d58-20af-45a5-917c-8765998c98c1", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389333, "uuid": "85e81e38-bb8c-4a9e-8f0b-717b35936996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389333, "uuid": "d8f18fb3-7aa4-464e-8f87-b1bcadcab006", "value": "59ea437b784c4234569a4d6d83b4adfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41e7966-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392665, "uuid": "6f710795-806a-48d2-8505-79f24d17dbbc", "comment": "Malware payload (SnakeKeylogger)", "value": "33e248c570bd5e5026a4a7e42e8e571f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392665, "uuid": "b22aed3e-415f-449c-9aa0-b66c418b3fe3", "comment": "Malware payload (SnakeKeylogger)", "value": "6c357ddbf95511b8775a19d1dd8272a63853371467cd466e21db1b38de4228c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392665, "uuid": "06b9a8c5-2f91-436c-b767-c5a85ac98e81", "comment": "Malware payload (SnakeKeylogger)", "value": "e8a9efe06787c4305886199f76d4e2ebfc337941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392665, "uuid": "cadf525a-dd92-4d8d-b5cc-cda4dcf9a77f", "comment": "Malware payload (SnakeKeylogger)", "value": "9ec4647d30fdebff30d33a20c9983b4291f40c356575b067d3de5b4a765b5903dc1350bfd3a600cac53e3b5f610e60a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392665, "uuid": "6091c1ba-8f68-4438-ae0d-4ac2aad7713f", "value": "T12F159E9132B0D4B3F5CB017960297ACC2C7CB153B6D4E24B6A777AC09611AFBF698E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392665, "uuid": "f3c8bf1a-e464-42be-b5b8-c0d1358f46f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392665, "uuid": "47a52b51-7adb-4404-b219-c1a0df82bf04", "value": "24576:G1Qwe3cOQeTL30ydZNpIOtXSKQ7mBQPFL:GBAHEydZNeii75P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392665, "uuid": "0514a850-3e7b-4d48-b2cb-b29984cf74b7", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392665, "uuid": "e8ca3d14-37f9-4a69-950b-240c0ddad2da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392665, "uuid": "7ea949aa-ebc8-4cd3-b4d8-0dcf83295882", "value": "33e248c570bd5e5026a4a7e42e8e571f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a022ff-c78e-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1679364998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364998, "uuid": "ae501945-58f0-4b0b-a420-59fa8d4aff23", "comment": "Malware payload (OrcusRAT)", "value": "3f3da8bac0a5a861bb9d8cc338277cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364998, "uuid": "06c597f1-b855-4f3f-b175-3f6a38e4d361", "comment": "Malware payload (OrcusRAT)", "value": "6d06740fbd595b66c802c2c32fbef399cc1b3dfec45722b67534bf597ee7a388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364998, "uuid": "b8f11435-0180-498d-a300-267ef0f25f2c", "comment": "Malware payload (OrcusRAT)", "value": "c4decfc78ea894203ef57400e1378219b452ab85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364998, "uuid": "b141e1a9-dedd-4053-8d11-7aa9466cf948", "comment": "Malware payload (OrcusRAT)", "value": "0a43e22b0aa991418a7052033fbeeec4aee88cd1a77340e4264f25929d67243ca20220c7cc51d991cd38327388c7c785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364998, "uuid": "7667a0f8-86d5-4264-9d3b-9865d4bffac2", "value": "T1E6F6BF013FACBD07C1BE3679B7731ACA07B8E90A6052FB4E095851AE1D9BB01BD15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364998, "uuid": "9ee420a2-a820-4435-af12-dbeff7ea739c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364998, "uuid": "16032c51-c90a-4ef9-be8b-ccf8924342cd", "value": "24576:g8c4MROxnFj37rkxrrcI0AilFEvxHPA2eooyD:gGMi1PqrrcI0AilFEvxHPA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364998, "uuid": "c0820802-cb1d-4515-a447-7c16459b6dc0", "value": 15691775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364998, "uuid": "81d4d7ed-0ef2-40db-b0ae-7d90aa276cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364998, "uuid": "bb4bb3ce-6471-4d54-855d-1d0ce6025daa", "value": "FiveM-CheatHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32ce913-c7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1679394435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394435, "uuid": "b0482e7c-4c2f-4cfa-aca0-a66a75572665", "comment": "Malware payload (Socelars)", "value": "802e1974c79084d3b80ce713a54929aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394435, "uuid": "40376d08-5a96-4c0d-b683-d016a8784dba", "comment": "Malware payload (Socelars)", "value": "6eb28920cd3e8d50c66e39e7aa042b22dd05d17c2a62817113d76e5df2732fd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394435, "uuid": "3b435f46-d718-4678-b94d-a55dac2fc9a1", "comment": "Malware payload (Socelars)", "value": "c65a48fe08d3747202ab2a2bc6821a3f6dd95f76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394435, "uuid": "24c72e36-c161-4244-b422-a78252f70346", "comment": "Malware payload (Socelars)", "value": "db8bf4d5eb441168ab831c280c8c9e1cb3cdbcac52fa98464635e2557f4bf15b23654338d97c78fe31408dcb8fa94c5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394435, "uuid": "24b0534e-1663-4452-9ca7-97df5b963532", "value": "T14A658D21F7C26032E8E310B745FF66BE9D3C6A11470894D7D3C81D99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394435, "uuid": "e869e21d-721a-4a76-adda-c4c952ba8ca5", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394435, "uuid": "00511708-891f-464c-8f5f-442cfaae1252", "value": "24576:UGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRTg5hoS6S:fpEUIvU0N9jkpjweXt7785GjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679394435, "uuid": "6d1ff5dc-f5e3-4b37-935b-9faffc8e447b", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679394435, "uuid": "232772dc-06a5-408e-8a57-ccca709cc8c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394435, "uuid": "3debeeb3-1947-4477-98dc-ed0f5f0b2aaa", "value": "802e1974c79084d3b80ce713a54929aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defbb3cf-c78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679363907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363907, "uuid": "cec4344c-4171-4788-86d2-6adb442e27b0", "comment": "Malware payload (Rhadamanthys)", "value": "3ef8a7ddfdc0ad6dfd395b4bd53d1a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363907, "uuid": "bd39799e-fadb-407f-830d-b5e885245058", "comment": "Malware payload (Rhadamanthys)", "value": "6ef6b791315d1d1581ea617d1837ea8af4db3147ee4ea2ec7cfccc2a5ed11f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363907, "uuid": "dce22518-360e-4882-91e2-9f83a7fd7c06", "comment": "Malware payload (Rhadamanthys)", "value": "d809d082e77d4620a63ea4806c2a194ee9912a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363907, "uuid": "e0e32c2c-620f-47ac-a189-e6afa64025b6", "comment": "Malware payload (Rhadamanthys)", "value": "703f4fcf4abae04531b6935876209ba1e7768e53843d2ccf7e16908b6be539a80c4d720035126a17c436b0d56b4b3784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363907, "uuid": "83726604-40ad-440f-96de-32bfe536af01", "value": "T1FCC57CB262A3FE85D77F2E60C0043A405C30586796ACD78CFCC926A756E1664EF5CAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363907, "uuid": "24e10ecc-8578-4fdd-b0f3-46996b837d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363907, "uuid": "75660cd3-6269-4565-a96d-67e102de97af", "value": "49152:avk3R00kqG1CRVSZb5I8druJiu4GyXjtMbx9rQjmHAqcyYx:avkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363907, "uuid": "3a671e24-3766-4607-b555-5723102075f6", "value": 2512384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363907, "uuid": "f0c60815-9616-4a1b-9318-b493c78f694f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363907, "uuid": "d394ff4d-aeb5-4c1c-9dfe-a5d92524f35e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80031d0a-c7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679401973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401973, "uuid": "35f0318a-08f3-4fb1-ae0e-deb2fd88a011", "comment": "Malware payload (AgentTesla)", "value": "cd0c059c2973fdca77b4e3e1f10223e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401973, "uuid": "7c87c7be-7e65-44ff-acfc-1b68d8a4bb46", "comment": "Malware payload (AgentTesla)", "value": "6f277849ad036b9481e70898f13ec857a52f12983c129e01439f97bc2f785646", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401973, "uuid": "03b4e70a-a495-45a7-96bb-d75b718f2e6a", "comment": "Malware payload (AgentTesla)", "value": "1e8eeac95a33fe46cbbe40b050bf96678c4c261a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401973, "uuid": "85cdcd33-2332-4957-8034-6c88f048d603", "comment": "Malware payload (AgentTesla)", "value": "13267bbdc00fe8f501996427e33d37837f842a68aa7de9a7b34c64fcb37c1bffe4752ea98820a1dcac8c1bf4f30c03d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401973, "uuid": "369ebeea-a27a-43e7-b779-c24bd81820d7", "value": "T1D384CF126765DD03E780127C9592EB7C8E265FD8BD06CF2367F9ACC77914B26282E183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401973, "uuid": "17272dc2-f8c7-47a1-b55d-40d56485e744", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401973, "uuid": "a9cc1060-05d1-40a5-97d5-359654b4cc92", "value": "6144:xspNjlsvCnvxZGVGGMrYfXcHQcjyKyWwVfg8VKYU7Qn8fU1kyxIUpKfKsf:xcBwlOwVYP7QgEyNfKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679401973, "uuid": "36a02451-88fd-4f37-a752-09f15d65d614", "value": 379896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679401973, "uuid": "32de60c4-1800-46e9-9fa1-edf7c2bd7d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401973, "uuid": "ab6e6cbd-8f8e-40f4-adab-385144975764", "value": "Bonsoir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bd62a5-c7eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679404799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404799, "uuid": "33fbe00b-7914-4406-a175-57fa5bef871f", "comment": "Malware payload (Formbook)", "value": "b98feb15976a8317f9edd750d3351f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404799, "uuid": "8bf3eb8e-7e1e-40a0-8a3b-25da8f7668c8", "comment": "Malware payload (Formbook)", "value": "6f4246a44c4b69ed8cc30d0583be906c7a8040216321889da1bd74ba7815aedd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404799, "uuid": "886c728e-5f3c-442c-a3ed-0391c4dc0643", "comment": "Malware payload (Formbook)", "value": "e391a5fa6a96f0c1a69c4487be9c030f2bc40b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404799, "uuid": "e74f9867-6c8a-4b7d-923f-bb20869cc329", "comment": "Malware payload (Formbook)", "value": "94bd2919ddbf675f47b9cbe9e8f8a8941c7daa5753a6eb56fff6bf852a0fe10e6e041c2ed4acb1ac435ffc536d1d8b20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404799, "uuid": "cdf9e958-393c-4132-942e-68f2f2bbb24e", "value": "T160158E19FED999F3C324D233EFDAE92563674F56B722C67521C213220E0E346A9CA11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404799, "uuid": "80788ef2-6fcf-43a4-93ac-9af5be6e00f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404799, "uuid": "9769bfea-3268-4d0f-b1ee-447b23a19ae3", "value": "12288:4Ht0TQJfrqsf88NSL7GrRybMVvC5mDPCegwjcsRvirNotqzR4FP8nKCVk8vBMHYJ:4trbfS7GrRyf5mb7jcgKaiE9dJlNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679404799, "uuid": "a0899e7e-a73e-4fa1-84c3-71f6efb48b27", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679404799, "uuid": "8aa0058d-235a-4dc8-b1fc-b0dbc507e02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404799, "uuid": "1a200353-c2f7-475a-8566-1a716585bbed", "value": "rORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe09318-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389698, "uuid": "37a126f7-5860-4d6d-804c-7e1eae4d65b2", "comment": "Malware payload (Mirai)", "value": "434c2d54c50a5b7196552db407a2dc54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389698, "uuid": "8794ef61-085e-42e3-a392-4349097071bf", "comment": "Malware payload (Mirai)", "value": "6f561101d77146c709ec91d121498ef908faa6cb699837ea0aab31b66c42705f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389698, "uuid": "ff9469a6-f84d-41dd-83ac-3338eb436579", "comment": "Malware payload (Mirai)", "value": "3925077fea5d81a073b68a5a0502161e837526c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389698, "uuid": "009a7e12-c343-488b-80a3-729995a57400", "comment": "Malware payload (Mirai)", "value": "3833e80a5ee9a858e9517e56673065d5449b6fb2d3e777d192439b391f6e82bef27a4bb2084a4a8510e6e5ac5102c974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389698, "uuid": "b9a3a746-405b-421e-ada0-349b93517c86", "value": "T118E31930D4504B17C2D213FAE69E825E3F221FA793D733115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389698, "uuid": "82ff5a55-4b7c-4ea6-bd75-35c1fb3c5f42", "value": "3072:/8AoY2a6TZ3KT7iOXtLvPqqua1qkmhxQwoVSUNu:Fia6TZWtLvPqqpqkmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389698, "uuid": "77a3852f-e22b-46d6-960c-c3f36507a8fa", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389698, "uuid": "7e6375f9-3ae8-4661-8bc5-5e88f13d9f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389698, "uuid": "abb1ffab-a93e-486e-ae0b-dc09aad4de73", "value": "434c2d54c50a5b7196552db407a2dc54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e95dce-c791-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679366252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366252, "uuid": "159d70f8-06fe-4452-8038-80a6f50362d1", "comment": "Malware payload (QuasarRAT)", "value": "0c02a1fb840235d20030983bd4506abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366252, "uuid": "d1bb7d41-ed4f-4171-b49d-2ed0ccc5420a", "comment": "Malware payload (QuasarRAT)", "value": "704724185f332058786deeebf8980b5c1d505c9a97917cda06ad171d7c14c9e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366252, "uuid": "a52d7d6e-9ddb-4e19-8dd1-5f5a3508e577", "comment": "Malware payload (QuasarRAT)", "value": "a7a0ff0090a4cc63d046746ade2e074af22702e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366252, "uuid": "424a7672-ddd5-4bc1-bdaa-e9f35cd910b3", "comment": "Malware payload (QuasarRAT)", "value": "f51fee5c291460676a4b2310cffba04ac6ce6811866db4953949156e2ee8d02b2d125cafcaad136b2abb78219568b750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366252, "uuid": "11fd3422-5a61-4a87-887d-205bc1e0b332", "value": "T1FD749E13B7A4D53BD1FE1B7AE43206151BB4D8C3B612E38B5A5846B86D133868D913F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366252, "uuid": "aad887d8-20e8-4a09-ae80-7fa33210f67c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366252, "uuid": "0ffabc1a-00e8-4025-9d99-f1f2433f598d", "value": "6144:vD+zrEsiN1PqyH7FI2bs7IS0MCTLryj1IdiKTjn:bxsiNPbFuCMCTfC1IdiEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679366252, "uuid": "fffbb04d-bc90-46f9-929a-a4373f347acd", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679366252, "uuid": "b5a52095-f2d8-441d-8c85-48a17e651dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366252, "uuid": "2cbf63a7-5979-4aa2-8e1c-b288c8f14bd9", "value": "Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f9e247-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679393039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393039, "uuid": "e97aff5c-7d72-4fdc-bed0-150b7cfc3ccf", "comment": "Malware payload (Formbook)", "value": "0b09e53e2fc33342c42fbc66473df157", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393039, "uuid": "e0aa2b79-7209-4579-a5f9-b23386f2d058", "comment": "Malware payload (Formbook)", "value": "708e57865390f24449be8d2c202ffdf9517984bf96a82de7aacf6d5ec6f7adbc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393039, "uuid": "d14f1c3c-8d20-4dc7-88e2-63fe898ae0cf", "comment": "Malware payload (Formbook)", "value": "214ed38e49a874f7b4ac5b5e245ce165eb767f0c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393039, "uuid": "987bc39f-0679-47ee-a483-232519d95d22", "comment": "Malware payload (Formbook)", "value": "d3146199ca269f64298efa276690d70842c8fb48196c7a694565677cedb9528d601015869b38ccb733719af6faeb8a86", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393039, "uuid": "e584939e-dcdb-40d0-be6b-ba66c34289e1", "value": "T1CA350213F9848D46D44247F97AE3B9D9531EBC626BD6A2C72344B70F5F78AE08A4310E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393039, "uuid": "cfe3a6f7-beea-4c28-8c3d-ed29a7fb1314", "value": "24576:dLKjWQmmav30xY+MXUu9/41+MXUu9L3bV7+MXUu9s3bVn3+RoyPZNQ:dLKCQmmQ30K+MXV9i+MXV9L3bV7+MXVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393039, "uuid": "5bac822f-085a-4943-8264-30aff1cf4b52", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393039, "uuid": "141d5a91-96cd-43f7-b68d-03e0a5a62e74", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393039, "uuid": "2a21553a-7d4b-42af-abf8-ae3af129dce5", "value": "P72215 \u10e8\u10d4\u10d7\u10d0\u10d5\u10d0\u10d6\u10d4\u10d1\u10d0 7 \u10d9\u10dd\u10d3\u10d8-\u10e1\u10d2\u10d0\u10dc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e558186b-c7fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1679412451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412451, "uuid": "73fb572f-7ecc-422e-a0d0-26cf0f64dd80", "comment": "Malware payload (Guildma)", "value": "33787f43fe8ed4cec69a1df70df66175", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412451, "uuid": "026e290b-a1ef-4404-89fb-38cd423d7bed", "comment": "Malware payload (Guildma)", "value": "728aafbe4063f900177f678ba1883ba4e7f1fe1aaf3cb91b125afcd6d2f41187", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412451, "uuid": "1c9999d1-b18c-4c97-b074-829d3499451f", "comment": "Malware payload (Guildma)", "value": "55f28723822a0e7ff23d49d334d30c65e56af8ae", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412451, "uuid": "367709ca-6c0d-491d-914c-de60fcb2ce8d", "comment": "Malware payload (Guildma)", "value": "0b46b0e49b737fc1761c91d011238b198eb6a164b2ab2f3e94a0e6ccb64f8b0bb0c9d5f9cbaf1eff55968f5ceab4c66a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412451, "uuid": "2d0ba05c-00ea-43bd-a8be-ce38e6eb2630", "value": "T153E0728DB9EE1EECC06E28200EF82E4C2C0038032B84780B1AABCF848D0CD004A2CE80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412451, "uuid": "b3e76fd0-5145-41d0-8a77-f7405d579315", "value": "6:SGIfGlkRsncU1x7PBIjd4tL80Omb8msXeE7G4SCq0pYjJIWgBAVEuf5LElFn:QgkRor72jdgL80Omb8m7EIC4j/p7LKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679412451, "uuid": "dab22d7c-1049-4c77-90d4-b15838ab2e51", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679412451, "uuid": "ae7dfcf8-c5cc-4d3d-b7e2-64eada5f47c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412451, "uuid": "e35e61f2-3072-4fd6-9bf0-6c5513dafff8", "value": "252_FLUXO20PROJETADO375.759608.88082.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8500fb72-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679364185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364185, "uuid": "8744e6bb-d0e3-4786-bc96-4e1e7bed52a0", "comment": "Malware payload (Rhadamanthys)", "value": "11f013f44faf58b5d0743db838595c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364185, "uuid": "2329d838-0359-499b-9962-5b0c550e85e9", "comment": "Malware payload (Rhadamanthys)", "value": "7293966f11279380ddedd7269e344dd4d1f85269753da563bb0a61f62bc7ac21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364185, "uuid": "8a6b2bba-3b35-46be-840d-afb9571994b6", "comment": "Malware payload (Rhadamanthys)", "value": "f940ee2c4f3e7594ee658951916c9eac22a34026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364185, "uuid": "8c267da9-0d26-4fc4-bbd6-ddae00ea0230", "comment": "Malware payload (Rhadamanthys)", "value": "2b1a2b664de270e982c110daec167bf8d448d7e7315328b6ac187599c0b56a0bd29f46a3b32be2a42ac3969a4be44ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364185, "uuid": "74cd58f7-34d6-4aba-8db1-79000b9e1205", "value": "T10644CF0347907855F412CBF14E1AC6B9AB0EF9D0CE5D67AE32146F2F08B3162D6A6BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364185, "uuid": "3fd0b72e-754b-4bb6-b639-f2c1de27cf5c", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364185, "uuid": "67c2bd67-3d38-4fe4-a456-09515b4a85ef", "value": "3072:dX1B7Uz2DbePNW4qgqO1ek03in4jrJ30LCbJo9zsoz0bVhAfT3yKoux2zAsopZ:FDU6u1Pyk0ynEmPzWVhwyKo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364185, "uuid": "a407acf9-1fd3-42f3-977a-4c441cc7a09a", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364185, "uuid": "cf9cb234-8cc1-4259-9435-86df251ff6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364185, "uuid": "241996bf-7b9a-4241-8bfe-bf198e349515", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc09656f-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679364331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364331, "uuid": "3b14dbf8-5c2b-4111-a34f-e82ab446551c", "comment": "Malware payload (Rhadamanthys)", "value": "326cc532d49bb68d5583030a11f4ffb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364331, "uuid": "1c31ae87-a6c6-4e4e-919c-f0b9bfcc2fdb", "comment": "Malware payload (Rhadamanthys)", "value": "733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364331, "uuid": "062fd448-2ec8-4497-9504-1ab3d1572ad9", "comment": "Malware payload (Rhadamanthys)", "value": "81d1b693b2774c18c820d079823d7b87b29b8286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364331, "uuid": "6b902093-a63e-4140-95c5-eebe08d77fd5", "comment": "Malware payload (Rhadamanthys)", "value": "a4c8a2201c6291c5f197962c4ac2271f66b14a95cc16b823815d579137f30229d0b2ebed8dda2f0ff1f7769065207cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364331, "uuid": "8f66b61a-610f-4c2b-9d05-02baf7417a3f", "value": "T1C9B58DB262A3FE86D7BF2E60C0483A409C64546393ADC789FCC925A746E5350EF5C7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364331, "uuid": "19a3d151-28b4-47d1-ac77-6df43b9b8edd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364331, "uuid": "212120da-a99c-42f9-82f9-bf797ec98408", "value": "49152:dvk3Qg8ZRwkUBnlHPRFzg7uGmuLoaUIFJL:dvkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364331, "uuid": "613d5765-cfce-4e46-8fef-6711dedc1f03", "value": 2420736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364331, "uuid": "643a1ba3-5c0e-4870-83d7-cb5182a65acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364331, "uuid": "67735e1e-8fc2-4bd4-9a12-df78e9576366", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3f5c98-c7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389293, "uuid": "e5241a47-1194-4fd2-9271-fe1c749a0de6", "comment": "Malware payload (Mirai)", "value": "b364f8f830ac2f8c79ffeec56cda8fa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389293, "uuid": "9ecad158-7203-44e4-ad94-afc10b813e8f", "comment": "Malware payload (Mirai)", "value": "74e3cac3b267ad0d45f62ef215d45eeef5c9cf7a1fbf5c6aad509bf463ae67a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389293, "uuid": "d8ef519e-2e0b-4f54-83c9-4df65493bfe4", "comment": "Malware payload (Mirai)", "value": "27a4781a98cfc11a893607be994292107b734fee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389293, "uuid": "37158b2e-7a5f-495b-a882-5bbdf8fe051a", "comment": "Malware payload (Mirai)", "value": "86a30eb2473f30b2bb4e18495f504f2520268a4ba62ee644ab13cd21beba3ea02e1b9f3c4d14fab772a6aa05428a6d4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389293, "uuid": "da8aa1bf-de60-4bce-b7f5-aedee9edef71", "value": "T10DC3E730E9044B1BC2D227FAE75A469E3F351E9793A733115A387DB02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389293, "uuid": "93e8f41f-775a-4273-81dc-56ac1bfd0aa7", "value": "3072:iRHAMRIwv92IXjLIOeczbxBd1mP46aQyfPlfKsNb:ilRj92RZczb73mP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389293, "uuid": "627d9887-09f3-4782-94d4-62236196e23b", "value": 129890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389293, "uuid": "187f19dd-e10a-4171-b7ca-009f8db0f7c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389293, "uuid": "3a3c937d-2f88-47c1-b141-726d1078d9e8", "value": "b364f8f830ac2f8c79ffeec56cda8fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04222368-c78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363540, "uuid": "4a1a3d7b-40c1-43e2-935f-b79b141998f0", "comment": "Malware payload (Smoke Loader)", "value": "3dfb87ae27b7c97fbdd4fee1134ccecf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363540, "uuid": "f5fbc6fd-b95d-4216-9c71-9e71af902356", "comment": "Malware payload (Smoke Loader)", "value": "7523639d55f6d00bd8cd509061f7a808d88d1f0dec76512ca74748a497a590e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363540, "uuid": "f916082d-84c4-4404-a874-f679ef03028c", "comment": "Malware payload (Smoke Loader)", "value": "a906c14104215d5552a32e37950dd384d2eb58b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363540, "uuid": "c149d5de-1ebb-49ad-af63-586cea97b371", "comment": "Malware payload (Smoke Loader)", "value": "3ea01cac0dc824022ddb28744ec3ce7dbcdfc070d8fc9edd37f446bc1df73d04d81893d3f441d9ab65ea316a5a252722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363540, "uuid": "781da6b1-7e3c-48bb-91f6-b9aaa94d8bfd", "value": "T1CA048FC292D0B851F5168A368E2EC2F4771EFC91CE5DAB96E2186F2F08BD172C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363540, "uuid": "24a1c65b-12ec-4aca-b1ac-e98e733480aa", "value": "b6299cf22bb1b2b906c76a98a991dd84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363540, "uuid": "9f97fc4f-3ffe-45d8-9a6e-10018db3282a", "value": "3072:eOv5uSzqd9bwNrU+mMxRe9kYpeH/M5Ke26hiTjFs4:R4SzaMUx8c6zk5A6hi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363540, "uuid": "33895764-dab8-4e5c-b219-fbcdf29b0040", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363540, "uuid": "e6e27f92-1b54-4662-8fd3-95c88cb012e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363540, "uuid": "1f71bbc3-bba5-4f85-aec7-95db139e5552", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8338b60-c7ee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406443, "uuid": "e6845d4d-ebbc-4c0e-8976-663d18cf8a18", "comment": "Malware payload", "value": "43c04b789207b03410165f68510ab435", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406443, "uuid": "a9451fc7-1165-4c71-965f-062263009c8f", "comment": "Malware payload", "value": "764372d631b927357280263ba0dd4f2c6d0b2360345131dfd0fb85942601d669", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406443, "uuid": "a52a5808-ae42-47e7-b320-30c6bd46ff0d", "comment": "Malware payload", "value": "554ee503b8f742c3b4e41b9f5209b64426745051", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406443, "uuid": "1dce9916-5fdf-48b4-a737-c90e1d3d50ee", "comment": "Malware payload", "value": "8d542f37df477f4996dd6e3d4a1a4d2e5713842cff1652d53d36272d0a40e59ff05bdfe296c7eba820d606c99dbfefba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406443, "uuid": "2925a704-138d-456d-84db-12a16f467f4f", "value": "T18306BF47E3A791ECC5A7C4708777F373F634381851346D776680EAB03DA6E501A0ABAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406443, "uuid": "479ccba1-fabb-4adb-855a-bab511d69bf9", "value": "8b2be6e82e1a2f5b6a6ac4ed9979b98b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406443, "uuid": "d1af42f5-4868-4947-9424-8b641e192e07", "value": "49152:nMeD5RnCzXNqviwO9j8fdh7H3ZNaaA3rA0Odlm6wqjpHWmnHp4E14XQNqrHt+T:MS5cj9jCdh7XZNaAlZWmnf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406443, "uuid": "d9cf88d6-6931-44f4-97fe-01e348fc3a2a", "value": 4009984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406443, "uuid": "ec673e56-3a56-48b1-bba0-94426f0afd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406443, "uuid": "b5edda1c-c66d-425d-b744-2c79a2c67f77", "value": "6419b50c25117.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dccdfb-c7ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679404578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404578, "uuid": "2fe9d61c-d202-4570-8c79-539aa7ef464b", "comment": "Malware payload (SnakeKeylogger)", "value": "149a233b91ae4b3ee57d9cde29d114de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404578, "uuid": "13bb2a49-4cbd-4817-b5de-46dac0a2add0", "comment": "Malware payload (SnakeKeylogger)", "value": "775d529b622e56fca4a1ffcc6632c3c89b188cb773c88438c525fd4a69a27d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404578, "uuid": "5e2f80a4-4cc3-470a-aa0a-6bdfbb704602", "comment": "Malware payload (SnakeKeylogger)", "value": "412f07ccdbe832b139a6cbe136ef9c436a93347e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404578, "uuid": "2a68b063-35e2-4135-8abc-cddc6a651a91", "comment": "Malware payload (SnakeKeylogger)", "value": "3a736320cb998bea900a8372a17bc43d4637a6eeede3a8a28e7a8775e2b5377f92866d9bb042ec2a5e93d1b0bea832ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404578, "uuid": "1cef0365-1eae-4f91-b086-c8af020c90f9", "value": "T19405E048B698C709C13A07FBD43464F053336D69D612D35FAE8D7CEA3C72B858A4AA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404578, "uuid": "ddb2e418-e207-41cc-afe2-d93e862cdad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404578, "uuid": "e93fd1b8-99f9-4c8e-a3f7-afb49ada1571", "value": "12288:h3wQXyuaqBwGO33EmDKcbU71iCKuKTbrReVQ+KqUaJ/BFyzv0vYO33uqbN:dl+yynEmDKcbRCGTBwQ+RUaszv0vD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679404578, "uuid": "6cc3e131-9aef-4220-b040-3d94074902b6", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679404578, "uuid": "572c5b3a-7206-46b1-a84d-6e4e7c89597a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404578, "uuid": "d14b842d-3764-4269-8df5-cb4490a3fe7b", "value": "Shipment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd32954a-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389674, "uuid": "8a809797-7274-449e-991c-8903c90c64e8", "comment": "Malware payload (Mirai)", "value": "8246bf108acb871570705df738cd6299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389674, "uuid": "291de9d9-9967-45b8-972a-ddc77de7aabd", "comment": "Malware payload (Mirai)", "value": "7821752d98d88bce276a70e587310ab018014cb02c479c3e23d2ed82d2bde3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389674, "uuid": "fbb7b7f3-eef9-45c6-8f41-a3d1f5e92592", "comment": "Malware payload (Mirai)", "value": "f9bb10cd5539ef150dc857b5139cd75e5f8277a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389674, "uuid": "fef691f6-1b87-4bbf-95b2-0f094181795f", "comment": "Malware payload (Mirai)", "value": "55bb19ef1c3f35650447f7d70ff3492206733f1cd33ed9dcfce74b3cc1aacbcd78139216b8d8fd321d3def032105a51e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389674, "uuid": "8eb1a860-0e03-4cb1-a41a-07c4a6351b51", "value": "T13CC3C63B67170E23C0CA50B111E34332AEB5DF8734B952D76AD07DA86F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389674, "uuid": "c5d92706-8262-40fd-9862-5a3ad974ffbc", "value": "3072:/cU6x1pFA/JTFiNPha2JHc3KCKenc0mm/QMurB1nKGNb:/9BclWKenc0mm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389674, "uuid": "50ad648a-0451-41d5-b113-5b68a5d00083", "value": 129840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389674, "uuid": "610ccaab-c9a0-48dc-84ab-ed589a2567c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389674, "uuid": "63d12fa0-c9af-4571-b5da-f8d9b61fb66b", "value": "8246bf108acb871570705df738cd6299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6235cd-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679362671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362671, "uuid": "b5781da2-3fde-40e3-9dd3-5535e6d3501b", "comment": "Malware payload (RedLineStealer)", "value": "4995cb8afa48cdca14f07c5a3e8ff430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362671, "uuid": "689eee5c-accb-4570-8ecb-c6f13dc0d761", "comment": "Malware payload (RedLineStealer)", "value": "788d26f05d1bbbad26b8907e36a730ad380a300c9265888f0319cca80b87d1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362671, "uuid": "df220d03-3a54-40bc-81f4-8119f016f867", "comment": "Malware payload (RedLineStealer)", "value": "7680271136021c1070c9fdacbdacb16b16715fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362671, "uuid": "bd722341-cf25-4a7e-b2f4-3202b7c133bd", "comment": "Malware payload (RedLineStealer)", "value": "c82e8762eb709fa8da9079e708dbcdb6d5aa850de8c4c28eff973300126c40913f45a7b417fe3829a7aa93631a2ccc94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362671, "uuid": "d069846c-b661-4e7c-95d9-866d6a74332d", "value": "T1E9049F035B917865E412CBF24E2AC2B4B60EF9D1CE5E676E33086F2F0873162D566BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362671, "uuid": "070b952f-04a9-41bc-8a22-8e11cd2a0805", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362671, "uuid": "eeab3266-2ab5-4549-80a4-8b9cec73ef8f", "value": "3072:sS1jCCTzkCVDNWYW5J/sUKiKc5VxqljFRyAyNa4XHkUZ:VoCf7p0/rrIjuNNaWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362671, "uuid": "25c8aa97-1a93-4e06-b60d-2f8c6826ef99", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362671, "uuid": "bfa94725-8fba-45cf-b79b-6feca57e39f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362671, "uuid": "9a50215f-88ea-4f89-a6ea-fb89bda52e4a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8175b9-c78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679365513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365513, "uuid": "ca44f369-b8ec-4c71-8f5b-63775bdd4d29", "comment": "Malware payload (Mirai)", "value": "b2c7b530dda1e86285699cc34666bcf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365513, "uuid": "0905c2ff-669c-44a2-87d9-c439f63abc29", "comment": "Malware payload (Mirai)", "value": "792754c6e660335fe22a3099a2953c7d51b9b5c9eb6bed989790393ba1ef8ce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365513, "uuid": "f8991447-cddd-48e5-8c90-b7d2ce188b6c", "comment": "Malware payload (Mirai)", "value": "5a4fa656800a06fbd556084b2c878469fbe1ce47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365513, "uuid": "e7f7957d-9b0f-4493-9238-54ea09cd0469", "comment": "Malware payload (Mirai)", "value": "fde40c579974606a8d78186c62dc8c76e59503a45116261c4e87bab5812f9eca399ab97fdb60867dd7c87e7707466926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365513, "uuid": "70f2f405-bf58-4544-b1bd-9f26b507c9c9", "value": "T19BB2E17960A93A15D5EA617A086EBFDF2195C70F520996F3C9F4B6135087FB02C2C0DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365513, "uuid": "49a86a9b-b4bf-4feb-8ddf-c515a3eeb253", "value": "768:eM6CVAD/s90GDQIRzaRtcSo73WnbcuyD7URQRjT:YCVA41DQIGRu3Wnouy8Ry3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679365513, "uuid": "9bcc260e-6e85-4d42-82c1-008315f55285", "value": 24880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679365513, "uuid": "03096f92-5268-4648-a62e-4b0fd963e622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365513, "uuid": "f6fdd87a-addb-4f56-905b-e87ceb268916", "value": "b2c7b530dda1e86285699cc34666bcf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c05b75-c7af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679379145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379145, "uuid": "48c16558-3786-4646-aa64-64859eeacf57", "comment": "Malware payload", "value": "bedbec22f0ae7c2548ce8fd07bfb04ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake loader", "colour": "#3EA798", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379145, "uuid": "850398b7-0c99-4e82-9319-fb744e23a0ec", "comment": "Malware payload", "value": "797bd80d43c4ef7ab8fde178ca551ad2f9141ca3552ce42c8e96ccc95dc6d3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake loader", "colour": "#3EA798", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379145, "uuid": "6320a87e-06e8-44f0-a7be-5f1722e8c791", "comment": "Malware payload", "value": "753a2ca15710cf7ec16b59abc768a459f451e8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake loader", "colour": "#3EA798", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379145, "uuid": "be6943b4-8486-4b7c-bb0d-a3716dd5968c", "comment": "Malware payload", "value": "5de881ef6530078f3d269545d371506a950e3c397e1d9214830ce51ea54131b7738df8c638e98a2bb394536ac78fe3f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake loader", "colour": "#3EA798", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379145, "uuid": "52d0e89f-20b3-4e95-85f7-7eb137960bf5", "value": "T1A1959E3BB268653FC46A463F2572933099F7AA51E41E8C1A87E014CCCFE5460DE3B69D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379145, "uuid": "0659c26f-f2c0-4f47-a407-5cfa8527803f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379145, "uuid": "50518801-8e8c-444c-80dd-e9f5766c7fb1", "value": "24576:Z7FUDowAyrTVE3U5FTd8w8cfRenhAb9hRZaOyKMG0NDU+ExFYG6i5NwImxgYxhvc:ZBuZrEU+/cz9nZ5wDPEzY3ONdmxRbLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679379145, "uuid": "d94dcb26-a52f-41dc-8882-7a2272f13e24", "value": 1894312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679379145, "uuid": "a8f8628e-5150-4938-8bf4-14f2d9022245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379145, "uuid": "6898ff45-9737-412c-939a-26b3b2d30cae", "value": "AdobePhotoshop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d95a95b-c7ee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406290, "uuid": "19222681-e745-4e75-8c20-b17456c876d5", "comment": "Malware payload", "value": "463053169218b1ff7ab65e4a181fb5f3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406290, "uuid": "77a3ef8b-8a45-487a-a7f4-85f9c535209d", "comment": "Malware payload", "value": "7ab0f97af5956c1d9807ce947249c3f68880dd0539753808f633ed48048f8504", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406290, "uuid": "8d71e4fb-32cf-47d5-9520-fe596ca0f85a", "comment": "Malware payload", "value": "94bf8f0c28de0351b65115663885d9f81807f540", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406290, "uuid": "e083e203-f282-4ded-940b-bab896401fc4", "comment": "Malware payload", "value": "73a6aeec555ec5ae566cb8f6059ef41c3cb92585b54744e1c3baaebea00a15cfc59cfe08783a0496568823a8ce888dcd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406290, "uuid": "e487b91c-fc4b-49b9-9d58-e37fa4cfe7ec", "value": "T109665321927279DDEA63A2BFA1ED0FD5C111E0F0E509DA3B63792BA49ED130531E3943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406290, "uuid": "7c7d8d8b-a850-4c4b-8281-477f174acfe7", "value": "98304:uY5AP531P9tHq+PXq7Ud45OByH7hsMWhFy96hDmag2ESIqGUW:45357Xq7UC5OgbhEFyaDmazE0HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406290, "uuid": "c7ba8148-1479-41f0-8903-725a15005cb3", "value": 7062528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406290, "uuid": "ba36c3f4-a6c6-42d4-a8ec-9524ec4653b1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406290, "uuid": "f74cfbd8-553b-46bd-aad5-da120aa314d6", "value": "\u00c3nDR0761yqvbwygv6z065uvjd9x.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4c5b10-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679391875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391875, "uuid": "0f7902f7-1568-486b-8d74-0ac38b00c847", "comment": "Malware payload", "value": "7ec1bc46354c3515e27d6392b1f1488d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391875, "uuid": "ecac8ee2-3424-46e3-9c1c-9cbe60782b6e", "comment": "Malware payload", "value": "7c6100cfd6b60032143cd16732e63bdf3aea6e5b13b37c115a071a88e76a3fdb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391875, "uuid": "9f665fa6-527f-4a67-a348-685684c81666", "comment": "Malware payload", "value": "253f407186b2da61302a3018b00a509b7ac6054f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391875, "uuid": "9c476390-2e11-484d-a453-b9a371fe2c55", "comment": "Malware payload", "value": "9aade6df5c3c72456b90a8910d86af6c6277ec2955dbbd759a32347c6dd85873524c6bd7876eb19c2be6b916727516d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391875, "uuid": "5ebb188a-18d0-4d41-a9e6-9c9e1d2e3cd2", "value": "T142C59EF21593FEC5672F3D48C00429449C1018A797AC96E8FCCA3A579BE9564EF9CBB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391875, "uuid": "38ed14a1-b910-4e40-8459-84b027095e9e", "value": "24576:4+lMcdXEn/FGOS/vm7Nd3coupJ2ny/v/LtGZsYjot0HKZndqM+qFOiG8z7ICqdlA:s/3vJKlThZLmYHlBJDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391875, "uuid": "afb7c706-dae9-4d32-bdf4-6c5063a545a4", "value": 2656256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391875, "uuid": "3db5fd8f-577c-49fb-8862-d53f1caef7a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391875, "uuid": "fe31ba38-7fc2-4510-9e97-7a6c9df20ba9", "value": "Qjiju.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2779553f-c7eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679404831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404831, "uuid": "0fd97532-5cf4-4986-973f-092b5455f6c0", "comment": "Malware payload (CryptBot)", "value": "da503ddb68a25aa665e0e15855ef4012", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404831, "uuid": "2a0a7009-7496-45ca-b433-6753fb218f3b", "comment": "Malware payload (CryptBot)", "value": "7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404831, "uuid": "eed486eb-d31c-4a36-8a05-ad7564662fb3", "comment": "Malware payload (CryptBot)", "value": "0c016eb8eb016a1d0d36e1dc338e2766d40c7464", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404831, "uuid": "04895179-de33-4e1b-b590-f570f3dd0a89", "comment": "Malware payload (CryptBot)", "value": "2b7de733e160342535e7f395d69168aa8d3557a1b0c6cda88c11f595872acf93b59e6721acc9d208ed40d9f9c4181b55", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404831, "uuid": "175cbd92-fc12-40e3-9b45-ddf567857873", "value": "T15C6623B127551049F6D9CD34493BBDF9B1F12EAF8B419830B9B9FAC429399FC9602903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404831, "uuid": "d9faa58a-fa38-49a2-a576-d288321cda84", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404831, "uuid": "3ec10975-4cea-4c49-9b0f-65f6deb385ef", "value": "98304:fPTCG6TDhi5vXL1tnX5Iz3OIyN5RRZc2B9iv/BE645Z5rhnqrKUIqf5pQNVPoPY:f7CG6TQZLzkeIcRZvBQvq6erFQKqLQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679404831, "uuid": "c3393739-caaf-4d5f-8139-279430bd22e9", "value": 7072256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679404831, "uuid": "a970db37-fadb-4ce2-81ee-d3b999b1f69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404831, "uuid": "e2b7828f-0b44-4633-9412-bad1fe8a3d3a", "value": "da503ddb68a25aa665e0e15855ef4012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980fe222-c80d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679419622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419622, "uuid": "8b2eb89d-484c-4cf8-9379-fe60a9838bf5", "comment": "Malware payload", "value": "9b42c4e09ae59f235b7bb4266241f382", "object_relation": "md5", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "pw-775", "colour": "#C60DF1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419622, "uuid": "3cceff98-c9fd-4276-a8e6-4203b9c66778", "comment": "Malware payload", "value": "7db36ccba92cac87c9e4d574eba06ca0adb1d44b4ff017910bfd82af677a1519", "object_relation": "sha256", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "pw-775", "colour": "#C60DF1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419622, "uuid": "2b7e4d3f-ca37-4ff1-8f67-cb09248d082a", "comment": "Malware payload", "value": "43e8caf4709277a036e7d956c27b16c007908bf5", "object_relation": "sha1", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "pw-775", "colour": "#C60DF1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419622, "uuid": "b1dbb07f-e136-4687-b374-71e0bc4558ab", "comment": "Malware payload", "value": "ad18d0d7da62a543e2a68bc6f49e03ed14c5c258d943b9166b4e46d4dde024efee2504d9834f68f5e057cc9b70cbf15a", "object_relation": "sha3-384", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "pw-775", "colour": "#C60DF1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419622, "uuid": "b869dea7-a920-4fe2-8d5c-ff82abdb15b6", "value": "T11AA2F15DE333ED60C493A1B929890EB086595F0046B3E70ABA5357C3C762936D2F8F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419622, "uuid": "0a3c63b1-e7a2-4cb0-9c60-0f13139abf69", "value": "384:MKJFkwY5IR2AJflsgU3CZmk+KIRCNjkYgmQGGfw6/tiNeNfqu1D3XBXOyu3IEg5c:MsuyJfu3C091Ry9gmY/hNSu1LB+JIE/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679419622, "uuid": "72888dd5-a0cf-4218-aaea-5626aeb00bb7", "value": 22635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679419622, "uuid": "b7edcb5f-4b42-4ec9-9981-c2c688c03051", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419622, "uuid": "957d6de4-1055-4dcf-8fba-6f2a029af55b", "value": "Dolorem.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0160e9-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392680, "uuid": "57258754-d042-46ee-8d55-70c2a3bd9b6e", "comment": "Malware payload (SnakeKeylogger)", "value": "9b22c7ab22a4dee7d30e8986a389a5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392680, "uuid": "25283ed6-07b8-4355-895c-40cd448cf75c", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd7382e8afcca95cb6a3043ea4f4149fc8d76a4fcbd753adfc2c270f757de35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392680, "uuid": "fb69dc2c-a059-412c-8eb3-62d77500a917", "comment": "Malware payload (SnakeKeylogger)", "value": "db79ee5485c34c2ad80951d74cb35c7c8b746a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392680, "uuid": "ee70da85-59f6-4faf-b931-f7e5ab6b60c4", "comment": "Malware payload (SnakeKeylogger)", "value": "c0a3f7d5a883a8a542069c93a8aca272a8ccb848716812f013262d29de4302a697931bd9570584f77dfb06a97e6d7662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392680, "uuid": "be1dd950-7680-422a-af49-2e4d930070fe", "value": "T1A01501286BEA5335F5769BBE81A0355567BEA3A33703D98D0CB112CA07677034B81B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392680, "uuid": "94377f53-a91c-4dcf-bfb4-1fd30e6bb0c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392680, "uuid": "948641e5-94c3-4db5-99b0-5fa5b4b9c885", "value": "12288:QlhFTZygC9A+HShunvZKU2jP/z5Iy7B+lh21zgO17ibnhNyxBqNvVJKrgnFW/Nm:QxVRAryhunsjT5IS+y1zgU7irhUsJKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392680, "uuid": "4ada855d-c3f5-4cfd-9761-0f96fdee3b6f", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392680, "uuid": "62236085-50b1-4682-82b1-480bafa4c205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392680, "uuid": "eea49d9e-3cd8-4a32-982b-d3cb82955c63", "value": "09122_4940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62992fa-c7fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679412452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412452, "uuid": "6a9ccc86-f55e-47e7-8014-9b665fcde304", "comment": "Malware payload", "value": "d20ea90d3cb995380f4a17642c9b683b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412452, "uuid": "86de0ace-5652-4da4-bca6-e54657daaea3", "comment": "Malware payload", "value": "804029ced87879a1431aa86c48cfadc31d446f5c5dee5b4db650ca8e616f41f9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412452, "uuid": "5615f613-4389-4650-a131-e8f7cfbd1fe2", "comment": "Malware payload", "value": "92c94d1106901702a0f6ba17cb53dc63ca9f9be4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412452, "uuid": "2382452b-afc9-4302-b51a-783d2f45003b", "comment": "Malware payload", "value": "aa2c817650ee73a203354edb9a6027bf960a34f835568123526a72ef30886239cacec8d88c97a5756cf4f91693ebee3b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412452, "uuid": "142e44e8-36be-4010-8f50-4f6cb80a7cec", "value": "T1B6942328B3F19F8BD957D6B6A68FC0804054EE25D7C6F347A267BB3DA1717C01386889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412452, "uuid": "01e2151d-fac0-4a6c-81ff-88e670945ff2", "value": "12288:E73hHeXgqmY8VO3IsFRSXsnZppNo6sZMb:OhHeQqmvrWRSXU6Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679412452, "uuid": "08b14f5c-b469-44a4-88cd-364989067b72", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679412452, "uuid": "b62c01d8-720f-485a-8b76-f053a620db60", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412452, "uuid": "6d363e6c-9af3-47db-a17a-9734b38e2b93", "value": "SecuriteInfo.com.Trojan.GenericKD.66024660.26979.23415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4488235-c821-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679428233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428233, "uuid": "cb3aa196-3467-43aa-a597-fe240b02d25c", "comment": "Malware payload (njrat)", "value": "0c1f581841ab2c65bf2115b88946f0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428233, "uuid": "a134e795-5229-45c0-8cee-ba2b98f1824e", "comment": "Malware payload (njrat)", "value": "813ed01bed69e0d9dad949c955476901a4806418ba9c6c725a74f2d67d1240e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428233, "uuid": "3a0df5a2-ea48-4a90-ae2e-228546821ecc", "comment": "Malware payload (njrat)", "value": "a28bef32ee6f578d79983ec920e51afc0e77712c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428233, "uuid": "f037b7b9-b4a0-46a1-8aed-c33c6e0166e1", "comment": "Malware payload (njrat)", "value": "1864df8c48b63c5a0a4ba74a51feb9b89884a7179156c51f69d19a5711c5799609f1ff290375cf304bfd9bb996dc8eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428233, "uuid": "dbafbb6b-65c5-4bac-865b-3c61dbd78668", "value": "T1D613D84CB694E175D5FF8BF0B492B2890B71901B9902E30F99F154D98FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428233, "uuid": "06d6f12d-0d39-4234-9fdc-7519f7696b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428233, "uuid": "63537af7-c749-4408-9c2b-0d6dd63636b6", "value": "384:uZyk04i9jTk7Vqb08yGLws3esM9tGHJIhYb69D9O5UE5QzwBlpJNakkjh/TzF7pA:U7Y5A8Y5Gksu9snvQO+P4+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679428233, "uuid": "17eebd7b-206e-4414-9f87-4f4c63e11605", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679428233, "uuid": "cb70adc3-21aa-45f3-9381-e557597db7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428233, "uuid": "c7861459-e3a3-4cee-a73d-1cfdb7eaaaf1", "value": "0c1f581841ab2c65bf2115b88946f0d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c469026e-c7fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1679412395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412395, "uuid": "071b8d08-d396-49ab-be57-8273a579438a", "comment": "Malware payload (Guildma)", "value": "d8c9dd71c654e4133c28f7a9cc65bc91", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412395, "uuid": "c9110446-b0b3-45b1-8f85-21dd05994fe4", "comment": "Malware payload (Guildma)", "value": "819ff19aca8276f218d99ed288bf3314fa02951688ab7d2c7d93e222f286168a", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412395, "uuid": "dc472baf-21fa-4e7a-a13b-eadf38682199", "comment": "Malware payload (Guildma)", "value": "e6aff7156af505b400d8660dac19573d9b4fae3f", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412395, "uuid": "7a127eb0-b99f-46b5-be28-fa6019d1a398", "comment": "Malware payload (Guildma)", "value": "d6fc248bede16c0d4398c45c6a968dcb2b0267f3c07ae20e5d28ddc342af9622be240ec1cb1a59f0905e71746f9c4879", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412395, "uuid": "febf2d61-c480-4cdd-ad0d-d4511afd5970", "value": "T1F1F0A28CB0ED2EDCC03C20354CFA6F082C183C072B856017029B4BC88E68D881E1EAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412395, "uuid": "539847cb-33b3-4969-8c68-e0920bf11d6b", "value": "12:8rflM8OBE6ZGQWgkRor72jdgL80Omb8m7EIC4j/p7LKn:8loGQWFRor72aLnOg8m7FC4BLKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679412395, "uuid": "1efd7598-750f-4a6a-bc6c-fc1c0849e211", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679412395, "uuid": "1ee762fc-a3c4-4c2b-a024-09a8edaa9d69", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412395, "uuid": "b1cb40e1-af42-4803-a563-16f126febca9", "value": "252_FLUXO20PROJETADO375.759608.88082.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0da03c-c817-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679423899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423899, "uuid": "11b93f70-5d34-4481-a408-8e275181c7c7", "comment": "Malware payload (LaplasClipper)", "value": "fe2457d4da43adde492576a91398086e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fe2457d4da43adde492576a91398086e", "colour": "#A8A6F5", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423899, "uuid": "6d4e6eb6-89c8-47fe-9a67-301c2b96f8ab", "comment": "Malware payload (LaplasClipper)", "value": "82a5d382c3b4fe2e17f09af36df20f1e53bb8b712ca6f7af9a15861b38f91f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fe2457d4da43adde492576a91398086e", "colour": "#A8A6F5", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423899, "uuid": "3712a2bb-7b1e-4c8b-a12a-31b0596ebd3a", "comment": "Malware payload (LaplasClipper)", "value": "8c7c1efd47044f1d31cee78ea6c73df1a9296dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fe2457d4da43adde492576a91398086e", "colour": "#A8A6F5", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423899, "uuid": "a90f758f-8533-4cf2-8f62-d060e30ef349", "comment": "Malware payload (LaplasClipper)", "value": "7f18801262cec8e9d8bf9edc95c183b44663bcbbdfa2b254671b66e47ef9bdf9afa2d07b9d2ec0a936214a293a8ba4aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fe2457d4da43adde492576a91398086e", "colour": "#A8A6F5", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423899, "uuid": "1d12975f-4d2b-4694-8f79-9f5843227898", "value": "T15F965C52F99777B1D90218303132737F1B20DF394B24CA9BC9507EA9EB72BA214365E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423899, "uuid": "ae0bb3ce-adc6-489f-8f5b-240c7746e9b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423899, "uuid": "81634283-b518-4a87-8683-5fd10efba6f4", "value": "49152:pKnK6YN8UMtKNKogIHvueIxgfSZJxUu3INODRUgeCseICR7NWm8qpHakXvLQh0/o:on1YN8dKNcJxtISeCrXv0W/qpDRX5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679423899, "uuid": "152a7ac6-a121-4d93-bdc9-797e09c648ed", "value": 9068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679423899, "uuid": "044c8258-e87c-4864-b9a3-10adda139a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423899, "uuid": "64af08d7-2c18-4d39-a88f-952a9fe2ada0", "value": "fe2457d4da43adde492576a91398086e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66c2cdb-c78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363463, "uuid": "08b5e885-82e0-46f2-99da-21afa516f302", "comment": "Malware payload (Smoke Loader)", "value": "187b9ba548e33b911ccd00152337ec66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363463, "uuid": "56344220-e6ba-453a-9fd0-bf3522d00296", "comment": "Malware payload (Smoke Loader)", "value": "8305ab139c2ea41d5bad8bbac33a61ec9852e87536f07ec205fd130ad7d0652e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363463, "uuid": "ed5c86af-5c5d-41dd-bf8e-77fec32a8e77", "comment": "Malware payload (Smoke Loader)", "value": "2872062aa7d5ae8a8e299f6fbcdbbfc0db41ae6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363463, "uuid": "7e2f1b28-f8e6-4019-bae9-5676f0ae9e98", "comment": "Malware payload (Smoke Loader)", "value": "a1af5306278b42e907aa6531fda1c69c2874c814045495832da3cd73b8ccb9132491bb2521c14d1d747bb42268db6a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363463, "uuid": "f92abdc7-062c-4353-874a-eda38504425b", "value": "T195049EC392907C51F4168B3A9E3EC6F4670DFC91CE5CAB65E3186B2F48BC1A2D562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363463, "uuid": "cef967ff-dd4d-4290-9390-ff727c4a1f87", "value": "b6299cf22bb1b2b906c76a98a991dd84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363463, "uuid": "ba6d250d-1ae2-47d4-9488-6dcece528d8b", "value": "3072:N8gZBzKotbjNS+d+VbkfsgK24YD6sqrsp4:xHzvDd+VIljnD6sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363463, "uuid": "c4f9dda7-25f5-47c1-b4c1-26616f4de7bd", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363463, "uuid": "2e29168b-04cc-43aa-a9c9-2e936418b2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363463, "uuid": "b57fd3d7-a7b6-43f8-9b54-7b5b9521587c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f07b8d-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363081, "uuid": "90857144-0294-431d-8c22-04f98241cdcb", "comment": "Malware payload (Smoke Loader)", "value": "40f76826e5122977c1e3402e70291e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363081, "uuid": "16ae279b-b3a1-48cc-99bc-2e7bbac89cc9", "comment": "Malware payload (Smoke Loader)", "value": "834a84ce2a96832afab2ff5f99388209120c060f66bd420e06168c71f090b7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363081, "uuid": "5e57edac-74f6-408c-8ebc-504a90c136c2", "comment": "Malware payload (Smoke Loader)", "value": "37be9ea9010c9c7a11da14e676af3227a40b77b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363081, "uuid": "3370b64c-2cce-4f7f-9a9f-6738f4ca5dd8", "comment": "Malware payload (Smoke Loader)", "value": "9321a1e45062d4672e58e8f85b3622f5243ba63fb1eeff2eb1ecaf6a6692466ae78d746b16430db0a0deb62fd91d296c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363081, "uuid": "5ea97166-bd85-4e8a-a4ea-f7d1beec5ce5", "value": "T14A047E039B90B861E016CAF25E2EC1B4B60EF9D1CE5D67AE33087E6F08B3161D5667D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363081, "uuid": "2b60f21c-ee33-4f44-83ab-99168d339fa8", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363081, "uuid": "79540509-8c2f-413d-b167-3350ea6c6d09", "value": "3072:JirKyb2kXnWqmMRIHAZ2TYJcpbv6Ur1NpfRkX0Z:dyqCm0IHAZ4mWbvh5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363081, "uuid": "5c3f91c5-a82b-4fea-9712-e9b508e1e4b7", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363081, "uuid": "0fde6104-96ce-43cd-ba10-0575aee8088a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363081, "uuid": "b22ec034-16bc-4c45-ba2b-82b45d52f4d4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d0a3ab-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392668, "uuid": "a56e7531-000e-4421-9e60-81a2ca172503", "comment": "Malware payload (SnakeKeylogger)", "value": "1a6348ea59df55bf0d0fbabc88307906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392668, "uuid": "9cc75e78-3192-4117-bf1e-ef5e6c6df309", "comment": "Malware payload (SnakeKeylogger)", "value": "8394f08d071bc49b7eb6c186c4d4c769b82483340e850fda350797889723ffb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392668, "uuid": "57e4bcfb-d67a-4f24-aa6a-d1c64e7c9422", "comment": "Malware payload (SnakeKeylogger)", "value": "6cc3c789a5e2284b528e7a85f32f7e8d38b70ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392668, "uuid": "8ae0ec3c-aacf-45f5-8903-129ecd070ab4", "comment": "Malware payload (SnakeKeylogger)", "value": "b57ef2faf30a814235d5427557406597decaf32280bd0d9ee11a83e2cf5124179f007d7e75976e4c6de8ceb68c653682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392668, "uuid": "298866c2-fce8-4d7d-aa99-12bad75d8ffc", "value": "T183255B424DBB11C6E8B74F5C547A76980B38E966FEC8503B3CC9B65A4FF9A4360063E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392668, "uuid": "b7f9e5c5-e5c4-4350-9138-a4196144e40a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392668, "uuid": "38f1266d-5f65-493e-b402-19b3b6e97250", "value": "24576:BfE0gGByDpKfTshTL8jVY/kUxgIVMpbXqB:5wKfWv+VY/xxgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392668, "uuid": "219c4cfe-b903-4225-ad16-4c9a1a953a91", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392668, "uuid": "666b0bbd-28db-41d4-a548-56cab04ea8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392668, "uuid": "7d07f4b5-1664-438d-8fa9-691deccb7774", "value": "1a6348ea59df55bf0d0fbabc88307906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ee63ad-c7cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679392022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392022, "uuid": "37ea1301-cd64-4232-bb44-9e8a8adf11d1", "comment": "Malware payload (AsyncRAT)", "value": "9d9a0a119044c6a83d533a1941bb64c5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392022, "uuid": "0a724b74-60db-4342-8f30-3dbe2e64f3b0", "comment": "Malware payload (AsyncRAT)", "value": "83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392022, "uuid": "8515001a-b9fe-40ab-b429-464f98d061eb", "comment": "Malware payload (AsyncRAT)", "value": "279387ccf49c5f71c99f8b89b333be4a70f6cab6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392022, "uuid": "bcf4eb78-2e46-41e2-be1f-16156143b796", "comment": "Malware payload (AsyncRAT)", "value": "fc799d639e87a56368300fd85cb27d91848ba6792775ce8be04d26b1595548a6f01bdfe216f406677e59692db6943ca8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392022, "uuid": "174c8cfa-a67b-40e3-b688-f00b0b41e04d", "value": "T10114230B819460A4E2B20F32A69EAFE3FD56C1D4BFC19DF66F59E1112D282718B211D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392022, "uuid": "f895c224-39ae-4ec4-acd7-1fb75886fcc1", "value": "3072:Xg4C8YLEo5xuIvDocDWjc/pgDXQgKpacezvRBDobwrArHMp1G6/AirUIKX6MA:XpYIW0UY8pTxp/mjmqArYRQIKX5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392022, "uuid": "11cdbdd2-d3a6-4a4b-b553-84706c311a22", "value": 195298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392022, "uuid": "dfaaf453-6c78-4c76-b675-9e7c51ad9bc7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392022, "uuid": "0e877920-6bef-4863-9b1f-4690f1c0745d", "value": "RG.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d006c14-c80d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679419631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419631, "uuid": "dc496820-6a9a-45e0-9b43-03078ce4e318", "comment": "Malware payload", "value": "a743fec327c49889ba78ad8135050df7", "object_relation": "md5", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419631, "uuid": "4dcaf82b-4880-439e-ae6f-f8b7651c7440", "comment": "Malware payload", "value": "8477b2737e6ba177568fd1e2f30838cb8acb751b60c4c1a9643d8bb0c95d5d3a", "object_relation": "sha256", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419631, "uuid": "362afd58-a1c3-4283-8845-2f774f178e6f", "comment": "Malware payload", "value": "cefec0f3f74fd25943e9aa7c2ad27f317c585c3c", "object_relation": "sha1", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419631, "uuid": "e3da9dee-7439-429d-a2d9-9ac974c703d3", "comment": "Malware payload", "value": "491e25ba0ad1823400fd4efbaf19e4a754793e3ab5443af1e8d348260a863c96789b1869782a89655c1a4c447c5886a4", "object_relation": "sha3-384", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419631, "uuid": "6a1599fc-6c3e-407f-8ae5-f222065a74ee", "value": "T11C43E8501A4110572BBBBEAB9B646855E5782E2383409207F4BEB207FFEF54CC9E09F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419631, "uuid": "b1107102-2540-4b2c-892f-e50d867639b4", "value": "768:cIgfbO2Wa+/t8AUk/Ocg+PJ5pY23uDLryHnCMGfyOcAFYS3DV+6zL:cIgzO2WJ8fSoiufyOcA2kk6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679419631, "uuid": "8d4a89ee-c1d2-4b16-ae0f-ff847b4aab89", "value": 59448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679419631, "uuid": "945cf322-0987-4c8a-ad58-9faa64d896e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419631, "uuid": "af5871e1-7af4-4ea8-b89b-f1dff0c53fae", "value": "Dolorem.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba185be1-c7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679408513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408513, "uuid": "ba9e0828-9ea6-467d-b1b1-827a3656b621", "comment": "Malware payload (AgentTesla)", "value": "cfd458524b32490c9e1223506d8d2cdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408513, "uuid": "27513dfa-0eff-44ac-bbe4-abd68a4ee7e5", "comment": "Malware payload (AgentTesla)", "value": "85421dd4f81eed1d1e6c4067e1c8af898dc4a6e99e755dc380fe017502e22ad8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408513, "uuid": "2d5446ff-af93-45f7-947b-468ea5c158a4", "comment": "Malware payload (AgentTesla)", "value": "ac206d737419ba25049ea6ff11e7301c5232ca05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408513, "uuid": "ce99aee7-0f67-4984-9f51-1542799f8afe", "comment": "Malware payload (AgentTesla)", "value": "acf803e85ae648a26ff879e74d5cc94d68f3b3b5dd92f830b8f5c94dfcb8c04051cd8094b2c1aad607c741992dbfbc04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408513, "uuid": "65be97c8-fd42-45b6-a93c-bf4c9cccb049", "value": "T1C7354A424DBB1186E8BB0F5C647B76980B35ED62FDD8503B7CC8B65A4FFA64260063E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408513, "uuid": "b6cf567d-7f12-43ac-8e2e-d6d083d57a80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408513, "uuid": "4566496b-937d-4fe9-bedf-765df7ed7e4d", "value": "24576:K03kEo1cAFRn3z7Sh4KOXH9gFJsBHyYRwnbKdE9pHc:81f1fSWH9gFJOHrRwnb2EH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679408513, "uuid": "d17a653b-a261-4453-aaec-916ffee6a1db", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679408513, "uuid": "b92fa711-8048-4b15-baed-ecfb0518e535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408513, "uuid": "d7469ba7-54bb-4451-9545-32bb3e230f14", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff48c9db-c811-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1679421514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679421514, "uuid": "112eba17-b825-43e8-bd80-a65968e60ee9", "comment": "Malware payload (VectorStealer)", "value": "8b00956371455a2cec3430013108263c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679421514, "uuid": "e8365a55-7800-4db6-8178-b89ce043bcf5", "comment": "Malware payload (VectorStealer)", "value": "86e233cb75b893c9e4e0d26385155c4f575e4217f2d52cba592641c996bc9cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679421514, "uuid": "79a7031f-580a-4342-af0e-faccf71172e2", "comment": "Malware payload (VectorStealer)", "value": "7e4c0599f6c94762172431f522ced9873b2f01f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679421514, "uuid": "c1c36347-6681-45c1-a144-377c17fe96fc", "comment": "Malware payload (VectorStealer)", "value": "c3b875c0bf1049c7da167ba86838bc58460b1971727412c38233b681e44800058da406d7b2d072297ad2f4b476b98bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679421514, "uuid": "c95f4e96-d848-437c-a5b8-6b6e467f57b4", "value": "T1A585BDC24334480EFDA01E7E335564B3DE53DD99D8EBB2AF1A97BC2A64F844405CE962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679421514, "uuid": "7132cca1-36eb-4e8d-82ba-2e43ccf649c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679421514, "uuid": "222b0cf8-0006-4a5f-9561-82905f763d18", "value": "24576:Zr9N2v2XcyPon9gjLP2f1a5fRC7BmUITNKpM7F89ioA7sg1YtCb:Zh8WcVKjL6qfR9xKuB89VKpYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679421514, "uuid": "9771c193-b320-45a2-88f6-39b134e7591a", "value": 1729024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679421514, "uuid": "abd30f8b-b721-4ca0-b8c6-80f0b0ed0634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679421514, "uuid": "9a76ebff-7740-47de-b19b-0408225eedaf", "value": "CTM ARRANGEMENT BREAKDOWN DENOMINATION - MV NEPTUNE_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49cad92-c7f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679407752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407752, "uuid": "c1f4850e-cb9f-41db-8632-9659ebb131bc", "comment": "Malware payload (AgentTesla)", "value": "11473570b2c0b832a185c0686b299617", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407752, "uuid": "f799a3d3-b2a2-4ab6-bec0-786a6c94ded3", "comment": "Malware payload (AgentTesla)", "value": "86f672c898c07fb25235035b30392a1f1fd490efd425855cf840899f8a755b46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407752, "uuid": "e9eaaf33-21d5-4dfc-a484-b542e5dd3285", "comment": "Malware payload (AgentTesla)", "value": "c09591561f28ef819b0f5dd12e257a6bed7a7926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407752, "uuid": "9f8b5854-c897-4220-8e73-df942046f246", "comment": "Malware payload (AgentTesla)", "value": "8150e4bcc5851e21b3fa32a0aba1688e6e3b263acf6e07ae00296b77249613fc643cd581572233bf34135a94775f0241", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407752, "uuid": "3ad9a071-0073-4183-ae2f-fd2f5c8bd3e0", "value": "T1E3854CB25193FDC8973F1D44C0042B40AC501C97A7BC9698FDC92A57A3E9964EFADBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407752, "uuid": "41a06238-db52-48d4-a24c-6236d20e13cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407752, "uuid": "92552b9f-b79b-4f20-9b29-6f93b624adf6", "value": "24576:a9Ot09OX7l348A5NyiQyNUCKesphWrtZs5ovKOlpqAHk7A1dsIiilifApOLLQ094:a6jGv4APpoj2yqKP4Z2BlC2Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679407752, "uuid": "887f8183-5056-4deb-b496-8ec479bdb892", "value": 1746432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679407752, "uuid": "38e81f82-3700-4900-b817-b7b7927ed301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407752, "uuid": "1a2a4471-7f03-4654-9bee-9a10bf56dc0d", "value": "Documents and Personal Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6f5bf2-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679393407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393407, "uuid": "0f34c05a-c917-44fd-8b3b-185ad74494a6", "comment": "Malware payload (Formbook)", "value": "0f9dde6bf858d90584b6e9919719b6b6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393407, "uuid": "0e34391f-04c8-48d0-b1b1-4fa199d70999", "comment": "Malware payload (Formbook)", "value": "87c35ff97227cac466f0dae47ba41a1b81fc197ba4a2dfc87cb855226e0f327f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393407, "uuid": "4e7a2a6a-25b6-4036-aecd-274429b99807", "comment": "Malware payload (Formbook)", "value": "e2a952b3685e6a9c4919aa213566e2fdd9da956f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393407, "uuid": "90253fa5-636c-4164-8ae8-58e211715c23", "comment": "Malware payload (Formbook)", "value": "44fa2ad1e66e974675ad7aa28dd7d6f7e2852cb00e9fca4c1779d7266120f34a2f652152ebd411e0c538b7bfbb93c663", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393407, "uuid": "1fd1229c-7d30-476c-b06a-0342f12bd336", "value": "T167541225B698C067C8920F716F7B4BAB5EDAA8201D7C030B17404EA57973B91ED1EFE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393407, "uuid": "ae382b41-4128-4360-a6b7-6603636b1cde", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393407, "uuid": "c22159af-4820-4001-b720-6298878ffc1f", "value": "6144:/Ya628LIDZh+vssOe/rgoIghmJppvtbKT/AhrqDL0haVzC1LL1HREvivPg:/YY8UZ0vXlFhmJphjhrZhumtL1HR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393407, "uuid": "b1bdd943-126d-446c-bb13-df711b0e5028", "value": 298356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393407, "uuid": "8805ea4f-a998-40f3-acb1-16913ea22b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393407, "uuid": "06393c0c-7952-46e4-8a2c-73e206890bc4", "value": "DHL Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7144d5-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392655, "uuid": "ba6ff800-c2d7-4931-a0fe-4963411706fc", "comment": "Malware payload (SnakeKeylogger)", "value": "a4784e13c09a89236d560297a097251b", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392655, "uuid": "f326658e-8863-416e-b00b-b7f06a94f41c", "comment": "Malware payload (SnakeKeylogger)", "value": "87f6e2b80a5bcac6acc8cc18da81dda86c3ed609f9fe9a6880b913ad107afc11", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392655, "uuid": "5b5414e1-e9a0-4f05-9c9a-c5087b71d68d", "comment": "Malware payload (SnakeKeylogger)", "value": "8da18ace70281f41055df209162ba9f0ffaf39d7", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392655, "uuid": "1312997e-d626-4035-97a9-f5f73e069154", "comment": "Malware payload (SnakeKeylogger)", "value": "4c931810b557ea389f753763c3cd1bcb111be0dfbe078fa8f04af249cbf68597539f4f237d20f821f78c3dbdecc0b02e", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392655, "uuid": "bb017f6a-2b1e-4b06-8113-1d4457a3bc5b", "value": "T16F341208B2B0E153DD664B716E3B06BB7F95EC5310A8170F33689789B962383E71E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392655, "uuid": "68548355-cb4c-480e-b46c-562211c0b2cf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392655, "uuid": "2ff6dfe5-fbdb-41be-814b-07c3ace63633", "value": "3072:3fY/TU9fE9PEtu8b31XKZ5fJRW2oaDp7H0+E2kHrXw2xpCZhSUldFA11H5w8pMGh:vYa6I3185TWBaN3E2OHxpCFFClJBUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392655, "uuid": "60958140-2aab-4048-9cc1-c49aca8a8a51", "value": 234671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392655, "uuid": "276cf123-58c5-4990-b50d-b8719ca54428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392655, "uuid": "d3683f91-3dc0-47a8-9d4b-aad9e7b02195", "value": "PO-768865465.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4772f9-c78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363421, "uuid": "c047b8d3-d0f1-427c-b5d4-fd23da400382", "comment": "Malware payload (Smoke Loader)", "value": "20578a6db019d5d715f8735f69bcfc8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363421, "uuid": "81654baa-8486-4888-bed8-760237f5e339", "comment": "Malware payload (Smoke Loader)", "value": "88195941c3648c7ffe5991fba09d9bcd153e6d939e47c96b9caf2f30ea28e9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363421, "uuid": "3013a52d-ec97-445d-ba50-0400bd8b1a54", "comment": "Malware payload (Smoke Loader)", "value": "d97352370b9b61160d7eea789fa723e87f0491ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363421, "uuid": "c8de12fc-6662-4bdd-a508-c3f853f66d9c", "comment": "Malware payload (Smoke Loader)", "value": "34ef29ab60886cdc5e05b7470b1475fcd8c1412a43e83f46663287f6773464fc317f6e9a772795bcb529a3c060f854d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363421, "uuid": "be6fafcc-95ed-4d28-acfb-5df0681fcb6b", "value": "T1A6049FC35390BC55E4168A358E2FC6F4671DFD91CE58ABA6E2146F2F08BC172C762702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363421, "uuid": "86caf01f-b0df-4e27-923b-1568e3da6f1c", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363421, "uuid": "2eb664b9-1d53-4ed7-80d6-9e9008e86f98", "value": "1536:IqEWANMYQ4Bo1+wFQ9g/eaAPUoWtSiBD0/hytJhUpl8JjvDoxjSYDOBl8A/xqRhZ:Iqa6CaFyaVoWthBDEA/nlf+OBleR91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363421, "uuid": "8536c187-963a-4e74-aafb-c4e9ade6dfbd", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363421, "uuid": "706d8891-f1b5-40b8-8d4c-c72288519924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363421, "uuid": "059e9b53-d718-41e7-a187-d84c52b08a14", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39b86ac-c787-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679362223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "e8fe4f98-d602-4c5b-ada0-06bea5eb3471", "comment": "Malware payload (Stealc)", "value": "561ed2d07c6a8e739b1d1ba5979b13a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "2e1adc24-f448-441f-b636-3438cd78d0b2", "comment": "Malware payload (Stealc)", "value": "886c3d89d68ecf8d0d4b7ba45ea28f0474ece21a234c54b7aa4350342688c35d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "0d79a9ee-72be-4451-bd3d-3031c5dec770", "comment": "Malware payload (Stealc)", "value": "21c4f9b0fbc80850ff84193d0c458bebb0240889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362223, "uuid": "ebf8b85f-b566-47f5-93f9-913376a453d0", "comment": "Malware payload (Stealc)", "value": "8351e142be6ca12bf6d1b9938bed0c184e80828ab5f12efdce4c0d4e8131b907e69de199d7425507c438237bf208195a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "f61cb9e5-e513-418d-81db-95e598b3f7e9", "value": "T1B015D63CFCDC4E42E6188E7599E01E30F1A658F512C5E6278A90EC7937C666CA38D7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "15442266-4f70-4eed-8e22-5747c63e63e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "c0f2e463-e285-4978-bb63-50eb93444da6", "value": "12288:Zzb3z2MsKdO3E9htHCEauFRqVc6/Bq6Yi6Zmh6h8h+7ycEvgj+ijIm2URI:R3ty/hgycEvgjJ9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362223, "uuid": "2bfdaab6-1500-48b1-9fd2-bdc2caed158b", "value": 952928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362223, "uuid": "d0bdfbfc-2613-4105-9200-c33f2a0a532e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362223, "uuid": "6ef9f77d-d440-4f51-ad5e-5c806030b54b", "value": "561ed2d07c6a8e739b1d1ba5979b13a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6567677-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679362523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362523, "uuid": "83a754c2-7948-41b8-b024-184f4ed758f7", "comment": "Malware payload (njrat)", "value": "56adfb1405dcba693c73ba64a9d1c463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362523, "uuid": "7d01293d-35a1-419f-b349-e15231de65d9", "comment": "Malware payload (njrat)", "value": "889a5de641983dcca6e2a91b1442812e84fd17821c7117f965f751bea5eb4067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362523, "uuid": "854b6131-4e4c-4a91-ab57-34d0d7d814bc", "comment": "Malware payload (njrat)", "value": "294664d8ebda0f36572a1fb44c84a1df55376493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362523, "uuid": "5312ec7f-09e4-4713-99c1-f31beaa79508", "comment": "Malware payload (njrat)", "value": "25ea1e152027b4f908895342fb85a0725581913f0788d1f0c859c301c01b74afcdc646de804b4dfb398ea14404f1a2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362523, "uuid": "0042d833-82f0-4007-939f-1b74de313f44", "value": "T11B93D84977E56524E1BF5AF75471F2004E74B48B1602E39D88F218AB0A33AC44F99FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362523, "uuid": "6b2c1aba-d8d6-409b-ba37-8ff9e50b7d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362523, "uuid": "cbeb9706-cd4b-4663-ab12-292f79a9bba0", "value": "1536:ZerkVbPGHz88Ebb1pjEwzGi1dDXBDrgS:ZekPGHzmf1mi1drxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362523, "uuid": "2df59cab-ed43-419d-89dc-36fa05ba4e9d", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362523, "uuid": "8af7011d-6f8c-4446-a3ee-4214af1adde9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362523, "uuid": "b38bf72e-152b-4557-a804-8dbc596960c3", "value": "56adfb1405dcba693c73ba64a9d1c463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3320e9a9-c7e6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679402703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402703, "uuid": "ac2068c2-2092-41ec-8cc9-62f01369853d", "comment": "Malware payload", "value": "f562345e24bf73cfa0f8f24cfdd3fc5a", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402703, "uuid": "76e44018-d6ef-4fb8-b52a-663d39756ed6", "comment": "Malware payload", "value": "88bcc4e83606ae1b5137d5b60270bd99cc45f96df2c0c8737a2a5281ae121a50", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402703, "uuid": "b93185fd-6830-4758-9998-6bd4e5385cf6", "comment": "Malware payload", "value": "f06bfc5c886a205a49dad32bb7048d5b876f75c9", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679402703, "uuid": "4de30086-b637-42f5-9ce0-d0223a0eac2d", "comment": "Malware payload", "value": "f8eb8f2ac59d182f0a7458853326a0cddc5c7c968e41827476e1e232230e45ae1306c46292fff18ec68711ec30979ddd", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402703, "uuid": "aa141383-42fc-45b8-8ebf-3b779c9a4268", "value": "T17533A5094D88995B8273B33AEBA38559FD23216303625631FFDCB2061FB545846B2FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402703, "uuid": "98670204-e6e7-4140-ae66-d283bacdc0c4", "value": "768:ZFuskTt6Eiz/7pvB4Otk2Rb04l2lJ7+4C:ZFuskTt6EA/djC2Rb04ly44C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679402703, "uuid": "134fb0cd-49d2-4dca-b744-a1531463614d", "value": 51277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679402703, "uuid": "6bddbab0-3fd8-4471-86e3-10e1ce98878b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679402703, "uuid": "3a20d0aa-4db9-44fd-8851-3390051ed326", "value": "Fu3D5tVi.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c563a104-c7f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679411109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411109, "uuid": "bb5d00ba-11ce-4267-88de-4401f14f09f0", "comment": "Malware payload (RedLineStealer)", "value": "97b589099711bdede9eb471f0ae4f4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411109, "uuid": "ed2800f2-f7b0-48c2-a27c-beb7a916ca25", "comment": "Malware payload (RedLineStealer)", "value": "88d5bc87678592caa4efa83ad84b0120d3701f58a4db4b86902c4d7bcb164707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411109, "uuid": "fd3e4cf0-cbda-444a-957b-c9a53a76b5c0", "comment": "Malware payload (RedLineStealer)", "value": "cb257627fb1114373ab3dacfbddba2449b54793e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411109, "uuid": "1c29bd08-1dc4-436f-9b5d-cc4bfbcb6ed2", "comment": "Malware payload (RedLineStealer)", "value": "ae8fa896b20dedc98cce0138ed3c22bc32c10166c24f2979c57677be930eff84e20772bd69c1ff63ac8024f3e3a36943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411109, "uuid": "d23239f9-4e04-494f-9868-5598e7f5d1aa", "value": "T16E64B61382A27D45EA25CB73AF1FC6F8B64DF2709E497B6532199F2B14B0273C163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411109, "uuid": "21ce5671-11ea-4e7d-b02d-15569aaf6d89", "value": "a1987c4dfef703391c65547d45eb7acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411109, "uuid": "61c33a85-3d17-4bb2-bf80-154704954bac", "value": "3072:r0LebWULICF7zpxLRtEr6SvpR+0+E3bmPz0q0OYmLHLy5Z/UnWOL2vRDhGFpy100:rBWULTVzZtEr6SBRNO9YkHLC/4WFOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679411109, "uuid": "425199d7-be3e-4d9d-ac58-efd509f5194a", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679411109, "uuid": "4581728f-0e04-41b5-803c-f6d5c3a4125d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411109, "uuid": "da6032d8-1508-40f6-a93f-1a25d14d7645", "value": "97b589099711bdede9eb471f0ae4f4cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000ff6c9-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679393598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393598, "uuid": "dcf8b92b-e923-4058-add3-1c6715807907", "comment": "Malware payload (Gozi)", "value": "9f97ecab04f448021e196d0c14ea3680", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393598, "uuid": "65f214c5-72cd-4e30-9902-31b76698911b", "comment": "Malware payload (Gozi)", "value": "89bf7b68e0274df1cf579835206a8b4fcc4b9a260aee119186ab1dc8575cf2e3", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393598, "uuid": "03b42c89-6f25-4e54-9447-236fadfcb2cc", "comment": "Malware payload (Gozi)", "value": "0321de523c2d087425de5334e567dbb019173d7c", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393598, "uuid": "7b7320a5-a747-4bfb-9b5c-e9fda17d6437", "comment": "Malware payload (Gozi)", "value": "618cfc5b2a7cc0d9050942f21afbcf9140f75dea73b053db02535e79295031c8b7b66e58b1f2099968be641edaa049ef", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393598, "uuid": "680eb8f8-1e3e-419b-b393-80a6d279a187", "value": "T1E3E31250519FE84DDC0892A2E52E76BEBB9F77A2B0C420D5EC5F956ED0C0E01E80BED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393598, "uuid": "8d7b79d4-e7b5-40f5-80e1-7778a189dde0", "value": "3072:mddn4WiOLVM25WPqPyk4fCWvmKNzr7D8hzkvm666NwJdw57ftCYw5w+:8dJid25WPqPx4vdxr7DJm6666JdkTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393598, "uuid": "d6868571-08f2-4d57-9360-6b0868fa7bd8", "value": 150650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393598, "uuid": "10c6ae54-05a7-4466-b744-7acff6ad98cc", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393598, "uuid": "49839f6e-22b2-490e-a6e0-bef41f51e4fd", "value": "RIMESSA_CASSEGNI210320235059.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dbe903-c7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1679398679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398679, "uuid": "8db89887-508a-449c-980a-7a67dc50406d", "comment": "Malware payload (PureCrypter)", "value": "f8bb3cc761edc0a912b91c14d39edc29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398679, "uuid": "55080d97-7341-4c6b-81a2-fb0f13a0e39d", "comment": "Malware payload (PureCrypter)", "value": "8a2b7b7e8fefc70bc7ffa993ea416b2d844ca90f4659b60f9a80b7aebcd3f57d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398679, "uuid": "493343f2-b26d-4629-b599-bb6d04940a25", "comment": "Malware payload (PureCrypter)", "value": "df5f74454f930b65fb2a1f4d25493b401c528028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398679, "uuid": "a674f8b4-6806-48ec-ab29-da5fbf68933b", "comment": "Malware payload (PureCrypter)", "value": "01785d2b4ea486e49330444147723247e2da21d2141d2059a026a4f77c9cba4fe9c8f7342baa0ec98172835ceac91638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398679, "uuid": "a74507d3-aeb4-4fe7-9a13-1f74cf42f06f", "value": "T113360225229C91C9D17AD039C9864AABE7B57C428374DBCB0560BDA93F336F56E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398679, "uuid": "bc215067-7ca8-4252-ba6b-15aaa0e11353", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398679, "uuid": "e5226e63-e2da-4984-8f8b-d400190df995", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXG:tV44xgrwo5tLMKRUGrMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398679, "uuid": "0e4c4ce3-0926-43b4-905f-7f0374eeed84", "value": 5114973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398679, "uuid": "d4e1d30f-5675-4d8e-a024-544c9c6bbb95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398679, "uuid": "3c0c4259-52d7-41c1-aefa-3f4076b9d1a4", "value": "f8bb3cc761edc0a912b91c14d39edc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2cff08-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392657, "uuid": "72a937de-8669-46e6-9a2d-644cdedd90b1", "comment": "Malware payload (SnakeKeylogger)", "value": "368686236abe1d5f442d289ba8ad0af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392657, "uuid": "291ce5cc-75c5-41a2-9e77-a59ecd3c37c2", "comment": "Malware payload (SnakeKeylogger)", "value": "8a7f029bde9458749988b3b3df77cdd2dcc4d2302a244cd8b4fdd6b6348a0d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392657, "uuid": "b74c9a00-9631-49f8-a11e-216d313084e5", "comment": "Malware payload (SnakeKeylogger)", "value": "28e2d786bb80b2b2928e12cf1148489938581f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392657, "uuid": "d03ea73b-eba3-4ba0-a794-e34dc3e81391", "comment": "Malware payload (SnakeKeylogger)", "value": "a0a959f4b78f23139913c0b115a3c9713809c7f07c94c30364355e54276456958b7776a0c6b9a0b20a576c389e44eed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392657, "uuid": "ddbfee00-f4e8-49fc-ba99-218aed548738", "value": "T181F4011A73A89943C2995236C1D34564177198472B73D7483CCE13826E0EBE7AE8BBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392657, "uuid": "1efdd335-bf38-4ffd-a016-781db5eda1b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392657, "uuid": "c33da38f-1d42-49af-8fb2-39230599a431", "value": "12288:2Nh5nXW9vO5OVzfvCLUo5avqa/cFZDpiWgBpt8KzgTwsYRyA87/UQ0pNyi4+:20TfvCXHaKZo58CyAG/UQGNyi4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392657, "uuid": "283a61cb-2eec-41b2-ab50-d735a4376fe6", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392657, "uuid": "b8ea46f5-b7ae-4d7d-9968-5207a6784f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392657, "uuid": "1c56e78b-d254-4114-8f51-d14e589293a2", "value": "Balance payment copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b26a857-c7c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679389885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389885, "uuid": "bfe7ea39-aaae-433f-90dc-290d08105f34", "comment": "Malware payload (AgentTesla)", "value": "4864f22e8c458e498bd8dc2b3410b07b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389885, "uuid": "80071cd5-5591-4b54-82df-d16470fa2ea0", "comment": "Malware payload (AgentTesla)", "value": "8a9dc2573d3426c1515767a8d2b265ce2c96258bdabd9a90b194cdc0ca391bce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389885, "uuid": "1f2268b5-c25f-4162-a9b4-48826019e352", "comment": "Malware payload (AgentTesla)", "value": "c48ee258e2df18b06fd42111e61c272e64edb92d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389885, "uuid": "f60220c2-a684-4bb9-af93-4938661df50f", "comment": "Malware payload (AgentTesla)", "value": "ae971c920bd7663bdefd1e9fbbba60a8b3db701025eb91384b8d2d892713e6d3d22498c0ea851ac41c081431f2789e79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389885, "uuid": "29de4376-5222-4e9b-b29d-c79b655e8689", "value": "T11105022A73A8AA16C35E663AC1D712240771AD832332D7153DC612551B0E7EB5D8FBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389885, "uuid": "c2d9264f-e6fb-405f-8a66-ebcea7c4fe53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389885, "uuid": "d256bd37-75dc-496f-9d56-9f8fb86e1352", "value": "24576:nhyJAVO0zxytfc3xmYMS4Nt0/A9/kbz68dpIu+f:n9Vy23xnsNm/A9j8fIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389885, "uuid": "4ecbf30d-d0bb-43a9-be0e-adf129d8a4f3", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389885, "uuid": "8855f1ea-dcf2-4dea-8964-c5682aa63792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389885, "uuid": "89540ed2-ba04-4d74-8884-e5f020494645", "value": "Payment_request#52785.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e25ad7f-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1679397675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397675, "uuid": "16b287d6-470e-4c41-9bd0-23db11542c97", "comment": "Malware payload (XWorm)", "value": "827710efe58d1b6470dab05ba86d9c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397675, "uuid": "6ed4c95f-f204-4ba0-9279-c3b83e1457d0", "comment": "Malware payload (XWorm)", "value": "8acc5e78093d75cd1679b3314f7e79d8a3135a51a65d92d6fe36ed263e6a5860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397675, "uuid": "82042c91-da08-48f5-b01a-2b9aff2431b3", "comment": "Malware payload (XWorm)", "value": "c6be0ab758871cca8a1af80af7dd16cdaecc6ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397675, "uuid": "30d25270-0282-4d92-9d0e-d52857db1101", "comment": "Malware payload (XWorm)", "value": "77432064daba0cef7b5cd38ab8e1ad758e1149652456b9c4aa57b986f0522c250d4cdec54207a38180dbff002203fbca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397675, "uuid": "bc27edbe-227c-46ad-b8b9-3dd91d3f3802", "value": "T16F14FD82715E4447F7232DF59C0ED90021567ABA612AF60D2593BA2E85E237710EFB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397675, "uuid": "131e7113-dd31-4cbf-a159-092fc11dba37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397675, "uuid": "80ad9711-b9b9-48cc-9a8c-34bbe4f12e12", "value": "3072:zXLwTyrTmOwxqPoEqgnh/7rIJCYbCM5h4yLcAZPnJwrfqwlXWYDXsANAEA/jvApZ:zbwTwwZEqgnQZa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397675, "uuid": "5dfedaa6-83d5-4575-86dd-ca2f7fa7f392", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397675, "uuid": "8ba21773-f58b-470d-87bb-3aeedd39c599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397675, "uuid": "17bb4d97-7de6-4dfe-9759-80f2ce913b0d", "value": "Order_confirmation#265363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957ac61f-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679393419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393419, "uuid": "71e802db-f5a2-46b6-bd00-59d1e11f348f", "comment": "Malware payload (zgRAT)", "value": "adb18d5afdfbf1a99b91ccfa72e5d80f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393419, "uuid": "314a9895-4406-43cb-8dd4-1a3c998a3f71", "comment": "Malware payload (zgRAT)", "value": "8d278172242da77f4bf8bac9ec90152300bde595f8e29de216369ea9dd07abde", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393419, "uuid": "2547aa67-1482-4f31-b478-da8c242f5f0c", "comment": "Malware payload (zgRAT)", "value": "5a625a5fcb45253d729b5d361b70ad38abf588d1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393419, "uuid": "013be412-a9ef-4a10-9bdc-e55342f1d1a5", "comment": "Malware payload (zgRAT)", "value": "1e149489275a6e0122dfde42b813e110cab4433143afac95d118f854b69f9bed3cc13c329e1b96b40270f54d5c29ac5a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393419, "uuid": "5f934925-61d6-4fa1-9b18-9583f37f4408", "value": "T16D617C1457EA0708F3F2AB3AA9BE52594E3B3956ED32C74E0059414E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393419, "uuid": "cb1738fa-e1b7-4ced-9499-64213bb77c5f", "value": "48:8wHanU9Dmel0iglZ+JRslpQfYj1sAT1rTRRSJxodgImcC:8wHPB0+JR86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393419, "uuid": "70ba87a4-cc4c-4177-85d2-6b48f59effcf", "value": 3454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393419, "uuid": "b04c281f-fab6-41db-a95c-2180b2f9ff2b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393419, "uuid": "d812779b-03f2-449a-beb4-1eeb36181d86", "value": "ProductSample.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3d93ae-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392679, "uuid": "8f3ed451-06aa-4381-a4bd-8f150e0d2674", "comment": "Malware payload (SnakeKeylogger)", "value": "a49e5a458b1f972969cb3c0bb3e4430a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392679, "uuid": "1b1672f7-feaa-4f65-b9cc-922a336542ef", "comment": "Malware payload (SnakeKeylogger)", "value": "8db9b0b0d895677ae36576710034df582f27faeea5a7447caec41ed097b8a84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392679, "uuid": "c9ff938a-96b7-480e-b53f-308295c2bf81", "comment": "Malware payload (SnakeKeylogger)", "value": "23fd8d3e159580f15d951a5b4a77b5d67ad4cadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392679, "uuid": "f9de3da6-995d-435b-a394-d8a1211c4077", "comment": "Malware payload (SnakeKeylogger)", "value": "615f1e69859c6bc9ae7f7a34007ae92f4bf96b3cd22d16a6ffdb7fe51c076fa60a6f26887d06681cedadc64c5570becb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392679, "uuid": "f7f2414a-da48-4950-bbd4-c0e0dc7aa855", "value": "T1EF1502202BFB5739F1760BBD95A5325157BE23B36713C64E18F212C94F63B029AA1237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392679, "uuid": "5a9003c9-fa8c-4570-91ad-fdd26207c0af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392679, "uuid": "9805d698-d90f-4178-b6cf-c4db4a509257", "value": "24576:JrYMtNtwwL+w2I5iR+HMdbT8XtTq3qnl1EoT:ZYgtL12IQR+sJ8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392679, "uuid": "3fafd167-289b-4e51-a82c-799f9d1b326b", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392679, "uuid": "0d94959c-9397-43d7-a506-4b0ff87bf56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392679, "uuid": "6fb21506-203d-4ce6-937d-8f50d6619645", "value": "Urgent Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055e0090-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679398761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398761, "uuid": "a3754f5c-13dc-4e14-86fb-bd9341858aee", "comment": "Malware payload (Loki)", "value": "d528fdd2fae1e4f0c01ce1ad1e0a7cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398761, "uuid": "d84046f9-89f3-4989-a581-18dcacf96e78", "comment": "Malware payload (Loki)", "value": "8dd83883d8daee30f21adb85cff72ca768a80559820dd1770399c3f5c86f52ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398761, "uuid": "442cdc6c-0530-4c3f-a0f8-adde89f3b436", "comment": "Malware payload (Loki)", "value": "6cd09f12f43e69594e2d049c0435c123316d4308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398761, "uuid": "4ef0ffb0-7f74-4210-8d28-b92de8516f78", "comment": "Malware payload (Loki)", "value": "45114b83cf26d9cab13373cc25d819263cb4f44ff5346af49392bd60d0efb640fc6e0b26af1a3fc11faf690530445522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398761, "uuid": "ca4bb6d4-b2dd-4d7b-9f2e-40828b48d20b", "value": "T1F1254A424DBB11C5E8B70F5C647A76880B38E966FDD8513B3CC9B65A8FF9A1360063E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398761, "uuid": "d3d27b38-20af-4499-9d32-9fb979d75eeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398761, "uuid": "69f5983a-f86b-4992-85c1-38f0b0be77c5", "value": "12288:N3NWNXazC4s95aM7U/N8LnBJF9Fvj1aYKIEk6g5UY5FM3MFH5r4uDYhStl:Ir5Hk8LnBXTr8YlEIUY5FM3hu0hSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398761, "uuid": "5df2f2fe-0842-4c5b-8a60-09fbc8f24bdb", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398761, "uuid": "dab445c5-6951-4f10-b017-ea5a08f58d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398761, "uuid": "6a3f730d-a6c9-4869-87e8-aedca7af3517", "value": "d528fdd2fae1e4f0c01ce1ad1e0a7cfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71748df-c77b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679356968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356968, "uuid": "2392275d-dfd8-4559-a96a-5f1ddff24cac", "comment": "Malware payload (Vidar)", "value": "4383a4a1e5e283c8658fb012567fb5b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356968, "uuid": "8c743f36-e317-4da9-b8f9-c21e59f72d1f", "comment": "Malware payload (Vidar)", "value": "8e52ec55f770b443affcfb668d3ac3f904426b94635f6a16e0fd73c1d7323af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356968, "uuid": "a0810b80-9d3f-4d1a-bfc9-1c5aafab814d", "comment": "Malware payload (Vidar)", "value": "f4a2a5294d19f8e0b7676dcadd40ad3051533e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356968, "uuid": "9c4ea3fd-7f2b-4eaa-9cca-584acd17d1a7", "comment": "Malware payload (Vidar)", "value": "808d11050bb5051bc45b940aa96efea8e2156cdca40d55838721c76ec78570cb07c9a0e7e4927aba86df4018f3b19578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356968, "uuid": "ef4dcdf9-f94e-4d68-a7a9-0b2fca952ec5", "value": "T12225ACAFE6F13A39F8542977C186F92422E7A5427523930FA704C68A09F12D77D472CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356968, "uuid": "86c40e27-ea6a-4a24-b68c-29abf43ae09e", "value": "12288:hBD1QO+UgxQPYR8Iw+VziQnu8qKFuH38L0QPOBFxl/TmhvIPaqU+ciYR7qh5WB0D:oxlR8I7zju8zFu4O3T6QSqZHYiWBw3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679356968, "uuid": "c9f46336-22af-4d7f-b6f5-297886d8c425", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679356968, "uuid": "c2781e9c-7e95-4477-9f08-d88c2ee54e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356968, "uuid": "23a8e2e3-3c64-4d51-8924-8bc5d8142826", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ae49ce-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393047, "uuid": "2e18ac26-bd28-4e60-8caf-08e308ec3454", "comment": "Malware payload (Loki)", "value": "f95a3585584018b76f0580cea8f0eea0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393047, "uuid": "7f2f6fcc-f556-48ff-b8e7-118d6b570589", "comment": "Malware payload (Loki)", "value": "8eeb2129668940a702ff4ceb868ff0772a3bdb3871e6e0244017a8462f0f6b7f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393047, "uuid": "7e9f011e-be36-45df-ad50-1cbafcb305bf", "comment": "Malware payload (Loki)", "value": "ae4bcfcaf22baca075ef4ecba2e0e26759c409cd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393047, "uuid": "d225e001-a7f8-4c80-a1c2-d63e2fa7e0ed", "comment": "Malware payload (Loki)", "value": "8fcc59ea3a91abdc4d206e9307cb52545cb8604aca57c64d31cd805e1049314319a2a4b0b1f8d0b67ee7c7d5a8e60c10", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393047, "uuid": "d53e0450-cf65-40df-8a37-2feb14129846", "value": "T119D2F956F7AA03788B8105B2271E0BC9AB7DA13D73509572387C827433A9C7A46776FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393047, "uuid": "425b2685-231e-4913-9d85-0d1a78d08ea3", "value": "768:eFx0XaIsnPRIa4fwJMyhIErrDrV/RASgqHvWoq:ef0Xvx3EMSPfR/RAS5PWoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393047, "uuid": "70a6ec1a-8f00-47aa-b6d0-7003758c13be", "value": 28510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393047, "uuid": "3b05a3d0-f252-4f48-b85c-e642f8ec98a1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393047, "uuid": "07064664-1273-4dd6-b32f-35a25ba41036", "value": "NAKIO INVOICE.xls.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c1b8d9-c7e7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679403130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403130, "uuid": "20ed7bfa-7aeb-412d-977e-e0630d0b5ea1", "comment": "Malware payload", "value": "364fcc9033149cc961d09b6bb6f1b8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403130, "uuid": "0cd5c477-7679-470a-9f3f-5ea190c58185", "comment": "Malware payload", "value": "8f16f9bcdf16e9092f1c8741c57bb44d0b2c54699b206eca1e401d355f3c57c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403130, "uuid": "2a09b8dd-9c28-4b35-b788-172cc94e08f8", "comment": "Malware payload", "value": "1b39ce8efc5b5ec82a2b5d32e3243ca5c43ef5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403130, "uuid": "d361f4b1-acd1-4d59-a14a-e7f9655570d8", "comment": "Malware payload", "value": "f8883f4641cc094158efa8ee92b813105521045a69b1826ae03e1c79920d3187d5096e1665d63a24cc90137cc9ce326e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403130, "uuid": "e883bf51-bcba-49a2-a8ed-e12b46e05e04", "value": "T14A66016B731B602DC27A463255B2520C7637A66164FF8C1B77E0074BCB22B21DE2E6DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403130, "uuid": "3eeeda5b-a076-417f-b450-f9f9825ae8be", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403130, "uuid": "3a53c565-10df-46a9-885d-4a403655d3c8", "value": "98304:2kL4LkSZEOXPzQn51s6WHq2YjXKpw5HOliqTFnVQcfwGbklCOuiezfRicOnTm:B4YSZEgU5i9tkHOliqTdDf/bksOzeIc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679403130, "uuid": "b61821ae-2e6c-43e3-8d81-449102355397", "value": 6842440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679403130, "uuid": "7d1b4a1d-86fc-47b2-9165-d5542cc8293c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403130, "uuid": "ae3c7140-cfc4-439f-9f84-97429c7a9001", "value": "SecuriteInfo.com.W32.Kryptik.JEY.gen.Eldorado.19383.9378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cf7e02-c80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679418684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418684, "uuid": "a373a8d5-e6c2-46e7-a718-1c2888743718", "comment": "Malware payload", "value": "42ab05ba47cb6189d3dd3849d6a78fe0", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418684, "uuid": "237a8482-d768-4b93-8caf-3c925ed137ba", "comment": "Malware payload", "value": "8f67f13f3791d8cd711b77e448a9f054c898f3d38e981fca1c7dcea0bce83f0d", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418684, "uuid": "03a05787-d8ac-4c69-9406-4aab2c98daaa", "comment": "Malware payload", "value": "e2b52c2c1782d9bb9792bb0c16e83512d25bdf6b", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418684, "uuid": "2f136f48-927d-4548-81d4-911f65c57e52", "comment": "Malware payload", "value": "07f92e708ec5c94c6862eda7657339a80ec4fec234d13cafd9d1d59dc3e8ad9ce84bf1f79120ca54b9ab686e31fd6275", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418684, "uuid": "2ab737c7-e106-40dd-8ae5-89148cfda072", "value": "T1A7465C95BC1E6822EAC8BAB46B3543A5B235FC48DF81C3277514BB6DADF23148F11760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418684, "uuid": "e8ffa3f3-d799-4da1-b4d1-3690ac2eafa4", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418684, "uuid": "fedd2847-233a-4605-a820-5b2b9b7d9f6d", "value": "98304:yTp9dXqM6XyyAfH99uQqDmJdEZlh5sws:Up9dX959tybh5sws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679418684, "uuid": "1f377afd-8e4c-4669-aede-87cdc33500bf", "value": 5811200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679418684, "uuid": "8ca5a7eb-911e-43cd-8033-a6f218e86324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418684, "uuid": "606a02bc-e1e8-4490-8ac0-2b52f87957c9", "value": "dosia_app_windows_arm64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b642b611-c7fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679413231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679413231, "uuid": "d7feb632-045d-4b2a-b6b8-bc5150b4c77a", "comment": "Malware payload (njrat)", "value": "575c1492c69a86293f944a8cc528ce78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679413231, "uuid": "9fb25602-85d5-4b52-b365-288e194cf76f", "comment": "Malware payload (njrat)", "value": "8f7070b244f6d3559a7e5d4bb8682ec5bca8aacd37104c827d1897c3f6cd0650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679413231, "uuid": "1c5747f1-4ba1-4a5f-a190-4849994872a8", "comment": "Malware payload (njrat)", "value": "656d2ea8cd84cf5a867c1ca0561bc9625710d3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679413231, "uuid": "e53f4a85-4ed4-450c-9908-74fa1fd3a260", "comment": "Malware payload (njrat)", "value": "164a331654e80415db50d457ae87c9eea29d4b42cbf4aa6a158ad70344cac27f0e45a0ea0cf8726bd34a274804c85211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679413231, "uuid": "daef55ab-3d16-429b-81b9-661fc567e4e9", "value": "T107F2294D7FE08168C9FE167B05B2D4130776E04F5E23DD0D8EF664AA3A636C18F54AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679413231, "uuid": "20449937-5d1d-42e2-a448-9c655e053184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679413231, "uuid": "9d55daa8-cfd6-4c46-99d2-88d1b17054d5", "value": "768:VOgJlLJfcPCojPysIorM+rMRa8NuH0qt:VOgJlLJUJjP2z+gRJNu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679413231, "uuid": "24d6b96b-cd1d-4407-aa14-f2f24048842d", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679413231, "uuid": "02163a55-3fb7-4484-ab50-5df706de1dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679413231, "uuid": "11b0f4e8-88ad-405b-80c4-eb32c0d0ddec", "value": "575c1492c69a86293f944a8cc528ce78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bb8ccb-c7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1679398674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398674, "uuid": "5386a026-0282-4a8c-a34b-530793bae00a", "comment": "Malware payload (PureCrypter)", "value": "043e8888e7db2538ae95bab4b4d250ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398674, "uuid": "d1197dad-23ee-45ef-8566-721c2d5042ab", "comment": "Malware payload (PureCrypter)", "value": "8fe64be43f1b584df60abb81b68b1f88e35b7906b029e503698af7bceda5958b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398674, "uuid": "c20880af-d289-4951-a90b-bf3745a7a03f", "comment": "Malware payload (PureCrypter)", "value": "2c50a222e3f4047dff1ff67e8413f17f0477fe9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398674, "uuid": "f9480185-5044-43e2-b7f4-3c02a65caa3e", "comment": "Malware payload (PureCrypter)", "value": "0472683cc3fcf9731310058b2c8789f92e846fbe2f2318610c083ae0ef337baa45f017fa7c208ebb0851acdbd5da1858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398674, "uuid": "addc51fe-9d69-4827-8fd8-2b3057947b8a", "value": "T1D6761225239C91C9D17A9039CA864AABE7B57C429374C7CB05A0BDA93F336F55E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398674, "uuid": "d065164b-a9aa-4c37-8a64-1ad5793e91fa", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398674, "uuid": "de2b8812-04b4-47eb-8edc-039a15331fac", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXDzG5c0HXN3SKhbC:tV44xgrwo5tLMKRUGrMTC5H3SK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398674, "uuid": "d8c030e5-fdd7-4031-a169-2f880feed9e4", "value": 7225266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398674, "uuid": "c49e2c86-bf63-413a-9783-b37741bdaebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398674, "uuid": "4bdee87e-86ee-427e-970f-80cd7365efae", "value": "043e8888e7db2538ae95bab4b4d250ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db3262f-c7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679394238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394238, "uuid": "b55f2762-851d-4db0-b398-ec25a01c032b", "comment": "Malware payload (AgentTesla)", "value": "c836034c6d3418aae5c7d3ff26702c66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394238, "uuid": "69b3f554-b331-4d5f-8373-34deec9f36c2", "comment": "Malware payload (AgentTesla)", "value": "901cb8b6fccab478879d954a4268fcdc47c5f213a37927282adb952492e01906", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394238, "uuid": "4183b63c-fad3-431e-843d-a755ff3ce496", "comment": "Malware payload (AgentTesla)", "value": "35e7ad9af4cf14d15b76d0ba02bd14e42cdf2929", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679394238, "uuid": "920a93b0-dd74-4830-9aaa-e760b7d778ab", "comment": "Malware payload (AgentTesla)", "value": "4cac1b92cc6976b88464c208e5350087bb850fa51b6aa860363255331646886fac7d6d64159de56b9e945497b8fb05e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394238, "uuid": "4e54dd21-bd36-4e2e-9fd3-a541e36bca84", "value": "T12565230373864A53CB3E0FB04161628513B5D7229A03E7FE3D6D656EA7D1B8267213BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394238, "uuid": "4d7b1ae1-ef86-447b-a7d8-90e118109ac3", "value": "12288:cQcQqYoPnedLMki5+1yypMWxhBoZUAsUEU1UyjeM2RXn1AbLM4y1Pc:9ePvjSMWxhKZLZd16M21n1AoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679394238, "uuid": "d6e637cc-1fb8-4d3a-b418-5c2527dca8b7", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679394238, "uuid": "86a7a15f-de2e-4bf7-842f-1ed95dcd4035", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679394238, "uuid": "2c477b81-ccfe-49ec-8324-34ef0f2544d9", "value": "Nueva solicitud.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6b27d6-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393540, "uuid": "cfabfe69-37da-418e-8add-832a75db337e", "comment": "Malware payload (AgentTesla)", "value": "1ecc519acd2c55e3ba1cf1e5cf207e81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393540, "uuid": "0b461348-f784-44db-9746-54b99cb65acb", "comment": "Malware payload (AgentTesla)", "value": "910d9b96c26da8f58f9574ced9e737b7139deb7ca5eab2e329f2612c66013d26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393540, "uuid": "167e4120-b3ae-4c6f-af77-1bb683b60719", "comment": "Malware payload (AgentTesla)", "value": "30292e88abfa1c1238df7391e45cee42cea6dc03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393540, "uuid": "6df6b52d-34f9-4905-8da2-797404a5ad58", "comment": "Malware payload (AgentTesla)", "value": "f0e71ccd830a3e8c2e536b3c6a4b070d5a7087a0f1598be385fec014f696f7024dbd3959135a2411cf4c2c7bff5ecee7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393540, "uuid": "28d91e95-8806-4e9e-8dfc-809d9c1cbc04", "value": "T1D474B5503BEB094433D1AA638F47FE5D97BABDD6863B1F5588CC094916FE50A48C2BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393540, "uuid": "b82ebe17-8416-40d1-b47a-6785d602c0e4", "value": "768:Y6FleOwNktr+MLSC29mBaM1ip1Nlmjl7+Ad:Y6Fl6ktr+MMmBaMszshd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393540, "uuid": "1b262279-1ed7-4df8-b939-4e6425e62c95", "value": 340920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393540, "uuid": "ae745f06-8eb5-4831-90e9-dd9c28d12ff6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393540, "uuid": "4f0faf32-63cb-4349-b4a1-73c028628567", "value": "NNE70093-3411.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0686df71-c780-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679358819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358819, "uuid": "107b7cbf-557d-4132-9fc3-a5c21c0cd888", "comment": "Malware payload (RedLineStealer)", "value": "9e98a2dc80de1dd30099b522a2a4d2fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358819, "uuid": "140ac0fd-af58-4c10-af07-9dec3d23445a", "comment": "Malware payload (RedLineStealer)", "value": "916259bba3fc68a628b8662776afe89cc2865bdc3dfa80b0349f93039564e35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358819, "uuid": "876bf818-b511-4219-b6b3-74354b072aae", "comment": "Malware payload (RedLineStealer)", "value": "86e86ad2172cfcae48a6e74c97a81b8f0ffe6edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679358819, "uuid": "b46e31b7-6ab1-43e4-9b17-764172df96fe", "comment": "Malware payload (RedLineStealer)", "value": "b337e79e0a4151f83f66c2fee8fb87345cb9c1937579a650c7c7851a1781ce40403d0640a9217ed86040e6111214ded6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358819, "uuid": "8b51ba25-fb2f-4775-8a2d-ea9e401a9ecd", "value": "T1843512138660B892F426CAF28D5EC6A0BB5AF9E1CD9C276D33049E1F0C731A3D565BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358819, "uuid": "097d150c-49c8-4b02-8a5f-b2cee77efecb", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358819, "uuid": "51e28e03-5aac-4e36-b9c7-abe60257266d", "value": "24576:VtnJxHciZIzfNzGrd2+CYZdFxXr/77nXbLfH/kDyHWuMkAcnE:lxHcGgkjFNvbLf3ecn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679358819, "uuid": "64bee8ab-30db-4d61-a63f-43feb9edeac9", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679358819, "uuid": "24570e51-3165-4fc5-bbae-3fcf9620df81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679358819, "uuid": "15ddcfa9-0bd8-4132-905b-f13af0d0d4e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfa7264-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392651, "uuid": "59073860-1cba-4c38-9e34-b10b19593f18", "comment": "Malware payload (SnakeKeylogger)", "value": "bd40396cc63041ab16df42eafd34b830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392651, "uuid": "6a954ffb-2281-41ed-932a-c2301a609ddb", "comment": "Malware payload (SnakeKeylogger)", "value": "920e8b9207269863468f27f124941390f56e3558e0b5b3aa7c35c9c4d7020e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392651, "uuid": "bc9c5296-26ef-40a9-85e6-c8869aeff5c2", "comment": "Malware payload (SnakeKeylogger)", "value": "09ab1ff9d5feffc0511ffe3f66b5ff4ee324a681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392651, "uuid": "e89d00cd-ee11-4474-9b90-632e1ba07fd7", "comment": "Malware payload (SnakeKeylogger)", "value": "82ce8504a716af98419d403ca5cc23877613d63d77ee8eae128a45d512fa17fef65f35ba8f4213c87dd900c1a98d82d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392651, "uuid": "27763db6-d805-437c-bd54-2873d89f1c5c", "value": "T148E44A1D3DA899E3C324E673DBD2C226B3639F567723C95925C213620E0E356ADCB11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392651, "uuid": "52955457-4828-45d0-bbd4-2e94e6bb8a7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392651, "uuid": "85eb6a81-4aa2-4101-b410-036adf1b2ed0", "value": "12288:BXBtdbLSOlXPNSG7GrRyb6TH6yYVbPSMVi1K/u7G9/i0Ojwii65zgKR:zKOlXN7GrRyWTH6ySbPSMw1K/X/ipE6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392651, "uuid": "436b6b3d-951f-47f8-893c-d564988805f5", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392651, "uuid": "d53d9fe2-991a-4e2a-83e1-4fb75fec2157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392651, "uuid": "55dd6824-3c89-472c-98b5-ad96754308cc", "value": "#FileP0VRsM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecc560a-c7d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679395045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395045, "uuid": "23b6ee78-9982-43e8-adf9-7dcdabf2e20f", "comment": "Malware payload (RedLineStealer)", "value": "e1030f0227b150f13c1a85d812ce56b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395045, "uuid": "061ad046-a7f3-4a56-a20a-27fae2b766c3", "comment": "Malware payload (RedLineStealer)", "value": "924c83ce5405de7a1cbaf802918de711cb29b8385469ef763eaab53708c876c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395045, "uuid": "936f5ee9-6e56-4ed2-bce6-b7f64b89668c", "comment": "Malware payload (RedLineStealer)", "value": "a49da7621bf7e1dc706218a7086a6bedbb4e93b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395045, "uuid": "f0f67a5e-f70b-4907-b89a-c3a400102cba", "comment": "Malware payload (RedLineStealer)", "value": "bc3d3291cbe732c517c71d62e0b8898c97f1eea80d14072a285bd55c218646656950c8465792b34dc2197cd167ac6ed2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395045, "uuid": "035e9257-6482-4fff-94a0-2d7a2281e44a", "value": "T1AE052353BAD44473D8B1177498FB12830A35BCD25EB8976A6348A98E0CB3F94793533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395045, "uuid": "577f7e46-4074-4b0a-b895-4f9726166434", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395045, "uuid": "5f43ead7-ac73-4cb1-aea6-f1f974f82248", "value": "12288:gMrSy90gBHT1OnxOqZLObzMIjOw2A6k9Z5SpJ8GPg5pjj0aNiZsIlzpwZ1UOX:iyneOq6zljZ6k9Z5EP6fNolF4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679395045, "uuid": "ea11dfbd-2017-4f75-ac01-16ead02a0408", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679395045, "uuid": "59d05017-20b7-4b73-819f-95d27ae5406a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395045, "uuid": "647de180-5604-4f57-b8e8-eec9a3e4b037", "value": "e1030f0227b150f13c1a85d812ce56b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d862570-c781-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1679359448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359448, "uuid": "ff59b24e-5f4f-4952-a1e9-6027daa0c7d9", "comment": "Malware payload (PrivateLoader)", "value": "d80448b684ce5ebb82305199177c428c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359448, "uuid": "8ad7ce55-c3a4-408b-9531-e5c1fb906ed8", "comment": "Malware payload (PrivateLoader)", "value": "92618bacafd87b6655b729bcc61285150b0e1c5da339162144d652fe3d6be629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359448, "uuid": "80beefa7-93eb-4445-a540-8e0c2edd95e2", "comment": "Malware payload (PrivateLoader)", "value": "b5aad338c6f026442c18b3ea515abcb7bdb2c0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679359448, "uuid": "02311ea7-e266-496a-9246-f495dec69d08", "comment": "Malware payload (PrivateLoader)", "value": "6b2326ca072eccbcb75e2a5d12bce17cb24ef68b8137dff5377817d3e86c69abbd03ad94d194170aa7b5a44c0a3c20bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359448, "uuid": "b0058246-0a78-41bb-a46e-5f3fb5018409", "value": "T1CE267CA2B797E1DFF241397CACD6D5038E2806E01359DA26E97E3071B263E4315CDA78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359448, "uuid": "ab207345-ace6-4203-8b08-18bd8310e3b7", "value": "5f15e282c9ab32f785ec67df78e330eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359448, "uuid": "6649c4c1-eaad-4162-a1ec-a2009ca5e933", "value": "49152:tRcTFkJWRR1WFKymfGEbpzGgcroQsgZ7fh7hNwGi8owARjHZn7/goiSGGYswUNM:/IFkJWgUzeepzGgcroxglJmRGGYsw0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679359448, "uuid": "9a275117-d988-4789-889e-4ac85936cb27", "value": 4530704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679359448, "uuid": "95762d94-b2e7-462d-bc6d-6697729992ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679359448, "uuid": "8014f167-22f2-423f-9a6a-086f7c60ff0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aaa5d6b-c7f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679407440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407440, "uuid": "0fd0d1a5-b0d1-469d-a6c4-c16cfb5ab897", "comment": "Malware payload (AgentTesla)", "value": "ff73afd299862fcbecabe9ce1390d65f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407440, "uuid": "a477c2c4-a10f-4f78-a754-e7dfc94dded3", "comment": "Malware payload (AgentTesla)", "value": "927f9944a4284ce1222ce51a9501c0e984144297fe7c3b3b11ab32ce075b58c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407440, "uuid": "37147672-7454-4b9e-9693-dddcf1136167", "comment": "Malware payload (AgentTesla)", "value": "7ac284026e36dc8ef1bd4852bda2802e21d458c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407440, "uuid": "9d9da495-1062-40a6-9e6e-6304a0161f8e", "comment": "Malware payload (AgentTesla)", "value": "7925508c9af555c4fff66e70a6dd98b7c2c305fc630b7be605d005f2053dcfad76dd26f220a52dbdb254be4156b69d1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407440, "uuid": "4dea585b-17c4-4480-b3fb-3ecd08a133df", "value": "T14005015A379BDE12C2A91572C1E3561403B199436337CB4B7BCB17862A063FA5C4ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407440, "uuid": "5df32f3e-0580-4a36-ad15-46f8ec1314a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407440, "uuid": "c315894e-e70b-4507-92e7-73c45a4b7cbf", "value": "24576:ULXq7ClqX1FYsqhoLylmiX8Wip1MNpTCsjucs5Q:UwClGfqmimKPirQTpjHsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679407440, "uuid": "46389021-70dc-4b6f-91a6-11b0c0cdf2d3", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679407440, "uuid": "43b66094-2f5c-41cd-9ff7-cacf73723321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407440, "uuid": "6e7d0a23-a417-4560-a3e4-13b8127263de", "value": "ORDER PO-2303-623430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fda5d2-c7f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679408150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408150, "uuid": "75e5fda4-12f4-4537-866e-a2f44166282d", "comment": "Malware payload (AgentTesla)", "value": "a5d6a7e9b6afc3de25c0f7a265f17b10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408150, "uuid": "36a58129-ac9e-4443-a9c3-1613536bfb4e", "comment": "Malware payload (AgentTesla)", "value": "92a56edbf87e9d6ac166254023fbb3b6706a3122ef050694644582e8685fc996", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408150, "uuid": "5c1861a3-5f1e-4cee-a107-2953e03eb2b2", "comment": "Malware payload (AgentTesla)", "value": "c08f6842f5cfbeea2cc1cb8f284c57026534485b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679408150, "uuid": "af1b7620-0205-41b1-8832-864599afd572", "comment": "Malware payload (AgentTesla)", "value": "b2c6bad4ac6686d610ebceb1c8e0fe8f8794f8055264101a5476009d2a645fba9375ad539aa5ecd9b65799f8fa0878c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408150, "uuid": "0a267b2c-9a9d-4a43-934c-5b193b80613e", "value": "T1D6B57CB262D3FEC6D37F2E6080043A405C209867976DD389FCC925AB96E5364EF5C6B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408150, "uuid": "a7745370-ba4f-4af7-8e60-36699e96874f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408150, "uuid": "8a8daa49-8c1b-4d80-a3d5-687c555845be", "value": "24576:Kr0V668rgCrsqCn8Om19Ot09OX7l348A5NykshHuvJiahIuBt1oN3Yp9g4kFT5Z7:7V6Hrgf+6hHueDiPA2EQr1zb3iyGma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679408150, "uuid": "c60e7619-a08f-49c4-9418-8b9ca8dfd158", "value": 2413056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679408150, "uuid": "0ae9820e-b669-4abe-9462-ce0719c95454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679408150, "uuid": "e8c8ad46-c441-46d8-8fa1-ff4084193387", "value": "Documents and Personal Details_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4e18b3-c78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679363740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363740, "uuid": "740740d1-207a-4b4d-b618-a21eec666fb8", "comment": "Malware payload (Rhadamanthys)", "value": "d0a19fc660ff0fcf3219644e0fe77acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363740, "uuid": "18181087-b790-4dd1-abcc-603827cd3e68", "comment": "Malware payload (Rhadamanthys)", "value": "93f7b0045c564abad182d9e2006505cef3b68b4beb3a4db787332a31839fd7a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363740, "uuid": "2cc659db-51b3-42b1-97e9-64881fd7a76d", "comment": "Malware payload (Rhadamanthys)", "value": "b8febb7077be83911fec6a9e8e9998a36bd806b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363740, "uuid": "f74575c7-b8cf-4fa3-9667-2925bda936ed", "comment": "Malware payload (Rhadamanthys)", "value": "1d13e7a4d30cc455fe118cd62ad95abc4ce1e4dc098ad4c1631ae30b6b53f41839b2b67232661efa8660d890d94a8036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363740, "uuid": "7e2eb2a5-a359-4038-b170-af81bb0c169b", "value": "T14B44C00397A07815F526CAF24E2AC2F4B61EF8D1CE5D67DD32146E2F08B31A2C5667D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363740, "uuid": "b7c87eb5-97dd-4985-9c29-4234b059b8f4", "value": "c7e43254116cf1eb594def3fb89b8588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363740, "uuid": "4f1fa4af-ad44-44b5-b556-6907d40171ab", "value": "3072:ug7wpePP9oGRo4VmV8ikDeu3iDwwMGaeg9drZoQcZpvz6JppcFyP9x7wuf/xZ:7wIRIV8iu3iDwog9d2nZZi5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363740, "uuid": "608806db-5404-4459-9e13-db813fe56017", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363740, "uuid": "d200617e-f740-4ef3-87dc-1a217c2cd835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363740, "uuid": "8194d351-36bf-4212-a43c-3d974931a5a4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4197a79-c787-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679362117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362117, "uuid": "c9e66c69-08a4-4924-b9fd-854d7a3e924b", "comment": "Malware payload (Amadey)", "value": "2c74cf808248c906eb84386fff37f025", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362117, "uuid": "6f5297e5-452d-4ff2-947f-cbc5113a9d3a", "comment": "Malware payload (Amadey)", "value": "949774a46099feb9039cbd267d5cb15344f6b0f082489175e5a7c17070a8c250", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362117, "uuid": "d722dbfc-b6df-441a-982c-9fa32f6061af", "comment": "Malware payload (Amadey)", "value": "93dbe1ab62f11564d859dcec56b8ab10b386202f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362117, "uuid": "4e3cf3e6-f572-4dc9-aac9-4597ad79da8f", "comment": "Malware payload (Amadey)", "value": "98b0f2b554afede68e33104cd9ff9e76135a3a2c67e086f23007c359835d3ed363d18e9b1df13af3c2732af5cdd594b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362117, "uuid": "ccba74bc-7a95-436d-8885-68e030797949", "value": "T1F7049E135BE07C51E5228BF15E2AD2B4B60EFCD1CE5D6B6E22046E2F08B3162C5677D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362117, "uuid": "7f66cef9-4b0b-4fe2-b18c-943d4831e9b9", "value": "c7e43254116cf1eb594def3fb89b8588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362117, "uuid": "8931f5ec-9e4d-4e43-b525-682bf5c86ef8", "value": "3072:+eyGQqLjGod31x0GCOmHHPs0XMuUGdAie994Y8k7oZ:sGHpuBOmnPBMTGdA79CY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362117, "uuid": "9ee1bb85-3ce2-479e-904a-454c262577d8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362117, "uuid": "70d38417-71d1-4191-b7dc-bdc0366a0a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362117, "uuid": "e3cf26e6-fdf8-4e4c-ad93-69ffee958c5d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab219890-c7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679381429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381429, "uuid": "3d369fee-60de-4891-8fc2-eb5be5155115", "comment": "Malware payload (NanoCore)", "value": "0824bc52c4133691364453dd4d2143ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381429, "uuid": "8ec5738a-2691-4de3-b3e8-6bed05edc967", "comment": "Malware payload (NanoCore)", "value": "94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381429, "uuid": "3346c5a4-4500-4849-a867-f032c111bb75", "comment": "Malware payload (NanoCore)", "value": "0e5119f96e2071c64e97f0ad689c89ae5caae2dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679381429, "uuid": "711694b8-ee45-4e00-a294-f0369d2572a1", "comment": "Malware payload (NanoCore)", "value": "69bb554ae384c181d60d5596b00c9dfbc5772135d9a9ec64e8b6b7e67db429b8ae5dbee2771425180991013cb0871a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381429, "uuid": "b15ae9b4-2357-48c4-ba8c-483b78549c8c", "value": "T1BE2512206184DB60D52847FDCCB19AF113B92E79E961EEDB2DC67ECE3A3179251806C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381429, "uuid": "2593e9a4-427e-4a09-87e4-908e15463ea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381429, "uuid": "b0201356-a906-4396-9fc9-13258602b073", "value": "24576:51bgzPGhgzfYdwMYedHwioX47BaeSavf7QetqZ:5ZyPyywdwMYeSiqqocAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679381429, "uuid": "ad7c8bce-b749-4979-9e50-1941c4914e66", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679381429, "uuid": "286c07e4-77c4-43eb-9852-6a6ebcd26901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679381429, "uuid": "8a6cafd0-5fdd-4295-8e38-94505767a3d3", "value": "0824bc52c4133691364453dd4d2143ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18ef3f5-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392661, "uuid": "4fecb275-677c-4546-8606-c30fa50cb86e", "comment": "Malware payload (SnakeKeylogger)", "value": "24f3fff5016853f4c85546d338ade05a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392661, "uuid": "36cc2046-df6b-46b6-8a46-4cc0fb7b181c", "comment": "Malware payload (SnakeKeylogger)", "value": "94e41741803ebfe3ef088e4f0d8677872a5ab65e13f1f35272a4fb4def435645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392661, "uuid": "0afb9ac1-8ed9-4e8b-97a9-34dbd40b89a1", "comment": "Malware payload (SnakeKeylogger)", "value": "2d619c8cefb73b669546e8116acfdcb9f6129549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392661, "uuid": "3c1b3d45-843d-452b-910f-8662a7188ed8", "comment": "Malware payload (SnakeKeylogger)", "value": "b83719e8b5de52cf469680597c06bdfa1e46af9cb513f195624be8ea412d06763a9a85484d69c1c3ec11b4be10fe5e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392661, "uuid": "39125e58-16c3-404b-99a6-8e0003d24331", "value": "T1C2F4015DB76DA806C2E9A531C0D7451003B19D0B2B76E7483DC9169A192F3E26E8BFCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392661, "uuid": "903524f7-7464-4aac-9e3d-6851bbf1161e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392661, "uuid": "b01e0026-95f7-4d5b-bbc8-49b1c66e027d", "value": "12288:8Y+UuxtVL/MXrG9Lbfo5ylsTZL81onCxg4WxpnyIa2t+52Na9nxEjKZKomNneK0n:8AQLgG9Lk5tTx87uTnyIa2w5VpxpMMME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392661, "uuid": "4a428e7e-3998-4f11-aee9-4d4b4902cae7", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392661, "uuid": "f10c9691-a745-423d-80ca-c76cee85c38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392661, "uuid": "9a9b211e-e7c0-4dbb-a12d-390f6a3b549c", "value": "New Order 002820_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb0f6ce-c792-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1679366727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366727, "uuid": "2afee87b-2ee6-44c1-8051-2cd18dd69a0c", "comment": "Malware payload (BitRAT)", "value": "e43f5a6b060e95078d1bbab95dbf7a67", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366727, "uuid": "6fca05c4-e540-4391-af1b-71a7f94ff80f", "comment": "Malware payload (BitRAT)", "value": "969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366727, "uuid": "28b90c82-1bda-4467-9697-d074b3e0e8f2", "comment": "Malware payload (BitRAT)", "value": "5f6c18308a96a1c750d6f4e8b22dd7bec701f105", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366727, "uuid": "6472462a-a1a5-4e7c-abd5-f857df22498c", "comment": "Malware payload (BitRAT)", "value": "ca27e27052a4e49a5da9aefbfc7252e3d5f53d4ea325b7c5090067a56304877bbb546a0818b1af2feeff996f730ba252", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366727, "uuid": "2bfb8e0b-95d4-4f76-b1c3-bf48b3a00bd2", "value": "T1D766232B9583C81BE62DB4B7F94A88064AD0A6DCE0F587D3472CC5CB17DAAC432E7715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366727, "uuid": "6b0f3a31-195c-4de1-bd8f-4016348cc4d4", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366727, "uuid": "10cfecbd-c298-4ee8-bd14-e73661a5265d", "value": "98304:gXc4No+9i3kwuwmX2qaaDvcrOobV1023br5I5S0fmw0NKg0yMgiPNIy6Ygl3qjZB:A/7+uSqa2dQBV+0ATPNO3EZ/zEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679366727, "uuid": "e54b748c-2504-4e6e-af84-d9a2d16ea559", "value": 6860288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679366727, "uuid": "c1bb18c4-376e-4b9f-b349-6295fdfaaeab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366727, "uuid": "d0703c5c-fdcc-415f-be92-406ab444f28a", "value": "luxurioux.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830c0524-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679393388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393388, "uuid": "8ae75a16-8e85-4c6b-90aa-b4857cec5434", "comment": "Malware payload (GuLoader)", "value": "d3b3b76fb78ccc698777a1a7635de808", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393388, "uuid": "34b453cd-0aff-4927-9f6f-370c1d5c0680", "comment": "Malware payload (GuLoader)", "value": "9765dbd65a085f5367621bfec9f896cf9d37eb298cee6e8568d4488137d888b1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393388, "uuid": "464a0620-7077-48ea-a086-075906d05613", "comment": "Malware payload (GuLoader)", "value": "122b645d6ecdc33fcb5ef3e6a61f76c4df31c1db", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393388, "uuid": "458272a3-c533-4a73-a141-3a3382017c89", "comment": "Malware payload (GuLoader)", "value": "f071e3a83e9d412c98b809be0a81842ed0a9940a73583284fb99d0b66381bfc4bb15ee7ed1411d92400378cda26e73dd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393388, "uuid": "1bbca474-9b49-409f-befb-c35a950c7e44", "value": "T12B54025336985533C68AC5F078BF62A38B74C27C059C275F6B94CB793E9AD82970B207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393388, "uuid": "e4670918-e1a3-4130-8474-a1756a1b226c", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393388, "uuid": "15387fe0-1c87-4011-8bfd-fbf203b955f9", "value": "6144:k6dY/yvEhQSSSshZfMhqqCORRLBvG8zR4lrhGjXSbJ2t:dvEnStfMhqABvG8zR4lraXou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393388, "uuid": "2f35759a-0e4b-40e5-af0a-b281ce3da2d9", "value": 281440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393388, "uuid": "167402ef-52bb-4d11-ab3e-6d7781750685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393388, "uuid": "a36aff86-56e6-4c6d-a691-85f830628285", "value": "DHLINV001267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2504ec-c78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679363853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363853, "uuid": "41ecb971-33da-4a68-af41-bc560cdd22e6", "comment": "Malware payload (Rhadamanthys)", "value": "7676c0161c77a5453d707e6ed14ed45c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363853, "uuid": "c32813b8-7e53-44ab-adf9-282d30d4fbdc", "comment": "Malware payload (Rhadamanthys)", "value": "9891812f13690272fc0581c9b68c6fc9d0bbdb30f6715b1a5b8e2040112d811d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363853, "uuid": "1c5db686-8de3-485e-8b3e-f80299207579", "comment": "Malware payload (Rhadamanthys)", "value": "0e867699e96d5dc3882728a9903937d130b36432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363853, "uuid": "a3cbd175-8092-4d05-9df1-f4f6991eb1a4", "comment": "Malware payload (Rhadamanthys)", "value": "b0adf366984377ee59463c985d9469745f337255820d981162f2b805fb1cff2297d86b449b9e64ab381206177372ac07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363853, "uuid": "e4d7644d-4eb3-4785-836e-91815ee9a13b", "value": "T1B644BF135BA47861E516CAF14E2AC2F4A61EBCD3CEAD676F23042F2F0873162C5697D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363853, "uuid": "8807b382-0749-4cd8-80e1-6f59276ff1b8", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363853, "uuid": "463af0d4-5b45-40da-bba3-4ba9352c6c8d", "value": "3072:Uh1AyJ0xWIzyNWcfONrkRX5QG35Agiww+8ihqtxRpbOvWgbjZ:OhJUELSrkRewwFYixPOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363853, "uuid": "23c4ee90-74ea-4cf7-8b00-8c0917c64b5f", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363853, "uuid": "da0a94cd-4e68-45aa-a8cf-c8e98dd4e34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363853, "uuid": "a93c97ff-7b8d-4340-9ee3-a5e15e7ebac7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a47ab5-c839-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679438355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679438355, "uuid": "05a552e4-96cd-4620-a93f-912a8a580e79", "comment": "Malware payload", "value": "8d6fc36eccc49b7cef363949d11b7dd1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679438355, "uuid": "580fbfab-ca51-48f7-a14c-b4bec815dc14", "comment": "Malware payload", "value": "98965c1f6ba98dd646e44ee2158c832788b260b492e7b14d6f708fea38593dca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679438355, "uuid": "5e1d8866-ff78-4f96-a34a-3f8d1036f0d4", "comment": "Malware payload", "value": "5158a933d40999338fa975f45e9cd209ae740ae3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679438355, "uuid": "d2dcc11c-8724-49c3-8653-b5f6c58428b7", "comment": "Malware payload", "value": "e87ee3bd3d897c727a153b8bf8d6487e7256eab42176b614dbc4298991a28ba2b6332f672250bf778800fe4b0fd71ec9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679438355, "uuid": "a5664ecc-1527-4214-a945-485617b67009", "value": "T1CD838E3C7552D08E647B4AFBFEA42D94D0841F5BC8CDA78801E8856D2FF8E6B31186D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679438355, "uuid": "42de192f-dee9-49bd-92f8-1e6a15742eb1", "value": "384:gN6dBDvKV49HPbEgmjqSYXEaQrzd2pL2nPnEudF0O1EQhEjCZF+bRPkU+mE3xQNb:gN6/HvSd+LAPBbN1bxbft/yPGQwdds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679438355, "uuid": "67eb6f45-bbe9-4063-b4c8-71025fd50d9c", "value": 83384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679438355, "uuid": "a577c4ff-0577-46c1-b46b-812485f87e32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679438355, "uuid": "870c9e49-2811-40a9-8378-21918eeec9ab", "value": "@magicfingersllc-11-04.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c0fa51-c815-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679423076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423076, "uuid": "76903da6-91a8-41fb-a44f-9bdb8ee741d2", "comment": "Malware payload (AgentTesla)", "value": "b2538efd60d3ebb7c9bb4157fe5abf32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423076, "uuid": "6786836a-6893-4d05-847d-cc15a4b7266d", "comment": "Malware payload (AgentTesla)", "value": "994a75e4c8d2071730d03b74859fa34391a995a1f0e81dfecd2d74182f64c0c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423076, "uuid": "d6311af2-2c5f-45b5-8cd4-f9f2b146611b", "comment": "Malware payload (AgentTesla)", "value": "9458393b21f6eaa9cc915922e7afd3cdf8df4acc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679423076, "uuid": "708aa378-f23e-456f-93e7-30dc01ecf49e", "comment": "Malware payload (AgentTesla)", "value": "c1dc8a203e5372941d230c4c0ca885c3f140fc5704bab0a6d695494d1616fb5fcff298a0f4439ca27950faa6cabbfec1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423076, "uuid": "4cda3d9c-f5b1-4c50-9fcf-41712fb23ddb", "value": "T18605015A73ADC952C299153AC6D3015403726A432733E7293DCA9785290F7F2AD8BBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423076, "uuid": "3c813914-4990-42ae-a486-af6bfc7eabcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423076, "uuid": "76760649-80b9-462e-8dcf-de6071759c8d", "value": "24576:NP20c8oXcVSMZZnjobT/0wWqRLWOTQfOT:E0c/y+vWqsVfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679423076, "uuid": "e8ac48d5-967f-4d41-89e0-9514484a42ae", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679423076, "uuid": "d2eef688-1bc5-42cc-8341-c3636fe11ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679423076, "uuid": "7572187d-b8c0-4ac2-ac13-bb1a911a7531", "value": "RFQ-ECZA Project OSMAG_22-23 Mar 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd732c3d-c7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679378937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378937, "uuid": "01d98f5a-6bc4-4e81-8f1b-e9f5ea7e099b", "comment": "Malware payload (Mirai)", "value": "8406babfb9b432ee244575aa2e3f63fe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378937, "uuid": "c3c74eed-8227-4f2f-bcf3-9ef3d369346d", "comment": "Malware payload (Mirai)", "value": "9a067e32dd6c25053c302de7caf61cdc0f3982289eb91d06c449fe08a47fc6d3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378937, "uuid": "bee6e2a1-39af-46e7-b9b0-d6e441338388", "comment": "Malware payload (Mirai)", "value": "22761d5d5c43e0251bab907054066239a8f35b61", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378937, "uuid": "fcde79c7-5657-49c2-900c-2641dde26ff4", "comment": "Malware payload (Mirai)", "value": "cd9ac647feae9ef45a3dab2ed36ee7aee93754289f932070c6a444c76352f58291e6f0a7c812352d74cc85f2a0904ab6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378937, "uuid": "75d9c5c9-dfd8-484f-8f13-338fb85d95b8", "value": "T10B534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378937, "uuid": "3a3d0660-98e5-43f7-a0e1-61fae552b364", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQNLiKimfFoktCe3fYRMD:WShU3q7cEDlCK/0D19i8Fok06fYRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679378937, "uuid": "ce6f09bc-25a4-4891-84ba-1cbe682ca314", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679378937, "uuid": "7df10f67-e267-4709-a9a9-15e159112e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378937, "uuid": "19b1865a-e784-42e3-bd58-0a82e9aed48a", "value": "8406babfb9b432ee244575aa2e3f63fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329864fd-c792-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679366624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366624, "uuid": "87e00ef6-d38c-4928-ba41-dbc9fb663415", "comment": "Malware payload (AsyncRAT)", "value": "66b5dabec55deb65ac6ecdbb385c9181", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366624, "uuid": "4f3451f6-5ead-4bd0-9888-9d72f4b4fe7d", "comment": "Malware payload (AsyncRAT)", "value": "9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366624, "uuid": "3c4c7ada-8ef9-4757-94d5-183ee92ee6f7", "comment": "Malware payload (AsyncRAT)", "value": "8485dc1ecf501916e3850521e81112fccdfaa110", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366624, "uuid": "56bc313f-3900-4034-9614-0d3491172d42", "comment": "Malware payload (AsyncRAT)", "value": "fe6daf2e29ddd2ef0ced6796a09c68eb39ad6cc55bed7e6e93cf03e18ae1329bcabc985feb86d94c946ee365f3ac7348", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366624, "uuid": "ce499557-6bee-42b0-a4bb-bf1a65d5573d", "value": "T1ED64D9D2B54109A8ED2A3BB58937D9351266AE952033EB0F05E77B637FF318714A3D02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366624, "uuid": "ce378e59-d707-45f9-9bec-f51679c24cef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366624, "uuid": "22169d84-6f9e-47d7-8537-02782eb181e8", "value": "3072:WHuQETR+J2IoYcOXb/CPJDjSIU1dA+h9b3dA2/S1dAK3dA/Sf6CwCPuikC0oXz2T:ouQ1MIPXXbaQIDp5OqfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679366624, "uuid": "d65e4c19-e2cf-4923-9d44-b689ade75960", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679366624, "uuid": "cf713b77-3767-4831-aaf0-3c03bf27f35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366624, "uuid": "499db52c-0193-45c8-a83c-a7e6e4287799", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbf075f-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679416250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416250, "uuid": "97b140e0-c068-4eaa-8620-bb39e039f059", "comment": "Malware payload", "value": "e0fbd3a7dab0f391907347ae91334cdd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416250, "uuid": "f005d66f-dc9b-4763-bcf4-38bf230200c5", "comment": "Malware payload", "value": "9c3912e3030b26e80cc4ed88be01fbc90ed957671c3724fcb722dc5463038d40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416250, "uuid": "4dbae3f5-81f1-48e4-91d8-ea782ef61592", "comment": "Malware payload", "value": "5c2d22406a1b24d502caa318bc1bd7e073b9eacf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416250, "uuid": "c3e8eb35-b650-40a1-9cb0-1b221eb1ff0f", "comment": "Malware payload", "value": "2c3029ced6870e07334bc954cc6102db3b389d8b52de9d0b835724e987ca8f9074ce5d7826c4890ee8012224e6240aee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416250, "uuid": "7c3b0d59-002a-4bd3-8f5b-c8cb2fafe71d", "value": "T15D3660519781FC91200B5FB7BB2AF6E4EE2A1F7C7194099FC514BC50A7AE904EAD0B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416250, "uuid": "0b08f4f5-5ef9-42dc-92e1-935c1f36647a", "value": "24576:CA5B5QL/56Yvb7unEwDzV0n+g4zTMV6CZjivDTvA28i4TdJYxFKydXIPCNn992TR:95z21wDBYoIgeqDhiv+GD6kK0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679416250, "uuid": "9de18ee3-974b-4976-b12e-c593c672952f", "value": 4935488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679416250, "uuid": "9a0537c6-ab08-4bb1-b5c1-4f6227728c54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416250, "uuid": "9df59417-1aca-43f9-95e1-9421b07db2dd", "value": "Image01_d3f8992dedd9c451346d0a1ae698992dedd9c451346d0ad85e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6f8ffb-c7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679398747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398747, "uuid": "82f0816d-8e45-443a-9e5a-555f2a925757", "comment": "Malware payload (Loki)", "value": "4ed4fa3beef61b2efe185096c2f05675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398747, "uuid": "fe457336-a765-442f-8f15-36c1af5f18a9", "comment": "Malware payload (Loki)", "value": "9da6da6d54ad5c972dd827ea8a62d7fd76dae32c2c03ef2b0b5d9fd902c7ee34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398747, "uuid": "f5a17b92-61fc-40b1-b9c2-65e057374af8", "comment": "Malware payload (Loki)", "value": "8817b6adc7e0abbd919ca26eba3bcd25d7abb96d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398747, "uuid": "0bbd91e0-38be-4ec7-9d8a-1f4835a5965f", "comment": "Malware payload (Loki)", "value": "8854ee0df9b17a0b98d925bb72b200322bb1a156e204c826fc8a529c06f6c951843ba4a829a26f646d127681c56a7da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398747, "uuid": "7cdd6e84-cd2a-4e2c-b24a-e091f63555b7", "value": "T13E254A424DBB41C6E8B70F5C647A76880B34E966FDD8503B3CC9B66A8FF9A1360463D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398747, "uuid": "b09e7ee8-6c0a-46f2-abec-c516aa8e081d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398747, "uuid": "0fc452ed-3259-410d-be16-2cb3a98fb746", "value": "12288:63NWN6El3RCd6UDeSz3L5eytJB/18YAlVdfg5ACDajO+Sm6uKvrth+ktugperuV0:4EOdv6SheYID0ejONZvZtp50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398747, "uuid": "0d56c31a-4ed4-4ec4-8388-7d027d0e0a37", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398747, "uuid": "54452e7a-8e05-4e0c-83dc-5e675c592bd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398747, "uuid": "dbd5ad87-d6c7-4286-b5de-50b0a00211b0", "value": "4ed4fa3beef61b2efe185096c2f05675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0bff6a-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679405380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "8ba2ccdc-e055-47d6-b7f9-1a250a46a1bb", "comment": "Malware payload (RedLineStealer)", "value": "4c591f245efccee54c89669e1d28e675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "ffe4172a-7f5e-4de0-9780-c51bef7c20b9", "comment": "Malware payload (RedLineStealer)", "value": "9f2727bdfd763219f83abb84822108c63dbb410ba13be238292c620eb9f5db9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "ec2fb2a0-722e-42ef-810e-6824c826aa4b", "comment": "Malware payload (RedLineStealer)", "value": "62fc96a1127d6b64fffd9ccd2cdf3693e3569837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405380, "uuid": "c35f50fd-2196-4c71-87c7-1cbf5da4d552", "comment": "Malware payload (RedLineStealer)", "value": "d6b254d5e801738039f5b7ef43caf16b440ae092a19b0f41926d6972b67f5619d6cc45e3be1dc4afbba7ba963dba2e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "99ae605f-3f86-444e-b562-7141efff5a9d", "value": "T132941A5383A23D44EA258B739F2FC6F8B60DF6709E49776532189E2B15B02B3E163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "6050dac1-fbf3-405e-9b2b-6e75d7dcd018", "value": "86f73ba4a5b0bd6d0633bc10b0ac18f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "433f615f-bcdb-4356-857f-bf10bebacb95", "value": "6144:FB8LVJit7HWnbTTABFM/4Vdpk0xtvbJcGP19mzoOtjflVRDH76tgJWJBo:FB8bit72nb3a44VzDnPcoyrWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405380, "uuid": "284a3e1f-8b49-4f76-b766-ea448b8fab05", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405380, "uuid": "b93078b2-a8a0-4c79-9c9f-e7e0317e681e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405380, "uuid": "ecf703e7-1dee-46b3-b0ee-39d8da89c738", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17993d4e-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679397503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397503, "uuid": "cb72a41d-29fb-473b-988f-6422c157ed37", "comment": "Malware payload (SnakeKeylogger)", "value": "f99d5a071e38ed4add47c1d47f657422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397503, "uuid": "36e485ab-f8ff-4777-ac23-0cd54b2debb4", "comment": "Malware payload (SnakeKeylogger)", "value": "9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397503, "uuid": "27a080e7-82eb-48bc-b376-6bb83a37b034", "comment": "Malware payload (SnakeKeylogger)", "value": "94dbd1b97186229391c002d8f4b7aa1f65b386d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397503, "uuid": "e8a8f1e0-96f0-46dd-82c6-ec310692a393", "comment": "Malware payload (SnakeKeylogger)", "value": "f1876d4cbb7572c9d7d72e035f275dcf08d3ff127f6fa901924a613ef638fee59fad09918844ffe962900bef5237cbd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397503, "uuid": "721d546e-72c1-48f2-9161-306a8c57de2d", "value": "T14DF4012A77A9A802C35DA675D2D7552407B25D033333D3486ECA57861A0F7E98C8BBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397503, "uuid": "37905f8d-921d-43d9-a242-bc466703d1bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397503, "uuid": "2409ad1c-b0b0-408e-9f49-e3c3cb2465e2", "value": "12288:gifU3XkzmeoZcEws6AVBYltazIYTX/5J3JFsjx+MNo91XIkrqQqtxPHEoqBChsMe:gOLzD6cEwHAValtazXb5FJCFjeyk1qtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397503, "uuid": "0b9e16ea-f6c7-4fc2-afae-ff7a791f8926", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397503, "uuid": "c38ed6d6-ade3-4da6-a144-9c21a6029afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397503, "uuid": "b3cacb80-6c73-4e54-b302-d916184790ab", "value": "f99d5a071e38ed4add47c1d47f657422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dafb4d0-c7b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679379930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379930, "uuid": "35ffb7c1-362b-4231-b9ce-1575e56aa6f7", "comment": "Malware payload (AveMariaRAT)", "value": "c3c291b38d054d5e71fe17a10d737249", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379930, "uuid": "e45aa134-bc85-4401-9a3d-2475efcf6ced", "comment": "Malware payload (AveMariaRAT)", "value": "9fcf0a498b86fc20af3cc28a984135f0cc202f6577af79f96ec63ca6cb227c3c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379930, "uuid": "0e60dddc-27c8-4490-99d8-d64d1dafc4a6", "comment": "Malware payload (AveMariaRAT)", "value": "86411ff9d41eb140c80753873b943d80be323130", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379930, "uuid": "d18e4301-91d7-4a4c-a05f-dc77e8da17ee", "comment": "Malware payload (AveMariaRAT)", "value": "25e8c26824caf7135d1506bf4000e43ab6af8d5da6466f399d6eb5daf00ab25c4a736744bba6f929c4e690349336729d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379930, "uuid": "432079d1-ab3e-414e-ba75-07f9d1b73c26", "value": "T1EF0508425EBB5085E8B70F2C547B76880B34E953BEC9903B7CC9B61A4FFA69364063D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379930, "uuid": "092eee14-02b0-4ea3-af70-4f7ada5461ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379930, "uuid": "cebd51c9-e323-41c8-97b2-c0f18a630e58", "value": "12288:2nmIb3fNeH++znVXoW87FqKqi13U3mWxw7DG0mCuT7Yeg4firr:2m03fY+WnVX18BqBAU3e5mnn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679379930, "uuid": "3ef5deb6-daa2-44a0-9336-afa1b0e223a9", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679379930, "uuid": "d411b0cc-59ba-4b3b-8be0-62113b75b39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379930, "uuid": "dccb57ae-b442-4f17-a8ab-1a857cdf0d38", "value": "RFQ 31362.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a389f4a-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (5050)", "timestamp": 1679393803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393803, "uuid": "7ae553d4-cbe5-4b52-80cb-713372d40542", "comment": "Malware payload (5050)", "value": "b8a2817a18c49b839304bf3feda54e9c", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393803, "uuid": "b7ea9b3b-90b6-4802-b5ec-3c36ddd0a1dc", "comment": "Malware payload (5050)", "value": "a2003640721f7d056e296c6c84dd78308bbfd2ebf9cf615e7d39c86071414f02", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393803, "uuid": "a1b4b975-43c6-4a4a-b72d-4a77a8bf1bbb", "comment": "Malware payload (5050)", "value": "6c80c4031ec68ffbff11495ee2d057309948421b", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393803, "uuid": "c5d7585d-2bfa-4533-9470-12dbe7d18c21", "comment": "Malware payload (5050)", "value": "5b7f969b404fa9685e75ec1a5303debfa9be1f13d030b1f18f2712d00296760d25b7bc8f8bef971e74da7ebb96e66dcc", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393803, "uuid": "39b34bb8-6602-4f78-9700-0907bfa19da1", "value": "T128D16936825C1FFF683631AD4C1856B225B2953BBBBF2DE7B47504A8250CB1041B6EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393803, "uuid": "27e6d614-49e4-4081-9012-022aa7691e37", "value": "192:M/fnUwLR8EzDM9a9gJ3txML677AfPLrFaLc:dY4Sjn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393803, "uuid": "d384c033-cc2e-4001-95b2-75fd25d3d027", "value": 6532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393803, "uuid": "c654c64b-a441-4ed8-b5a7-de2857f99ec4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393803, "uuid": "de3c722a-cbc9-41bb-9bc1-409a8f0f1bcf", "value": "RIMESSA_CASSEGNI0321023_2828.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44241936-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679398866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398866, "uuid": "43d517fc-2a62-42f3-802b-ffa3e5c3c765", "comment": "Malware payload", "value": "4d4edfd7144cd9b7da3c31f283b52a6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398866, "uuid": "19644e85-7323-449e-8a5d-47b6e0972c0a", "comment": "Malware payload", "value": "a2d2bc0e72c489f9c84bf5dbf11be1052c5c12e6c90ee5aab7856650b5b58339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398866, "uuid": "f80e74ee-2a94-45a7-81b5-a4a3bc2ea9a7", "comment": "Malware payload", "value": "6dee0841059456044bd43f145c4e9dc13c39597f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398866, "uuid": "cd8d0ede-40d0-45bc-932f-5c05af66d6ba", "comment": "Malware payload", "value": "2a47165b405998e5a8f66b5f93f5ab8af0313487356d38c1d325c5fc9437b204a7224bb69974bc4df1b4364a2d095af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398866, "uuid": "8d88ac7c-3332-4c78-a390-ef7b7d6f83a4", "value": "T17E85AF725DBAFDA6E2DD3FB4B01128D8DDF804179B5AF644F84228925EDD3888E051E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398866, "uuid": "79f252f4-bb13-4bf9-ad20-78c2fca79534", "value": "24576:oafQKgqtAyrUFdRZTbwcXE1Rw2qs9kpu2ny/v/LtGZsYjot0+iEzyLU/E5h8bV2P:oNwcXFoaU/E5h8bKlsyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398866, "uuid": "0a9e8630-5583-4fde-9601-a964101133bd", "value": 1780039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398866, "uuid": "3eb4de5c-02ef-45f0-bb59-8d463d38fc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398866, "uuid": "5adcabb0-bc46-4286-85f9-240b48c9786e", "value": "4d4edfd7144cd9b7da3c31f283b52a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa538a-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392658, "uuid": "e39e59b8-13d6-47c1-ab4d-5745a1d365a1", "comment": "Malware payload (SnakeKeylogger)", "value": "375da17b92297ca30b92155cf9abd27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392658, "uuid": "4778b298-c107-4982-8ba3-758d0c5777b0", "comment": "Malware payload (SnakeKeylogger)", "value": "a335efa110fb01b83f389b3f1355c6c00f1eedd155fd91bae5d9de9861ce60de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392658, "uuid": "da2fd54e-a478-45d1-bafe-c3f114568d25", "comment": "Malware payload (SnakeKeylogger)", "value": "32a0cae4d266cf049e3dd6e43f93f2ecc6e40754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392658, "uuid": "a7018f07-5f72-4376-a0df-ef378f315d96", "comment": "Malware payload (SnakeKeylogger)", "value": "5c48786aa0b1a72d5e97ebd0490f49e92e7db8302d9e2207ee3b6e701b11181bceba9745cd9526033f6838eaf7354da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392658, "uuid": "982cceed-548d-4888-8539-019340a324a4", "value": "T1AB34129867B9C0D7DC210B713C3E6AAAAEF1A62B1869DB0707405B64BC37941DC0F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392658, "uuid": "4be049ca-d3d1-403e-9e7c-b8598462f755", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392658, "uuid": "7906613a-0ba9-4acf-ab69-c00cb508eee5", "value": "6144:ZYa6QX9CrnGMAdpswv64NL/WAmBHQ66AgVUUSzY3:ZYC9CrnAPSO/WVBHQ66Ak3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392658, "uuid": "8b38e4a1-e2b3-43d8-8c8e-bcc1b9c7fb0e", "value": 236760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392658, "uuid": "79a80db5-2d18-4844-b165-ebecf41e5797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392658, "uuid": "f9c7e89c-648b-47ad-a9cc-02f68319c8be", "value": "SHG09876544567000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6066801-c783-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679360510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360510, "uuid": "899e8aec-490f-4120-b242-57b50d983132", "comment": "Malware payload (RedLineStealer)", "value": "20704669f05ba30af8912916f8a2cc1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360510, "uuid": "639b6233-ac28-452b-9623-bc9ea2282728", "comment": "Malware payload (RedLineStealer)", "value": "a3e14c8ced3917bb9ea25ad0ac3c9f87369d9d16348e028ee20b770d1e44fa9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360510, "uuid": "28a7aed9-22bd-4632-a30f-b85436c72ce0", "comment": "Malware payload (RedLineStealer)", "value": "b5e1c88e3e98adb62909516aa406358c96a9a4ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360510, "uuid": "2943be50-4e27-4b60-8cac-c966368e3ed2", "comment": "Malware payload (RedLineStealer)", "value": "34a4b6c806bcf884d769bc47e75c46f7e0d012bad3ef81bd80e0743a3c46623349a91bb727afd3c854d24c0940966c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360510, "uuid": "82479a62-73ef-44a9-90f2-dda1da8b2a70", "value": "T1C6442A93BA692616C8E5867088B384E99DEEBD4FB7D4ADFBD1304815CCC795CA372403", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360510, "uuid": "33934434-95f1-4745-b6fd-ce0652dee314", "value": "23ab51c15380bcf81a5cee1a5c0399b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360510, "uuid": "d378febc-e6cb-4840-bb67-0cfd78d9c483", "value": "3072:nwUEID31U40ByGrwB9CfxLR7hh711VsZv0HEn3a8+JkMKt87QxvFPt0HKqCJxIxB:wU5lUFjwB9CfxNhh11V4+9ExFeHKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679360510, "uuid": "f40040a5-76a5-40c2-a7b9-830e46fd6adf", "value": 267768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679360510, "uuid": "1e1bda01-7868-490c-8e69-d17cd42440c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360510, "uuid": "9b998878-91bb-4de2-8aaa-b5b5e04c3cb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4c8a25-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679364386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364386, "uuid": "dc7f36f9-2e07-4d6e-a4b7-33868375f314", "comment": "Malware payload", "value": "33a4a0cd185cf9ce5bfe153046d179c5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364386, "uuid": "5913cf4d-af5d-4b93-8d0d-bd3bcfbaf1da", "comment": "Malware payload", "value": "a4208ab96617742bde0a508cfe53ee6ebaa68ea6c68153c73dd4b58bc7d10d4a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364386, "uuid": "e6d1d500-9645-4b07-8484-3cd4a1640eb4", "comment": "Malware payload", "value": "4467b351b0b02be330f333b1e18cdc0cce6f4a70", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364386, "uuid": "f223f2c5-dbad-4948-9e33-0f7be43d3744", "comment": "Malware payload", "value": "38b4aa0f8e5e44083f8e924efe2d4c15c2547bc1fddbc4f6ec2fbd3d178d044cbdf1597cf9880174225c394f8c4bb034", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364386, "uuid": "d6158761-0ac6-40ad-b01c-7d32d37bf21a", "value": "T167D50182F758B42FC877C0374AB6067622568C598A42E7531959B36CBCFBEC84B85FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364386, "uuid": "9e168f87-b092-45ec-8228-9ce1b3ce6460", "value": "49152:RQdeEsIre6Sf2Qjs7Mt+JoOSRoHBPeWp9AtCqy805sQwZt70lJ0NsxpUJA:KC56S/js7Mt+JouHBPVjAtCqyHq9k0NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364386, "uuid": "3116aefc-f5da-4b2c-83c6-192d65285f6b", "value": 3000963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364386, "uuid": "a115692b-2817-49a9-9481-bb6f0a2d0f44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364386, "uuid": "50496d34-0ef0-4fd4-ae31-7af85047dda2", "value": "ss-kids.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b95af30-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679398878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398878, "uuid": "b437e7e9-c002-4e07-984e-6ff699996576", "comment": "Malware payload", "value": "257f3c5112c75802be4f30e9b5aaba53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398878, "uuid": "67ad4e89-d691-42f0-a10c-7701e5bfdecc", "comment": "Malware payload", "value": "a4cada8dd9fea4f869a27f6dbad976231447db5958ccd99e94033c3c4c0dcec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398878, "uuid": "1a0c55c1-c7a2-4e3d-ab1d-74220dd33526", "comment": "Malware payload", "value": "8841879ea14f89eafa70023145f65dde867d265d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398878, "uuid": "aece3995-6137-4db5-9507-792bc09e7c3e", "comment": "Malware payload", "value": "0aed5ddde5a108f15aea7c17344c925808f079f30aadd82062d62e6ca369ec99668f9b0de1d525e7bc8d149259a60382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398878, "uuid": "28256a4d-83fb-4aec-b9ce-6ea5dd495aba", "value": "T17BC318386BAA5239F53657BD95E42685977E73B32713C84D08B111CE4B63B038ED0A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398878, "uuid": "fd6494b0-b9eb-4558-a595-a83342b9f2db", "value": "1536:gbWYcaEh2MWfWeh8cKWKWKWKRNiotonMao1VDwo8BfnFWcK2WtFa85PDPZu8l+Ve:gWYcb2LfWTnltYMaYcoufnFWcKNFLoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398878, "uuid": "19a09263-3313-49c7-a744-f70f56abee6d", "value": 122750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398878, "uuid": "9bd6cb85-e2a7-4f7e-b6a7-f6c9c1beecf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398878, "uuid": "cf8d052e-4bae-4551-9006-b5b3736f064c", "value": "257f3c5112c75802be4f30e9b5aaba53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3d103c-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362914, "uuid": "87a3dd0f-8efa-4c96-9577-853d5aab96b1", "comment": "Malware payload (Smoke Loader)", "value": "97ba3d7082623cc792f68156791d447e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362914, "uuid": "a4e948c5-b281-4908-bd03-193ff15ecbd3", "comment": "Malware payload (Smoke Loader)", "value": "a558751ec974206e1e42ae4fee80eabb2141751daa11b502f1959d57bf85b57b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362914, "uuid": "dad755ea-fd01-437d-9875-f0b7cf27ca08", "comment": "Malware payload (Smoke Loader)", "value": "bb5c09feed9829fd5a57422330e3a39cb03986cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362914, "uuid": "dec3ffce-97f6-49bf-9439-e5e87d7ee246", "comment": "Malware payload (Smoke Loader)", "value": "b959140c9f5d4d57604fe2e47631b362a0cac6bfef4a01341621ae5d5a92c0d03cdb5ed8a1a47bbc4f3106285488bfad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362914, "uuid": "68b9a737-7920-436d-a0e1-459257c6dc97", "value": "T146047D139BA07866E4168AF18E2FC6B4B60EFDC1CE5D376E3204AE6F0873161D1667D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362914, "uuid": "76ca6112-444c-43c8-817c-ab8d48ca4827", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362914, "uuid": "025bf3b7-8696-4fa0-a188-914f18ecf1f7", "value": "3072:SfMRO3W9ivPWULb5Tvs+PuRK+WY2kAj+Z:rO3OOLdTvswusfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362914, "uuid": "9db86792-5f27-42c4-984c-29cb80e25988", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362914, "uuid": "3f837e3e-667a-4037-a450-85708d27862d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362914, "uuid": "96afb61a-5df5-4a6d-ad30-39d1829da65a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9dfaac-c80e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679419982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419982, "uuid": "b0c53172-1239-4a46-b80d-fefb5a23ce8a", "comment": "Malware payload", "value": "acd81ee9a2774dfc08e99f544a73264b", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419982, "uuid": "2a4d6f0c-17b2-4f1d-803b-d8f9321701c8", "comment": "Malware payload", "value": "a5c6570b63638c3b920cf6542587227ddf9ed77d3e372de1308c4dcc77b91087", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419982, "uuid": "bcf811a5-ddfe-468b-becd-a51ccf8de565", "comment": "Malware payload", "value": "38a6760b1a0c889a1f1464d0df036ac2e7ce2e00", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419982, "uuid": "bc4402a4-0d01-45ff-b5a3-4c31227f43e7", "comment": "Malware payload", "value": "e9cb8ee63edb9be9262c0e3317c6acede3d7d89ef672e83d510904e38966e6b15f7ed6ccca8e5cc3878033008449a8eb", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419982, "uuid": "ab062b7c-3abe-4915-9ebf-41aea0abe532", "value": "T1F676338A954B44C6F3EBB7781CAE5606692E5DE432E8E50A096331A01EC4FF9353F43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419982, "uuid": "63545bdd-d70f-4431-943d-a97c61c3f709", "value": "196608:7JVWvYtvXQJUbaUJzbopoiZAdTVBltSG/Hix2:aQQ6HOaiqdTVNSGv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679419982, "uuid": "296ea64c-ae77-4a7e-8edb-14705ae21eee", "value": 7174458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679419982, "uuid": "304f57d9-8985-4fc1-a3e4-3e242c3c5f14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419982, "uuid": "6f49a918-a071-4e9a-b352-c09896e559aa", "value": "gimp-2.10.34-setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf34362-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679393054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393054, "uuid": "831109b8-5baf-4073-8ef1-f951fd32b051", "comment": "Malware payload (Formbook)", "value": "dac486c2eff9e5a181b85aa8bae52b04", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393054, "uuid": "8010532e-327d-4bcc-b0c1-4a3515f0752f", "comment": "Malware payload (Formbook)", "value": "a66147f8558c01ed42611b4ca6ed4b66aa73262ec1509b8979312a60ec518a46", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393054, "uuid": "ec30870f-f027-432f-8460-63e24262df42", "comment": "Malware payload (Formbook)", "value": "44ce0bcb951fd7a580438c31762f0df522147840", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393054, "uuid": "2df833c5-4b1e-4fce-9ad7-892ba4a9b633", "comment": "Malware payload (Formbook)", "value": "d1f585af36a52f687d0b83adaa9c8e19e25d5601f4015d62cedf0b871210480e2f5c4d700104a94c420c11c88d7673ea", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393054, "uuid": "3a9f99be-b6f4-45dc-a58c-adae338eecc8", "value": "T1AB350213F9C58D46D40247B56BF3B999631FBC526BE296873348B70F6FB4AE0490321A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393054, "uuid": "b487076d-47b7-4e04-9f3c-2765a0419abc", "value": "24576:hLKGWQmmav30xo+MXUu9B3bVU3bVU+MXUu9S3bV3pMPQ+jj:hLK7QmmQ30e+MXV9B3bVU3bVU+MXV9S+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393054, "uuid": "09fd6d66-243b-4a8f-9a39-3fffe8764681", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393054, "uuid": "169946c5-c85d-40f7-965d-956199faf27b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393054, "uuid": "e5aa00aa-13d6-4315-866e-217a68320549", "value": "P772215 \u10e8\u10d4\u10d7\u10d0\u10d5\u10d0\u10d6\u10d4\u10d1\u10d0 7 \u10d9\u10dd\u10d3\u10d8-\u10e1\u10d2\u10d0\u10dc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de92a8ce-c77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1679357893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357893, "uuid": "13abfd28-0ab6-40ac-9761-6d1cda244282", "comment": "Malware payload (ManusCrypt)", "value": "7e9d6867dfd8711952376aa02aaeb453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357893, "uuid": "51284bc2-64cd-4235-bf2f-2e6bb1c75012", "comment": "Malware payload (ManusCrypt)", "value": "a759dfe145751752776c392ad2f5dffd1fa7f4e77e3f5daeeb2258baa2271262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357893, "uuid": "a37fc97a-93bf-42b4-89c2-0ccef39147f5", "comment": "Malware payload (ManusCrypt)", "value": "a90cf5c5d9079716dde8b0c2be20dbd6fb0fbc3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357893, "uuid": "250a4686-5b40-455e-a495-0ccb11c480c0", "comment": "Malware payload (ManusCrypt)", "value": "dfaae1a3bed0ab4fe2aec0c016f669f6e0b216d384e6c0fe8d8a8bb71f90c46fcc9e5dcf44f3f69fa4eae10b79be9339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357893, "uuid": "fbbb67b3-be65-4071-873a-417a721c30c8", "value": "T1E7150AE62190F177CB2996F1C655F8F608FC3C24EA1C22D751A33E64743ED26C92A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357893, "uuid": "d5817bea-ce45-46ad-a633-5fcbec575a56", "value": "9d7d0119149b87d9470a48af373560eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357893, "uuid": "65194b97-15c2-498e-8795-c50a4fbbe897", "value": "6144:LQuiA1RTz/cYja2ieb5YbF5R+Jn8xH97r7F/1d43wUmDm:nz/9ja2ieFYp5R+I7VY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679357893, "uuid": "12c11801-ecab-478c-b680-5430021c8be5", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679357893, "uuid": "7d1937d7-c127-4176-b3e6-91da81ddb5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357893, "uuid": "971b3e91-49ef-4df6-8608-5fc5ea0d174d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726edeb3-c77b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679356853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356853, "uuid": "19cfcd2f-8ffe-4242-ba93-1322adb4222a", "comment": "Malware payload (DCRat)", "value": "4994207972e792f8112c891760ce5523", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356853, "uuid": "d5609ecd-4290-423d-8ef9-079e843c5a1d", "comment": "Malware payload (DCRat)", "value": "a81fc84f16fd6501f5fcfe6e031fd4ac73d93e48a076aca3f96f1146df8d906f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356853, "uuid": "b0727665-0a8e-4c01-b86c-3fc69088fdaf", "comment": "Malware payload (DCRat)", "value": "bebd2f10abb04fb39d33eead4ab01ac0c98c38c3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679356853, "uuid": "bd19dd75-ca27-4aee-a7bc-e24eb6c68398", "comment": "Malware payload (DCRat)", "value": "0fabe74f12e91cc138ac558b58956c9b76e8dec01b2868a082fd73761d75fd61846618822432dcb7ae9be913b84a8fda", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356853, "uuid": "10c1ee6d-85e1-413c-bf2c-247d32634ac1", "value": "T121859D017E44CA11F0191233C2EF490887B4AC526AA6E71F7EB9376E65123B37D1DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356853, "uuid": "7ae1251b-91fb-4386-94ca-b1cf2919fb24", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356853, "uuid": "141ed568-353f-41cc-a9d6-caf4d5af8ed9", "value": "24576:U2G/nvxW3Ww0ted5uhXpZw1OtBN/8ibAs9ALpW7q7e2k96SQsa+JFu2sIz4xP:UbA30ed5o/LABVS+YcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679356853, "uuid": "eb0ad526-99ae-44ea-a2a9-99b93f6685ca", "value": 1741999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679356853, "uuid": "bb562760-ed2e-49e5-b638-9b97a9b1419e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679356853, "uuid": "83b63204-884d-4264-8bd5-01ef3ba64810", "value": "4994207972e792f8112c891760ce5523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc2a287-c7ed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679405861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405861, "uuid": "153cc7d0-0ab5-4ee1-a1b0-50a3002c0257", "comment": "Malware payload", "value": "be00e00a24137afd307f5b71aa9a88cc", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405861, "uuid": "6be75922-b720-4cb8-8a72-ac7a1000b839", "comment": "Malware payload", "value": "a969208c5cebc38bd631910188a1d16bc3d9ff6cdb84c5fe3d40da2b4617f314", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405861, "uuid": "4511bcd5-8e48-4a91-95d6-ab001f1c37fb", "comment": "Malware payload", "value": "ccca176c1b12247ce12362e7a9460b6028013ac1", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405861, "uuid": "2a2d2f0d-395e-4498-afb2-2d699f0372e9", "comment": "Malware payload", "value": "05d46d83864eecd6db47f3f71df312cce2f182bbf04d06a1e0b25ff88b5491f435468d50d0a681d3169a37cb90cb2786", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405861, "uuid": "6e4fd84a-4083-4ca3-ba6b-bcbcfa2de6a0", "value": "T1AFE0C24EF4DBBF91E2CD699B0DCE2A85AD4C1B9218D03E136E9D170046E8F94960AA5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405861, "uuid": "3d68d361-8fb4-42ad-978c-d27bd612ff6a", "value": "6:SGIfGlkQ4GncUuDA4x72AIjdyxLJPuOmqZmsXeYQdxMwVt+cG0aB9SfIWgBAi25j:Qgk2pjdSLJWOmqZm7JM++cGJB9Sdpi0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405861, "uuid": "864385c5-fe58-43d4-91fa-ae7038754604", "value": 301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405861, "uuid": "bb82f574-3d74-4a3d-844d-6c0b04205e73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405861, "uuid": "4a107f34-6e8b-4e91-bcf4-b411c6231967", "value": "482_CONTRATO407.001553.36701.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9502aedb-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384828, "uuid": "5a7742db-21c9-4406-a6ad-abc8c152de8d", "comment": "Malware payload", "value": "8c5f55e36dadfa7a7d12d0cc11f35c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384828, "uuid": "d086b4fa-2fee-4860-a646-8174cdd8a878", "comment": "Malware payload", "value": "a9b8f1656e499c20f1db066bc115ad67a1cfba416ea8eaf3a0417e411cb955b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384828, "uuid": "52016fc5-3b7f-4cc3-97bf-d788f600f0a1", "comment": "Malware payload", "value": "788e0c403b8092d2ff3b3151cf7d827be9fd533a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384828, "uuid": "a72a687f-8ea6-46a7-9c32-8ee5891d1d0d", "comment": "Malware payload", "value": "dbc407c2c4d92b250c87ccc1a1b0a20e09e293651be4ce2bcf47d758f2f6f29ff18017ea8f9a22703056b88fae2af240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384828, "uuid": "5350a06a-13bc-429d-a231-d8e9dd4bff46", "value": "T1F9C58D36F9804CB2C82319385569F336B5BC5E70272DC3D772497B1C2AB55C24A3BE6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384828, "uuid": "e1143b11-26cf-4435-af26-5d8d8ca8cbbe", "value": "274e645a1afafbe24fd83b023a4bf389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384828, "uuid": "aabfc65d-3e36-4059-90bd-37dd96a3eb35", "value": "49152:yPz6a8JPkaBvLiCPmUKSM6saWqgfB2pfuo3qFlMYe+0:y778JPkaBziEmrz1aWnfB2pr3qFl9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384828, "uuid": "51c04d6b-ae2c-4192-864b-bfe529132a82", "value": 2566144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384828, "uuid": "d13a7100-f573-4c2c-b8c6-de2ccda1471e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384828, "uuid": "04466599-0ddf-427c-90a4-a98f52dfb76a", "value": "8C5F55E36DADFA7A7D12D0CC11F35C61.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c1821d-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392659, "uuid": "4889508f-3155-498a-ad36-03e3b132af29", "comment": "Malware payload (SnakeKeylogger)", "value": "65b74e983a1ba012085ef6a5fd3c343e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392659, "uuid": "c9077712-31ce-4816-bad8-17ec685b35a0", "comment": "Malware payload (SnakeKeylogger)", "value": "aa1dc065f798952f199efd19aae9ffa6c4c13f388eca7dcf298c7a73de2cdb7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392659, "uuid": "869dd898-5b6e-413e-8915-269de752b95a", "comment": "Malware payload (SnakeKeylogger)", "value": "54ac191f3f1d4b5889a97986c4dcb7fd968b134b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392659, "uuid": "149c17db-c82f-423c-abd0-efa50cd93978", "comment": "Malware payload (SnakeKeylogger)", "value": "3605514b67c406a7541fedd75bc7fd6062949c915999b67af9227a5d98a347644a88940ab79f1f77bb07bf3410d3a09d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392659, "uuid": "24359a3f-59e7-4bc6-8c43-c965ac881353", "value": "T15BF4020A33695902C29A3175C1D755140771AE4B27B3CB4C7DC9238A5A8F3FA9D8ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392659, "uuid": "db8b253b-ce08-4649-9ece-6465f9651c62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392659, "uuid": "14252995-7a16-46b8-9f30-a8800968a1cf", "value": "12288:4oURU7W/xQjbT7NE2PPcwFY8/NGoyhR3cTXCqW+e3K0Veian/ltvkGv:4obAxwbTqIvFb0BfKC5X5an/lZkGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392659, "uuid": "85f22915-c7a2-42ab-a2aa-accba7ef573d", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392659, "uuid": "0ace0c68-4067-4b31-a1f1-0cf4eafd8dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392659, "uuid": "92a06c6a-41e3-43a0-b77f-c2875b22fee9", "value": "Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723b54cc-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679392930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392930, "uuid": "7d5a08e7-3b4f-4544-8256-2d2a7f463b45", "comment": "Malware payload (Smoke Loader)", "value": "c741395b2117920307fa6aea5ef9d973", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392930, "uuid": "c7761287-e00d-4482-872d-f4a1cfcb434a", "comment": "Malware payload (Smoke Loader)", "value": "aa4f54a9127acc3c861c1278833ddca5db84792eae9630f6eb28b90fbc3a627f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392930, "uuid": "da15a332-8b5e-4dd8-8e4d-414e9eaa506e", "comment": "Malware payload (Smoke Loader)", "value": "c027e73654cc9aa893ef8125c25473df1e948197", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392930, "uuid": "aea67561-b2d0-40c6-b9bc-867509d3933a", "comment": "Malware payload (Smoke Loader)", "value": "c6db27a8c792f673aadbc69652a2a3e386570cdbbde004def8981f3ca8a3846f7ffabbcb4ebd53260f9f0619a581e53c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392930, "uuid": "9e63a5b9-2918-447c-ad94-e1abf38a2d4b", "value": "T1DC048EC35291B865F4258A358E2EC2F4770EFD91CE59AB5AE3046F6F08BC172C5A3712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392930, "uuid": "a714065a-12a8-40d6-aaec-0db903f8e354", "value": "2bf4bd16bd9a3948cc472dde1e8c8ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392930, "uuid": "0d51fde5-59e4-4a01-a17d-993bd8d9da5f", "value": "1536:IvXO/PQYlxOc8vwwyCWIye1hPuIys+/qlboeP5dbe+89GkF5PKX8AJL+LfHkGCTL:IvwYX6Xc1Irs+ylbosLb65tgmERzQpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392930, "uuid": "74f30679-5445-4886-8cec-fbc23b64fb4b", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392930, "uuid": "263f467d-3392-440f-8c9d-0240bf97ae6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392930, "uuid": "0c52c36a-d88f-4b03-aa95-9f28eddbc641", "value": "c741395b2117920307fa6aea5ef9d973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcab4d97-c823-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679429133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679429133, "uuid": "ab173dba-9929-423e-b7f3-f710ace22e2c", "comment": "Malware payload (RedLineStealer)", "value": "09ce7728077b6de45e2e06d285fd2b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679429133, "uuid": "7ce1f894-c03f-4c51-9048-78d3605c9c2a", "comment": "Malware payload (RedLineStealer)", "value": "ab9618395cf2a8bb724b0a2242688c63d36bf8f06ddd536ccd3dbbfb88c201db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679429133, "uuid": "d668fa4e-781a-4c95-8ffd-889e5d55cba2", "comment": "Malware payload (RedLineStealer)", "value": "c7e38f2f996de54979b3ef929786a3562b632be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679429133, "uuid": "00d9d0ef-2ba2-40d5-8d03-4bf61beab4ca", "comment": "Malware payload (RedLineStealer)", "value": "830a7db61a60115dca46b9ddecc74c9a530913e74ab4b94fb78af8388fdede51ce5bc06da5dccba4784465eaed825bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679429133, "uuid": "c84eb760-ca99-4c1a-861d-70e529053ada", "value": "T11A630201FBCD5378C9AF11BC4AE26B7233B346574717AA0E7EA44479D6706088F391A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679429133, "uuid": "a1b577c7-8c69-4203-9594-f62761a99f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679429133, "uuid": "635294df-fc21-44f5-8073-6f73789479c7", "value": "1536:PHK8yKmUYCC9jM2nYihRIK0fRbtcO1UBxgQmmIm2bcy:PHdBPYCqw7ihmKc1KBbmmI1bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679429133, "uuid": "5e3d10e3-d92c-442e-aeba-340cdba72a2c", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679429133, "uuid": "e6e25d03-c711-4209-9113-8fa9e3ee7893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679429133, "uuid": "c94f81e5-b824-4cef-9933-7987985f85c1", "value": "09ce7728077b6de45e2e06d285fd2b20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6cf45a-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679393404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393404, "uuid": "0d8da454-5f94-4c99-8ecc-5859fcebe260", "comment": "Malware payload", "value": "a27c63b8fd7bcc4bec2ce29454636143", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393404, "uuid": "50270580-992c-4bdc-aad4-349f292e11dd", "comment": "Malware payload", "value": "ab97bbcda5baad1b76a138dcf544a1d0e0e35c925cb3ce71a6f7284344ddd291", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393404, "uuid": "acfee3d8-01f8-4522-8273-4adc731675ef", "comment": "Malware payload", "value": "fa57b127caaf299d43f15a38f18a8b55c3dbf582", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393404, "uuid": "a8aeda62-b4f6-4798-999d-9ec7d6da2bba", "comment": "Malware payload", "value": "70b387c08eb62a0a7dff612ea3e5fe021bc777bc1976d8bd3592a5a32d31369bb68788ea9ef05f7906ecf543a8598f5e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393404, "uuid": "7b21b0d3-7438-4da2-9eb3-f2c37b65d2a8", "value": "T123155C789D9845E2F83CD775AEB1C53291236FE7AB318D1C04CA3E6B3FB6252548901E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393404, "uuid": "ebad862a-231d-4b4e-b608-198062440cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393404, "uuid": "853ee6a1-acab-4712-bd8a-aaa9f2c6ac72", "value": "12288:4lKr2iNxKlgNGSD7sL30ZSYMzdZKBP7r9r/+pppppppppppppppppppppppppppv:ua1r+MI0SYMzdMB1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393404, "uuid": "c66a4a99-a8b6-4bb8-840e-ca52c9083df1", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393404, "uuid": "ae604c4b-5120-4519-ace4-e938be34ef03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393404, "uuid": "13244ebd-68e5-45a1-b2f3-89687252f7ce", "value": "DOCUMENTOS DE ENV\u00cdO DE DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c923df2-c7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679377781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377781, "uuid": "7506daf1-ffcc-4f2e-84f8-87d8ce68ec89", "comment": "Malware payload", "value": "cfd331366ba1aeec95b8a8df3daf6b24", "object_relation": "md5", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377781, "uuid": "3b2105a8-0430-4c67-a93d-b59adeec68a5", "comment": "Malware payload", "value": "ab9bd97e350f7131c358da0db0d78182e4b96790155b646dc773df96e317d5cd", "object_relation": "sha256", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377781, "uuid": "eb812942-c6da-4238-a07f-c2546891213a", "comment": "Malware payload", "value": "bb8a2fba2fcd5a88345c320b41806d3cea611e63", "object_relation": "sha1", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377781, "uuid": "0ae79177-5bd0-497c-96b1-ee19cff4f857", "comment": "Malware payload", "value": "4618998fd1d2fa9a5e6b4290872bedfff2836d5dd4e4a76bad9941415bd6fd774266845316f5575925d2df35fdf60d0b", "object_relation": "sha3-384", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377781, "uuid": "8a2b9162-3b14-4bf8-83cb-0cf780d4af94", "value": "T147D5BE22328AC272E6BE41715569D73AB1BABEE20BB144CF53D41E2F4E345C1573AF12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377781, "uuid": "ffd31e5c-a770-4223-bc44-f733d6d876b9", "value": "49152:dphtaDfpLvY+PMg85nF9Brz2q2+5ZPsZAAQPN162wOR4UkrfF1OrEMBZX26PH2ca:nif9vYMor6qlAMlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679377781, "uuid": "fa4cf1cc-2c27-40dc-b7bf-7c3477126633", "value": 2898944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679377781, "uuid": "cc4b859b-44d9-49db-b0ef-043012f77d75", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377781, "uuid": "ddc4762b-c10a-47e5-b410-df67f577ae45", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546ebd32-c829-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679431535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431535, "uuid": "80da693d-5e69-4ead-a61a-87756d9c9310", "comment": "Malware payload (DCRat)", "value": "09cacacf6eef86e62b26d5d1ca217c8e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431535, "uuid": "e1b4e0bc-d9c4-408d-82f2-c1f4fa98408c", "comment": "Malware payload (DCRat)", "value": "abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431535, "uuid": "1cfdd1a5-1ca7-4b01-b9dc-82f1d11fcd29", "comment": "Malware payload (DCRat)", "value": "21520171163005980651861cea13fc6edc82d2da", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679431535, "uuid": "63943b26-2dce-4eef-9cda-8a310eaeca37", "comment": "Malware payload (DCRat)", "value": "da86cffe46bb87320b13a0164f02212ed55f032f56291f6f9ddd50c5db7a85061eafe8e762f86f78ca535117144462ed", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431535, "uuid": "2df4d168-be4c-4347-bbcd-9d13e0117095", "value": "T1D9C5D0417E44CE11F0181A33C2FF554887B4AD512BAAE32B7AB9376E65123937C1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431535, "uuid": "f7571e6f-a482-4dc8-b7a6-610cad62b9be", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431535, "uuid": "fbd324cc-37d6-4fc5-a432-a14cca827064", "value": "49152:ubA3jlSSI+tkWr2mvKSq32s+FBf4HrypMFQtwfRKSSutCn0:ubcSbWr2mLHyC8LSut1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679431535, "uuid": "d50bf72a-9b3a-4121-9118-593a4314575f", "value": 2720900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679431535, "uuid": "b3dd3e98-729c-4481-833f-367822f8ce41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679431535, "uuid": "d2e4b9fa-dd06-4183-866b-ef5aee0ec1bd", "value": "09cacacf6eef86e62b26d5d1ca217c8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c457e92c-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679362574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362574, "uuid": "32c4f196-b660-423e-9440-2a0d58025a25", "comment": "Malware payload (Amadey)", "value": "692a89572a671956fb94e94432ada89e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362574, "uuid": "4a5f1abb-15c4-4c8c-96ef-9751bfb65fa9", "comment": "Malware payload (Amadey)", "value": "abf88f303f24e88531416f5337f43987e0d31a2fe089c73c1eb8aa23bc037066", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362574, "uuid": "3b67907b-6654-4e2a-8b82-bfb37bd09ccd", "comment": "Malware payload (Amadey)", "value": "ab37c7517e57bc7e12a12891f981937e33b0ccf4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362574, "uuid": "cbe80958-884d-43bf-a2cd-1c870048a4e3", "comment": "Malware payload (Amadey)", "value": "4393fa207b9e58bbb7a1f499ccc533c85a4c71671e1a914f22aa926b8ea053f671013de8011aa973774ebca3e82598a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362574, "uuid": "33c6e37a-4033-4f88-a3b1-ee8b8f23c131", "value": "T1A7047E039AA07C52E526CBF29E2AC1B4B70EF9D1CE5D675E32046E3F0873162C56A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362574, "uuid": "2579cc0e-25a0-4574-a824-3abcf45d0914", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362574, "uuid": "69924699-ec37-4801-97e8-12978f9269d5", "value": "3072:yu1Xda8GTvCSNWbUiB+8HRqsHWpLBDdNJZ:j/a3TdiB+8HwiWpB5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362574, "uuid": "de2161c8-57fe-482f-892b-0ebb22da1504", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362574, "uuid": "ebc02275-0e31-439e-9b0e-fe6575708edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362574, "uuid": "ba7a151e-5db7-4d67-a50e-eac07daa46b1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018c97ff-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679398754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398754, "uuid": "312b51f3-b04f-4749-816b-af5065bf2a85", "comment": "Malware payload (Loki)", "value": "2ee15a7119d7ce4ed2a4bae6e801ef01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398754, "uuid": "20dfa79e-0d28-4bf8-adb1-b858fde2532a", "comment": "Malware payload (Loki)", "value": "ac4ac969409616f3fcbe4983cf7ef19728dbfb8ffc34e2ee39943027e1bf37ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398754, "uuid": "e3ed1baf-fefc-47c5-866c-17c03088236b", "comment": "Malware payload (Loki)", "value": "73654c754c5c0cbe24bd47c79e968e9b6b560fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398754, "uuid": "a1b935c7-3375-4957-8cf9-ded39f0fd5a8", "comment": "Malware payload (Loki)", "value": "1b5fe643800ff076f63aa2424e1acc0ebf746227ee978e76278cf87a2b64320fee22f10363b469757c1fe0198ed707d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398754, "uuid": "baad31bb-0f99-4269-8efa-7d40ab0b6aac", "value": "T1C6F4015F775C9813C2992939C1D7692403B269832337D7497DCA224A190F3EA9A4FBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398754, "uuid": "948018d0-8d94-4979-88e2-9c2ea4ffc59c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398754, "uuid": "d893e0f7-80a7-47ec-8d23-8c1683dcc932", "value": "12288:4jBHnTjuWaAmXlhodTULtFcJzDyC9jfzrSuk8CYjF3GLH78j5RyRpE9t1eWPt1:CJHaAFtgcDhfzrk8+H7893tsWPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398754, "uuid": "a3f6cb9a-8c44-4713-944a-8ebf7b473f1b", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398754, "uuid": "c9550117-f439-4776-986c-0816c5e25653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398754, "uuid": "6baea236-a4bd-4536-b1b9-197841ac7a2b", "value": "2ee15a7119d7ce4ed2a4bae6e801ef01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b905d2f-c815-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679422876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422876, "uuid": "d9304690-50f2-4c4f-8c49-febe3706d0ba", "comment": "Malware payload (Formbook)", "value": "a8cf19b90b033ec838fb2f8087b547e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422876, "uuid": "5e384ba8-e282-49e6-8042-4d9e99eb07b6", "comment": "Malware payload (Formbook)", "value": "ac61c80f02e15eb3705836ff8dc9d81543eb0e26059d4aaa9b0895c716deafe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422876, "uuid": "389270a2-25c9-4e4b-84e2-915620307fec", "comment": "Malware payload (Formbook)", "value": "b30b0fd64696b601f08d05130dfcac418decadd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422876, "uuid": "3fd7a02c-40ec-48c8-bd55-7851a0f28ef9", "comment": "Malware payload (Formbook)", "value": "da26ed2aaccd2b49a2dd6c0c6accc7c40d00985e73fa695014261b0c74898c484dd6c0fdde1ef2eb2610e8bb1b8ffd3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422876, "uuid": "3b577ed7-c254-4c64-8583-9ac2085e38f6", "value": "T12E457D462DBA20CEE8B74F18547A7E940B34F863EEC99137388676198FFD543A5063E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422876, "uuid": "ab8f7600-24c0-41d2-992a-f72468a6eea8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422876, "uuid": "5b3cf4f9-ef48-4945-b5ba-4a9e9896f60e", "value": "24576:IaanD27lNUYEKfjxAQ+f+4yHQLDqLyxi79Kbdi+sgIYF:IaanKEKfFAQ+trih0oIIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679422876, "uuid": "f5485620-4354-4ec7-84ec-5d7e4226c270", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679422876, "uuid": "648b75f6-9f9b-4c38-a09c-be40dbd4bcab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422876, "uuid": "377b7b92-c106-44a8-be26-a541adffa5a7", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbb378a-c7d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679395261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395261, "uuid": "bfae6790-443e-4290-9e17-236c4fa51efc", "comment": "Malware payload (Loki)", "value": "d064bfcbf2eeffb0dd746daeb03a7208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395261, "uuid": "6adfa136-0d45-44b7-869d-3a2299134f37", "comment": "Malware payload (Loki)", "value": "acfa4d38373ad711e821419ddd439552de9c25585aa4c75b04279d6528cc2c56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395261, "uuid": "a3718a34-667e-41d0-b488-738787fe4cfc", "comment": "Malware payload (Loki)", "value": "f4d8b74d2bdb3829aab218de32645ed362b9a476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679395261, "uuid": "78040f7a-9308-42c0-9157-d7e8efa16723", "comment": "Malware payload (Loki)", "value": "7e1b9510af5414519fc616e78d4e2bdbbc23b595f83f196f22ceaf5b1cf34cc175766d648d3edc7331165f7809f40cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395261, "uuid": "fb595f74-33a0-4045-9e09-982da3db8ca2", "value": "T1E3445A0353E27D50EB168B728E1EC6F87E5DB6708F497B5632185BAB06B21B3C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395261, "uuid": "7ee04ca7-b64e-4ea1-a195-fbc3ae7ce0ff", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395261, "uuid": "f4798a04-66c3-46e2-a40b-c60216a964d9", "value": "3072:8ii05qf9LLir4UUX9/W0oshEe2weGN1nmDjpwpEm65aDaRRDhGFpy10wZ2H:kf9LL/59OKh8GNwDjpwpEmlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679395261, "uuid": "e1c9b29b-09c8-4b38-8029-15a68729a93e", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679395261, "uuid": "af472e8a-1ddb-4708-9736-5e97a209757d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679395261, "uuid": "d93a1d54-c53e-4cee-9f3c-829380c50f26", "value": "d064bfcbf2eeffb0dd746daeb03a7208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb9b96e-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679405569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405569, "uuid": "59847255-7c75-48d5-9b28-f1b38f7c346f", "comment": "Malware payload", "value": "691d949fdb501e0a4a10f335cff8b01d", "object_relation": "md5", "Tag": [ { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405569, "uuid": "76374192-cc5e-4da5-8d90-fe2b8b862457", "comment": "Malware payload", "value": "ad517cb885ee279ec6ca95cd7402da998ec5461461f745c2f075085ef49b4eb6", "object_relation": "sha256", "Tag": [ { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405569, "uuid": "e188a74d-be67-47d9-88ec-8a549b3c69ae", "comment": "Malware payload", "value": "d236938f8197f6bd00d9c6b43d5cd288208649f7", "object_relation": "sha1", "Tag": [ { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405569, "uuid": "15343e4b-6355-4005-9616-e610f803873c", "comment": "Malware payload", "value": "a70cc38d6fb687d61b7f54823bb5196dfb84169e24bdb0f59a6a125aa263776f0b16ad7fc702dbe58aa07bb7b02cfe8b", "object_relation": "sha3-384", "Tag": [ { "name": "fattndl-site", "colour": "#116920", "exportable": true, "hide_tag": false }, { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405569, "uuid": "31b102b4-37f7-4690-b906-4854e57443b0", "value": "T155B2CF785938C84DC44547741A1F372EABC8F56182E66CDE04B8E2A4B04BCBB7955A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405569, "uuid": "f06199c8-fe3a-476e-8ea5-a50b47619324", "value": "768:hgiREuzcyTgJb+5B2VVmaHsviiv9VXquAN07wFFq:miRHzG+5sUaHsviS3aaWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405569, "uuid": "91528ab0-6cb7-4636-8856-b0a9ff4f1643", "value": 25036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405569, "uuid": "f37ec60c-3af2-44d9-a4f7-ccc077e1806c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405569, "uuid": "96f0642f-f612-476e-90b0-d5dc26771e37", "value": "RIMESSA_CASSEGNI21032023-1959.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8921b02d-c787-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362045, "uuid": "eddde7c9-45d0-4844-ad40-1eb1c3858fd9", "comment": "Malware payload (Smoke Loader)", "value": "2b505c0016f3ac7ec39e3ad24255145a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362045, "uuid": "23ee1ebb-bc4a-4821-802b-3d5509fdc450", "comment": "Malware payload (Smoke Loader)", "value": "ad7fd4fd8efb14efb514e3208ebfb1cb65bf2080f9bf3b56336431ce2ccb3a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362045, "uuid": "fb56f9e9-1ec4-41dd-a56c-9592f6317517", "comment": "Malware payload (Smoke Loader)", "value": "cd35031910c2c71f4f0e647a60b98f533741ecbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362045, "uuid": "95e25fa1-7dae-4173-81aa-51b750af2624", "comment": "Malware payload (Smoke Loader)", "value": "44c45c2581000d7d729bdd92ebb7ddfccec1233494813aaf3e4df708831acb7e64653c4b7e79d9da0479d771a3094961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362045, "uuid": "d3cca42d-b7eb-41f9-9cae-a8afe98a8a6c", "value": "T165443B13F2F1BC54E516CB729E2EC2E8761DB5504F59776D221E6B3B06B02B2C26331A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362045, "uuid": "90b6e1c4-7a98-4ffd-a321-9454c301a9c2", "value": "c901cf1b33a79cac7fcfec57ffb66976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362045, "uuid": "fa94b6c5-9e1d-4c99-9af0-437212766a57", "value": "3072:CDSHoX9L8Ttm1qgKHaHOdp6HQ6fmja8jFC1QM15nbr8qJh+:KX9L8T00CHOj6HQtjaoHYv80h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362045, "uuid": "87a3401c-75de-4190-b9e8-891768836c8a", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362045, "uuid": "b80362a3-382e-406f-9d04-3ae685d45ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362045, "uuid": "58593026-3976-4b66-9eeb-b044a41252d4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a639f7df-c802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679414922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414922, "uuid": "4f8eb650-72bf-4d67-8a45-31ca05369f53", "comment": "Malware payload (Formbook)", "value": "2eb2d005e9e53cee355efd983c28d2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414922, "uuid": "bf274a6e-0dbe-4b32-b062-0ef366b5969b", "comment": "Malware payload (Formbook)", "value": "ae2e5e556f6fab620a62ed8dfe072e73ebff0a207177e48cb3b65253055205d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414922, "uuid": "b935c1cf-5c33-4ad8-8d21-0e5cf17d419a", "comment": "Malware payload (Formbook)", "value": "08df5dbf90f31c000b4ba06529b94da1ec3a4473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679414922, "uuid": "bce982df-2b08-463f-9035-91dcd0eeed0c", "comment": "Malware payload (Formbook)", "value": "a28d4f3716a35cf972eb7a3b60c845a74f37608b94527c1bb71434cae0a17c04ef386910bd66fd15541fa0862bbfc8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414922, "uuid": "1e19d367-d1d5-4356-82e4-4e8079e1b369", "value": "T1C015F18E7612B1DEC82BCE328A606C94A72065B7571BD757A01312DDDA0DAEBCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414922, "uuid": "edaf930b-79c3-4585-85f3-59d24fe03d43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414922, "uuid": "913ca45d-5f40-4750-a100-0e86dae4429a", "value": "12288:N3Xo0cwqYwceebNpo45Tx4h7p70n8Zsg+Us827SwEVaCLhgiHEmYIOySza72rLnf:i0Wmfd4h7p1ss27SnUShRbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679414922, "uuid": "2365057d-e02a-4c12-8871-44761291eee6", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679414922, "uuid": "097ac6be-e112-4788-af85-fcc8684c1d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679414922, "uuid": "2be07bea-0dd8-4093-9d75-0aac3a878025", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c454423-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679384813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384813, "uuid": "957b516d-d509-4415-a5cb-e69b5c8e874d", "comment": "Malware payload (Heodo)", "value": "5cc12c9c6ce9ad8969ce180c4e06d72e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384813, "uuid": "8370a13d-b62f-4a08-80b9-418ab899ffb3", "comment": "Malware payload (Heodo)", "value": "ae4f3b8731c2b56a556827fe8ccbc52ca7d0535845c29be35fa3836783f76986", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384813, "uuid": "807847bf-5c90-4c53-ac33-6a4ff19eede9", "comment": "Malware payload (Heodo)", "value": "13a302bff0498dc42bb01a79fcbdb150dd792691", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384813, "uuid": "de1af5c7-93a7-4938-b14e-53dbdeaee02a", "comment": "Malware payload (Heodo)", "value": "24d38676e5534f2cf6361083fde39bbaff3824fa7d441187c7ca64f295136e82fbc2cede547544b2eae906a82e1892ae", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384813, "uuid": "46bb20ae-e47e-4f41-bd6d-0d9a2662d833", "value": "T1B115F0AC74F5BA4AF5C4837FC6852CB6DB3CA540D7A93D9B8E2041577D8310E1FAA860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384813, "uuid": "06fba1fb-1b1b-4a17-b0b8-ad9e0717d565", "value": "6144:MPdXQBxb0BK5Z6lA8UKN7daEUhFRLinfmfjffdPmLNAMB7oj+uUsZ:3xb0BGobUKNBarhW4dQA6oj+un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384813, "uuid": "c6531fbb-e2b1-436b-9d34-e654dac01fc5", "value": 956905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384813, "uuid": "15c81168-ef80-4635-80bd-137613c53405", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384813, "uuid": "e27e7bc3-fd96-431c-bfea-d86aba0585ae", "value": "6EA930620E66F8CB84E1774D0A6C0B2D.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd28eb9-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392681, "uuid": "6228f597-27df-4b91-ac54-ab5cd549d8e9", "comment": "Malware payload (SnakeKeylogger)", "value": "342d347ee5afb4c16fb543f80dfba65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392681, "uuid": "087b306b-8a42-415a-88f3-4c2a8bc2d607", "comment": "Malware payload (SnakeKeylogger)", "value": "af4ad10f654b460da90e68d1592f3cf396a1052b39bcdabd6f13b2f9a5891624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392681, "uuid": "6357f52a-f9e5-44fa-9eaf-ad7eff0a9a3a", "comment": "Malware payload (SnakeKeylogger)", "value": "b09d307b860b8eb3276127e42a6a8a7383106d1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392681, "uuid": "c4a7e66f-d7f3-47b6-8daf-0caaa2bc9cd5", "comment": "Malware payload (SnakeKeylogger)", "value": "9bde361d1bcbe6132f8f96e067fad27ed03d9f5b530999388000607eec0b0eae26cdbfc36791ef6bbb6dd4a966fb54c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392681, "uuid": "116d63cc-45dc-466e-8b64-24e5e74575ee", "value": "T1761502242ABB4335FA7A5FBDA1A03555A7BEA3A22703D60D1CF211C94717B034ED172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392681, "uuid": "64cc8303-dfd7-41e9-a820-4743d5cd511f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392681, "uuid": "41eac28e-04a2-440f-8ce1-e51f4194d2b5", "value": "24576:xt9dzMhnkV7U+hFJBwhWhdAoWXlb9LLbPJDh:x7ukVRhFJBVW9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392681, "uuid": "f91acf97-af02-4fd7-a321-16121ccfbba1", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392681, "uuid": "e7b2e0d8-3eee-4b2b-8589-03216081ec23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392681, "uuid": "25249af3-d616-49f4-bb65-a712a9753c49", "value": "002820-930390202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686083f7-c815-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679422978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422978, "uuid": "43300701-4b4d-4487-a0a8-2ce32e70f370", "comment": "Malware payload (SnakeKeylogger)", "value": "d63d6243e24d5e4bad8d9e57608aa6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422978, "uuid": "834618d2-463e-4196-bba7-ea20a5e49f7a", "comment": "Malware payload (SnakeKeylogger)", "value": "afa66b94bd6590f41c5d758c6f226aeb6a9360aad144c0e83d1a1b6c49982049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422978, "uuid": "44327e80-a580-45f8-b910-0e6ce68c7925", "comment": "Malware payload (SnakeKeylogger)", "value": "0cde5e90dad9fb5e5e907c5625de1d84ac8dddc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679422978, "uuid": "a0d63d68-0fc3-47b6-ae1c-0f8986ab7dcf", "comment": "Malware payload (SnakeKeylogger)", "value": "1bfec71c4eb467513ec08e74955a814f98468b6c5ee68003b9fdbd69c94d38dc874199b297cca47336adf13da3df5223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422978, "uuid": "b55ff169-ac77-48ef-a49b-922b48bb8914", "value": "T128E4220A43870530CC7E97BA6CB364861376C3715177DA4CADA530CDAB36FAA4622BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422978, "uuid": "ebfbef7e-7738-4654-a867-221b5677ec7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422978, "uuid": "55fec32d-a947-4fea-ab3a-badc96dfe70e", "value": "12288:UVqY5zl06/TgTU4DXpCZBKZkCKGPGe/RVG07HQ9p6hsQsMlXcM:Al06MFDZIKZPhF/vFOsNsMlMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679422978, "uuid": "b384c9c3-0e2b-41a1-b059-bd729802a341", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679422978, "uuid": "2729a88a-e3ab-4d60-a20a-afda73661f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679422978, "uuid": "6cba9c2a-8b6d-4c61-911d-fe0308af1670", "value": "PU Request Form Hardware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b82ec2c-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362720, "uuid": "73193e3f-21a7-4943-9b82-e84ff343ac86", "comment": "Malware payload (Smoke Loader)", "value": "cb0cd0a8f3e0886c11e27e4fada4006a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362720, "uuid": "1bd9dcec-c24b-4930-96ca-343f5f5eaa0a", "comment": "Malware payload (Smoke Loader)", "value": "b09f2a17a609ca4e7ea83b3d4b7526df56cee30f0e5a18db63068e62608d59ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362720, "uuid": "b0d2479b-29e8-45ec-b307-007ac4c1a886", "comment": "Malware payload (Smoke Loader)", "value": "1e6a0874347c6984cb7d7d4c32c93a2d99e9acb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362720, "uuid": "0d19ea62-c8c7-437a-9a05-6a7fe07cdab2", "comment": "Malware payload (Smoke Loader)", "value": "46df62a1ae69171fa5455301739279327f9db131b6f8b0433416fb86746d4572fefd0bb419e267bbb280d3338be97dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362720, "uuid": "60d44286-2747-4a18-8671-f4d71ffefc1a", "value": "T1AF049E13D7A27861E426CAF28E1AC5F4B60EF8D1CE5D676E32086E1F0873162C5667F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362720, "uuid": "02dd8a47-441d-4f97-bdb7-05b65c188645", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362720, "uuid": "4d7f1977-e2ff-4ef2-84cb-d0037d23bc35", "value": "3072:6I1F6AcTzsjCQNWXGhQsaCk2gFCGq7T9sZ:V6AcfaR6/Ck2g7q7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362720, "uuid": "2868deab-9285-4512-a7de-bd9c405760bc", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362720, "uuid": "cb89d702-a788-41f4-9ac4-2d7212d47fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362720, "uuid": "15c677d4-110a-4dd0-88a3-94925170bc00", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120eb4e5-c7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Meterpreter)", "timestamp": 1679377736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377736, "uuid": "17de15ee-5131-4157-9f15-9ade6c41aa9c", "comment": "Malware payload (Meterpreter)", "value": "273743dae912e34afe847ff81432b61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377736, "uuid": "9f8c7a31-1962-4e78-839b-8bd2fc600524", "comment": "Malware payload (Meterpreter)", "value": "b14ab379ff43c7382c1aa881b2be39275c1594954746ef58f6a9a3535e8dc1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377736, "uuid": "dceb6b6c-0a7c-4769-aba6-44698232a1c9", "comment": "Malware payload (Meterpreter)", "value": "f13c36d02117c91ec93cb6aff56b53bff5d12a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377736, "uuid": "667c2334-af96-4d5b-914e-4df394d0a6ad", "comment": "Malware payload (Meterpreter)", "value": "b5528e7f7f21642811fdb679257770e97673150b2e20bcde6031a1a419b2cdfe4fd84c4575992184058d83baf1788f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377736, "uuid": "8f6de266-f931-43bc-992e-a75e948183fb", "value": "T157434D5E97120849CC2EF73DB8DC46E1D9B4B612A5F0E26B1228C0741FF1763AA791ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377736, "uuid": "9c7fac29-f274-4965-bde1-65e0a2c7e3ac", "value": "61dedd3514441513508ede9b44210757", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377736, "uuid": "87aa24b7-5811-45e0-9cd2-ef4ae718f425", "value": "768:zvulBMKf8XgCFNITut1myvE9oPxCsuXfPxWER:DmBPc6Tg8y9PxC3XfPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679377736, "uuid": "dd793c44-a54f-4382-ad90-d13bfe6a4d89", "value": 55312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679377736, "uuid": "8eca81ba-55a0-4e1d-bae6-296a5f3b31e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377736, "uuid": "69934a6a-aa5f-4d2c-842e-580a238a27fe", "value": "InstallCitrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4840885-c80d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679419643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419643, "uuid": "ab800802-0c50-4262-b5e5-c1f3772a863d", "comment": "Malware payload", "value": "dd16d50ffc4586d92140268a6f8743da", "object_relation": "md5", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419643, "uuid": "6a1ee96c-dfbd-4411-804c-5557082221b5", "comment": "Malware payload", "value": "b1c429f67478263f0e896755c6866dd7804c508a1589d22b9fb148520b38c81a", "object_relation": "sha256", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419643, "uuid": "3bb082d3-44be-4e94-99a4-fa6fdd6ec451", "comment": "Malware payload", "value": "6a20224214b1bdd48f14aba1c40b485e50cb3e3a", "object_relation": "sha1", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679419643, "uuid": "1d778f44-5f8f-4b9b-9eca-7d3166ab5cd7", "comment": "Malware payload", "value": "4298762caa4851b32674bf0af9d76abf6cc582f5b3bde3e7da7b5f5691ed66b747e9ca25d641df9f2a520a7477773e82", "object_relation": "sha3-384", "Tag": [ { "name": "1679411795", "colour": "#82EBC5", "exportable": true, "hide_tag": false }, { "name": "BB20", "colour": "#14B7BD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419643, "uuid": "06839224-d5fc-4777-9430-17396376c6c6", "value": "T1A5949F52F6828CFADC0606748592D32B563DFD518A22CB87EA647B3D9D339C27D4E306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419643, "uuid": "2493e1c6-ee2e-4497-b349-ba5f1ad7321c", "value": "8fc8d2aeb26153e5af5a4b8dcc7deaa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419643, "uuid": "8205e006-291a-4065-ad47-a60de3e2e618", "value": "6144:dJw5P0mR1bHI01J/LW3w7RUw50j6fbnFNr/GwgSMsn5HIQ/bSBBMxM6Qb:7wVv1W3xwdbn3rHgGO8SLT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679419643, "uuid": "a5d4666f-8644-4a9d-b305-ffb8f6b7ca96", "value": 435141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679419643, "uuid": "5a86eaf6-fbac-4e27-b283-305d83fd2230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679419643, "uuid": "c3d42d60-229e-49b8-962d-dcc2c4b3322f", "value": "NonfactiousUnbale.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943b268f-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1679391699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391699, "uuid": "e2d026b2-3284-4138-a442-3f3c58013432", "comment": "Malware payload (Gh0stRAT)", "value": "bc0a0e933e3cf836f9672098ef4967da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391699, "uuid": "16547292-b3a3-45cc-a0e9-aaf653294461", "comment": "Malware payload (Gh0stRAT)", "value": "b28ce0c2c493aa1dc75dba08c48379fb69d23bb6d0b131fc201984e7dadbbdf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391699, "uuid": "1acbe34c-2d65-4aee-87c6-002d640acde5", "comment": "Malware payload (Gh0stRAT)", "value": "6a580fdc125607cbbcf4d736993ae70897a8361f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391699, "uuid": "24e488f5-65f8-43d7-94a1-c8e695659257", "comment": "Malware payload (Gh0stRAT)", "value": "23784945e5fd3802f447edf64723ecb36984f3b91e9bedb225162358ec22a0903302e852e3db4cd7faeef80c3fac61f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391699, "uuid": "15aa6f42-962d-4eb7-9627-b6b876ac47d1", "value": "T195444C43D6408567D5520C755495AB3FBA6BAE70B70E1053A3D8FE4A38B49E0A332F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391699, "uuid": "8fe18b7b-b5ca-4a5b-b8eb-234dcf7335ad", "value": "510c7a172a09307b3eb2f06ac7cc2950", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391699, "uuid": "3583c574-91e1-4bf7-bd12-6bb4604d72ad", "value": "6144:xadO6argJ+nPfm/Q9F4FqZnCivtDLn4bwwww:xadO6aUJ4Hm6iFinCil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391699, "uuid": "6a39dc81-6358-4933-bd79-61a44d701139", "value": 269344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391699, "uuid": "e6e21da0-1cb6-483b-a754-c0efa91555ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391699, "uuid": "3089d228-66bf-4935-b2d8-75f350f79130", "value": "3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb25c357-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679393053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393053, "uuid": "b9080285-e289-49ad-a4a3-97728708f65c", "comment": "Malware payload", "value": "ae4ae7cf2ecb6fdfb3ce613d408b0007", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393053, "uuid": "2c06c69d-9508-40f2-9532-133bbece3e70", "comment": "Malware payload", "value": "b29660612664076e333698bbcc9afc9b63832fe8919b8fb3f2dd5d817d5e3eea", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393053, "uuid": "ed07c05a-11b2-4d74-8625-7f646b7fd49b", "comment": "Malware payload", "value": "28c0a2c2c1b59c078ad810eefb7dcf9a93920b96", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393053, "uuid": "fd39d3f2-8f2d-46b1-b8e3-6faebb7f9c72", "comment": "Malware payload", "value": "860fd786f1ccd169523f0f35b0cdce314fda437d1252f3fc19f0ad38ff1f22256dc17b43a174c4795a77267062a9798c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393053, "uuid": "b484e979-50c3-4312-8ea3-817379cfaf84", "value": "T1C8350213F9C49D47D44247B92AE37998131EBC223BD6A2C72748B70F6F786E09A4311E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393053, "uuid": "4a1fd22f-f17d-4b0b-9b9c-fd6cd102af19", "value": "24576:5LKNWQmmav30xk+MXUu9/7a+MXUu9H3bVg+MXUu9+3bV2f4LvjiiPGuHh:5LKsQmmQ302+MXV9W+MXV9H3bVg+MXVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393053, "uuid": "cd0801fe-3d54-4a45-9863-3811be60cecf", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393053, "uuid": "b97b95e2-8f7f-4e79-9b79-1887eb77c3b0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393053, "uuid": "94f0cc32-441f-477b-86a5-5f5c0800aee1", "value": "Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da715d76-c78d-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679364758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364758, "uuid": "ed885201-f7d4-4f66-aeac-df7dea3766f0", "comment": "Malware payload (LaplasClipper)", "value": "7e1ee04719bea1b532ed44609632ccd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364758, "uuid": "7567b8c5-26ba-436b-baa0-143c4d714ffd", "comment": "Malware payload (LaplasClipper)", "value": "b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364758, "uuid": "1342fcfe-03fb-4565-97ab-bd7df5f906b2", "comment": "Malware payload (LaplasClipper)", "value": "f6ad1ded616f8877cb34f873b3597aa6df50e957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364758, "uuid": "ad5c9939-1ffe-40df-b266-295939079b46", "comment": "Malware payload (LaplasClipper)", "value": "2cdef71f76931d9efc68e672aadb6fef3f47ae30650f331a9bbb7dbcdededef71c68daf6edbc041c4f6a7acfd6ac5c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364758, "uuid": "dc5518cd-6c56-4e10-8344-69643f9da09a", "value": "T15C950253B7A17C55E52ACB32CE1FCAE8734DF1109E49BF6C221DAA2B04B1072D16375A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364758, "uuid": "93e160ca-5085-442f-880a-bc598074ac9b", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364758, "uuid": "7603f709-56f4-49e3-b542-d6a22dec6cec", "value": "24576:prRWZ35JhqWpgXEC9CsacGA2XqHO4fOD22eAbFKhvb12pG5UojUsw1EyYMoPBETh:prsvJhS7Rj26H/fOyj1qG5UojUslMoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364758, "uuid": "f3f05b33-040d-487f-ac60-68e5c98d9735", "value": 1955840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364758, "uuid": "4cda4f1e-0000-47ba-b5ad-18a4d5a8ec38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364758, "uuid": "ae31157e-0d1a-48aa-b99f-4cb43371be30", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5ff680-c78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363210, "uuid": "07509dbb-8fee-4c88-9a3b-a03182965959", "comment": "Malware payload (Smoke Loader)", "value": "36da7db0e753060127bb4690ed9f132c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363210, "uuid": "04d2fabf-4449-4a47-bd49-245d19e84544", "comment": "Malware payload (Smoke Loader)", "value": "b4709ebbd28067c12858553efbe4e859e3031f2dd8b1f5321f96df661e2a54fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363210, "uuid": "4292fb7b-7de9-48c1-9252-ee7fe75c4578", "comment": "Malware payload (Smoke Loader)", "value": "b91c6a735e972a2dcbe26d7a8fffab46bc40fed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363210, "uuid": "5d33af9b-af48-4c7c-aef7-ac696d7da329", "comment": "Malware payload (Smoke Loader)", "value": "666051e4f064387c9cb5769bdeb304064b67d2354a7bb2da543969bc3334bb35b65af4e7b39f245e2a78610993fa166f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363210, "uuid": "86ec4710-f351-40a1-b3cc-d56b30ef2066", "value": "T103048D139B917C61E436CAF14E2EC2B4B60EF8D1CE5D676E32086E2F0873162D56A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363210, "uuid": "24d81a69-593c-4075-b93e-56d33a61ca31", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363210, "uuid": "6b987c73-60e9-4655-98ea-a0f0cf85b870", "value": "3072:VZ/KyRGvI6WWh5QUHayu4rt13vMoOV7uZ:+y8vyh4x1v/OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363210, "uuid": "365ae981-fc38-46b7-8cc6-c41772c5853d", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363210, "uuid": "fd646723-3f28-4b0c-8895-18247aa02595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363210, "uuid": "0cdcb2b9-080d-4848-9b42-7743cb823030", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b6d157-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679393475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393475, "uuid": "a9c03847-4555-4c03-a60b-959f3a330367", "comment": "Malware payload (STRRAT)", "value": "dbcadc2935c48a0f0c4fe94e6f0f0629", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393475, "uuid": "78ad68ca-cb4e-44c5-a4ab-0c2d018b36a4", "comment": "Malware payload (STRRAT)", "value": "b4a0d828487436154b2e0bf2d84fa49bc23b3ce8de3bf11d2c39a5677f0890a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393475, "uuid": "24136a1f-16ec-4865-a9bb-b29bc0f0aa65", "comment": "Malware payload (STRRAT)", "value": "7f85ad362fc1d0fa13086f245bd3fe924e1ec3d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393475, "uuid": "988dc4fd-f4b8-4a6f-b1de-ea5345e81e59", "comment": "Malware payload (STRRAT)", "value": "61cd39c175654a8dd1a7fae5538e2d2353d5cf3c86df373039d5573e120e2317f5c9d3de3ff6c1e838993d095a9af017", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393475, "uuid": "991d25bc-faac-46c1-8479-7ab62790e22f", "value": "T16E746C5EBCAE0B1BCA3C0809505B1E3A51E4D7CD3A7FC486B0675F5DE663D6A2D0438A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393475, "uuid": "d6f8bb6e-146e-4b91-9f99-31d7ab6bd9f4", "value": "6144:GQFKR0aymvil6TzqcAJy+DaWDVeSGvyjFPO0RIiS6HesMQQrEj5fLm:NCUmv04VAJjDaWB/jp9CiS8PQi5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393475, "uuid": "11917206-161d-4a24-8b71-21f18eddf7be", "value": 357633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393475, "uuid": "afa2f9d2-3c08-4bba-b1d7-50f22ab4eb30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393475, "uuid": "1331c818-b5b3-4de4-90ce-06b84b2c1292", "value": "doc2023032189743664478941236589.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba2ed74-c7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1679411736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411736, "uuid": "65428237-b51c-489f-a988-123cd8b1019b", "comment": "Malware payload (NetSupport)", "value": "5331532e760e8d1006f09ab8be38efe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411736, "uuid": "c7019edb-248e-4977-8028-834507901c0e", "comment": "Malware payload (NetSupport)", "value": "b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411736, "uuid": "f5da9643-4ba5-4eaa-8548-42b52be70348", "comment": "Malware payload (NetSupport)", "value": "09bbc125d5e7fba8bfbd1c26b71c7f0496b7e574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679411736, "uuid": "3d7ce4c5-8a35-47b7-b09e-0d92408fe4e1", "comment": "Malware payload (NetSupport)", "value": "61ba70dfec829f99b96b22a335894e1b2f8028df48db58b1c45a15fbc2e168d7e94112ef32a3a069bbdbb98c8de901c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411736, "uuid": "572a4350-3b1f-4907-8b20-8f3c91dbf857", "value": "T196C5DE6AED4EC2A3FF98C27BD42AC6F477F04D50D85D5237A859BF457232EA43286204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411736, "uuid": "34985104-d67a-4ab0-8d0c-afa75f2e1036", "value": "1f4f257947c1b713ca7f9bc25f914039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411736, "uuid": "268dac42-2c03-473c-9b0b-f558ff4a06e6", "value": "49152:xFeJD6gLQsN5kEtXhd9Gvf6Hgx6nlhXesKb40lKSm8:GD95kEtP9Gvf6AO5IMMKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679411736, "uuid": "fad2bf07-23ed-4200-8b2c-0496d46e6d5a", "value": 2619980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679411736, "uuid": "98c6c593-ec04-4832-a98f-5b3cc6902076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679411736, "uuid": "f58a5392-a7fb-4b5f-9f1b-02b82f06d9ad", "value": "5331532e760e8d1006f09ab8be38efe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869dcb1d-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679392964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392964, "uuid": "4a1517ac-8d16-462b-a115-10044e73b9b6", "comment": "Malware payload (RecordBreaker)", "value": "4920bdeb33972d9f4ef1f4d598fb3bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392964, "uuid": "122e710e-cc28-4d0b-be71-6de62cc53c7d", "comment": "Malware payload (RecordBreaker)", "value": "b6c63317d884b7fef58431c1ca61fd85438246a23c3e6920b3584741cc455846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392964, "uuid": "026f3b76-b251-4ed5-9abc-0b9d98fdbc21", "comment": "Malware payload (RecordBreaker)", "value": "043c5ee1e45accffa8d02c88fe65338c92606d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392964, "uuid": "d732313e-078c-4b52-a3f2-42b355eacbd6", "comment": "Malware payload (RecordBreaker)", "value": "3a067cf9e098c1700f514e523599bafec3b34d6c5e71fcfbfc8ed8d123f347f9d387b02ee2078430d0e4ef97e0da65a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392964, "uuid": "6767a1cb-7e64-4ebd-aa79-c4402b5cb205", "value": "T1D12716A8DC2D3BC6B3EB9329F81094749E944C7F99CA6017B0679B20043F7861A9D77D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392964, "uuid": "6a532c32-8587-43d9-9a4a-dfae7d4f8a9a", "value": "00de631d57481fec13b7898c99324f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392964, "uuid": "bb684c22-adbf-4a81-bba0-e80a962d3be5", "value": "98304:3Vde8FivCeGDRsiSc/XBgZrzyWGgRSL6O2jSk6adBNWuz+VRD0MbQt:HZFwAur6XBazEgRSSjS5aT1z+/D0yQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392964, "uuid": "1c7e660b-64e0-45fd-a1d8-fd5703193a14", "value": 20970308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392964, "uuid": "e02699e4-9033-4ecd-adea-4aeb7e140aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392964, "uuid": "bb973149-23dd-49d1-aa89-168343275f35", "value": "4920bdeb33972d9f4ef1f4d598fb3bb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493711c0-c7f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679410041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410041, "uuid": "3faf70d1-8deb-4d37-a992-89db3a9750b6", "comment": "Malware payload (AgentTesla)", "value": "92f597e69cb9c8c73148eba848c24932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410041, "uuid": "2489a181-db50-4405-aec5-8ff528c3a0ce", "comment": "Malware payload (AgentTesla)", "value": "b75b70e73450fe7e7cd8537d8e53c9d7e978eb7b8f34b8e899f85591a2f83c75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410041, "uuid": "e4051256-9f8c-43bf-ba79-2bedeb753e62", "comment": "Malware payload (AgentTesla)", "value": "34331e7fc029d598b230752e0c26771ec5d1dc84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410041, "uuid": "0adf68fd-e7ec-4350-8482-7616505ec1a5", "comment": "Malware payload (AgentTesla)", "value": "094cc242971aa7279001d5b2e555a33cdba4c9c331cbad00dd209f2866fe1de04b7ee2a811f2fa2610593bb3d0c1b21c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410041, "uuid": "6d313ae8-b14f-47d3-8984-dfac2ecf95c8", "value": "T16EF46C1D3C6899E3C324E677DBE6C225B3A35F567723C96925C213620E0E346ADCB11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410041, "uuid": "8837eabc-f4ee-4d6d-8f78-f691ad159df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410041, "uuid": "16f32bfe-97ad-468b-be7e-2e8dc9ace8cc", "value": "12288:gtY2czJMiNSzY1En59o6YCxCSQ04PM4spP7GrRybX:pdMZn5S65z4spP7GrRyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679410041, "uuid": "44814852-c782-431c-8c4f-67e5604cab15", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679410041, "uuid": "442cafa7-292e-4d69-9e9c-a472b4cf6bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410041, "uuid": "cd7f6fc0-82fe-4a1b-bbec-1fbcfbeaa61f", "value": "SOA-FEB_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f5b9f5-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406731, "uuid": "f4400e0a-41b1-45ec-b365-1a1216675e07", "comment": "Malware payload", "value": "c18b9c9cae745865166288c3178f6ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406731, "uuid": "035243da-f72c-4def-821f-45824469d0ab", "comment": "Malware payload", "value": "b79125be780db5d17625674db52f62c01cf365c4b5c9ee0369ff187dbf0bd622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406731, "uuid": "38d619b3-5f81-47c2-b96e-05ec4d7b5fa8", "comment": "Malware payload", "value": "c901b4440d948746876d4129bc4b40dc20d98ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406731, "uuid": "41327ea2-e219-4820-9ae4-35ee8b957d95", "comment": "Malware payload", "value": "d877b242a86b0b5be350f921b357a623c8f61416250fbdf1412bcf0695353da933e26f7a8269e0fc3a026e2bdd31957e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406731, "uuid": "5f32f842-4f61-4155-bdcb-6a50a4f4a55d", "value": "T112767DD3728464EED0660B3A4FEF96D0593F7EE02A119C0AFAE4364C4F359C19B26647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406731, "uuid": "5e2a89f5-85ef-4820-9ca2-d3ebda3dabb2", "value": "14f001244b7ee60719354642c96acc5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406731, "uuid": "a203e381-4d2e-414c-aad5-bc678e10a366", "value": "98304:ajKHnhO1fPfTWCwCZOQtyVpp7J9OUOQvO8eYULdeWdxSbM:aWGTWCduX+5XCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406731, "uuid": "e2578fc1-bc40-4c1d-b12d-1a9f941f5964", "value": 7462184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406731, "uuid": "3bb19c75-7af7-43e1-9499-66c633be1da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406731, "uuid": "3b1b1075-5048-4836-8102-ac527dcc6d79", "value": "B-201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f07cac-c80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679418711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418711, "uuid": "aa538d7e-0344-4006-8009-e0e9c42021da", "comment": "Malware payload", "value": "3bf6b061c5e34e124861e6ccd03c4eff", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418711, "uuid": "7c37cc96-c6f9-4104-aa63-126de2783e23", "comment": "Malware payload", "value": "b791bad751c3bcf9c3a6e4cbf0b5a722a87b2875e6a6354ad0e1a08857a8f934", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418711, "uuid": "e250d95b-7837-44bf-9a92-13f30dadaaad", "comment": "Malware payload", "value": "cfe9485bf2adfbfe83e221e74c1ffacae1874937", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418711, "uuid": "82a2f4ca-2c56-4c2a-bfb0-427abb23722b", "comment": "Malware payload", "value": "158775112a211110cdd607c77b9f98c248d968fd8359b5019a2889b09d8661661400bc3e9f4a94fe57ed508e01748d29", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418711, "uuid": "36ef3abe-1394-405d-989a-d2abb49bc5d9", "value": "T114564995BC5C6862DAC87AB42B354390B239FC498F8187637614FBADEDF23149F21760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418711, "uuid": "cadc26f7-a6c6-43a4-81e2-e85eda9e5fb7", "value": "98304:XWpXaBYBHizf5BVhzdw+sORK+/Eu+MyL7stkdUfAl:GNaw8BVnw+sH2ykto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679418711, "uuid": "d7aa8f9e-629f-4ff5-9150-db870ed007e6", "value": 6179250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679418711, "uuid": "c988eae0-396d-4135-8ca2-aa710241dd8c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418711, "uuid": "afbc23e2-059e-47df-a7b0-919d02028701", "value": "dosia_app_macos_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9778176e-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384832, "uuid": "e3f3de72-ce55-4e97-b8e9-2514c07d1216", "comment": "Malware payload", "value": "9cc4e0e434a979417000bf8d7099890a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384832, "uuid": "3950a216-7e25-4f5f-bc2f-168c10c43371", "comment": "Malware payload", "value": "b7a9265a8b419f32a9f43e114478ad5a34fd9b00fbc72e0860183b34b8a1d817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384832, "uuid": "b1984184-2764-42b0-b3b4-4904f9946af7", "comment": "Malware payload", "value": "23d8d2e657ded7b6c8bdb87abb2b561ec7c85180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384832, "uuid": "8b2335cb-d1b5-4dde-bba6-d034b970248e", "comment": "Malware payload", "value": "065e3bc32d2746a88c61633b5b4fe608d6f1ab9191a2efefe4da35c3fc02b40d21c157420815b5220e2aa7c3e2296967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384832, "uuid": "9b2d6080-6fac-45e5-ab0d-b74a20cd5bc2", "value": "T17BF5332BF59F1ACEC6862171B095B122C3AE10427EE9A210775D934EF2D363503EF796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384832, "uuid": "8218f33f-5ab2-4914-82b6-228b0cc4c44c", "value": "b0d55a0ae041738d08d0125777f06f46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384832, "uuid": "e999bae9-a221-4fda-bc06-29ea8432275c", "value": "49152:18wwqmLQkM6Bqy0XqBxTh8T8HtY7sv2AFPpNNrjrsxsF0eeoPXccXopz1HEwmZb7:qwwRQk5B/LLU7s+InlN/XXAz1cqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384832, "uuid": "562cc68c-906e-48e6-be8a-b4453bcbcbae", "value": 3579392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384832, "uuid": "6b8337ed-eda5-43fe-9d8d-b5fa41d35be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384832, "uuid": "c97b6eda-066f-4635-81c4-20f3f754a476", "value": "9CC4E0E434A979417000BF8D7099890A.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04a01d5-c7af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679379344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379344, "uuid": "84ceec68-9609-439f-a56c-b25fcabd9fad", "comment": "Malware payload (RedLineStealer)", "value": "b71ab517ce6686e3bc2f95875ddafba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379344, "uuid": "89770381-015a-405d-b548-64ff9c6fccd0", "comment": "Malware payload (RedLineStealer)", "value": "b80cdec3ef9998435fc76fbbe6def0eddb10739c2b9a99dfef209127dd33377d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379344, "uuid": "334e83e1-a0db-4c90-8131-25503db7cd81", "comment": "Malware payload (RedLineStealer)", "value": "16d83756d89bf66eb48dc69e83689c499ce2af33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679379344, "uuid": "19df03d8-0e02-4574-ac37-fada2d5bd3d5", "comment": "Malware payload (RedLineStealer)", "value": "c8472d81291aec954aea863af5df44fa665493167520b995262c4d1b7c9e104950c88395983bf2ccdf794cc0f9dc13ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379344, "uuid": "3466ea64-2695-4644-ac1b-94e6f5213b3f", "value": "T1A3C52C135A8B0D75DDD27BB461CB633EA734ED30CA3A9B7BBA08C43959532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379344, "uuid": "f155ef19-d6ae-40ba-a799-a3c2e298c990", "value": "fbe0effa0c3d2e7d17405f2bdd84a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379344, "uuid": "ffb284eb-11ee-45b6-9c1b-5aa8a6110187", "value": "49152:wFPYQBGcdYHVo4FfmsfZVqK6TXF1NKEl3P:sPYQBGcO1TfZv6TXFrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679379344, "uuid": "4edc3c6a-3030-4c64-8833-32382a170d3d", "value": 2675052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679379344, "uuid": "1951b8c9-ce72-4435-a16b-fb99f55d77e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679379344, "uuid": "b8512651-3508-4a93-81b6-9b428ae21ef2", "value": "Adobe Photoshop Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbb9dcc-c7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679386423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386423, "uuid": "7e13298d-6b5c-4c27-bafe-06dca0491743", "comment": "Malware payload (Mirai)", "value": "79cfa8e4ba19369308161188c8cdd61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386423, "uuid": "f4eab99e-2b03-4b56-a8b7-6652944619be", "comment": "Malware payload (Mirai)", "value": "b879b68e9829dff8209629afd872380a81f88a5acb16de10c97f7a0e75ee95a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386423, "uuid": "0c1275d5-980d-4724-b72f-d7b2ee5a09cf", "comment": "Malware payload (Mirai)", "value": "e090129823d66f22d019bd43472ecaa92a159991", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386423, "uuid": "a5d3d04e-aa76-4741-a9f9-1c426d6aa88b", "comment": "Malware payload (Mirai)", "value": "0f3873cc41326edadc144b200771d6c8706b624596d448a3f326a1d84fc5b0791b2b865c58bff585145b2bb83c684748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386423, "uuid": "e73e238e-4c79-4ece-ae0f-9376e2843124", "value": "T16DB33B376651C97AC08352F426EBC5729C13BCBF0B32215A33D47DA4AF368DA0D99B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386423, "uuid": "3e65ff3d-f53c-4dc4-b4d7-31886b6ecc4c", "value": "3072:CirOU8Ec6uPd0YqtxjlRt6l+eJg+dm7FnVqfJXFWbNb:IEc5bqtxrSg4m7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679386423, "uuid": "fe98bea5-3d39-4842-ac6b-d28fc2c1b71b", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679386423, "uuid": "0a0ce819-4ff1-44c6-a049-0a095f191312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386423, "uuid": "8ff4a4cd-ee64-4c99-a0a0-96ff70eae41a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5390499b-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393738, "uuid": "830fda93-5609-4237-98ed-bd736e8f3fd9", "comment": "Malware payload (AgentTesla)", "value": "8aa2ce42598595d5bd95053089faa2ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393738, "uuid": "819ac3da-0a9e-4fbb-a2a7-13e728dc403e", "comment": "Malware payload (AgentTesla)", "value": "b88695eda4138138c90c9b490a7bb10a1dc8e9ee3ac9b8502855b138914154ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393738, "uuid": "11d869ea-a286-4da6-8353-f52775c023f6", "comment": "Malware payload (AgentTesla)", "value": "41e4470933c6e77fabae90acf3a4d4bd071890f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393738, "uuid": "44b5a1db-ea32-45b1-9440-e536d2acf328", "comment": "Malware payload (AgentTesla)", "value": "5a5a5ee2caabbfb4f57c040538503d458bd7cb1792005653a95e05dc25c68ed5ee83daee51308ae170f86e8cb90d4704", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393738, "uuid": "612c1ebb-9b55-4bf1-a40b-44cfafc634d9", "value": "T15DC4C32731AAC0D862EA704746C3F67C0FFFA5D1123F6169A0DC8A595FE6A0A0D913D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393738, "uuid": "219e17c6-5258-4aff-8f67-970e31b86d33", "value": "1536:Fk1tkixFudqrNxtx/Jx1pXtRcmujLdgOOOOOoOOOOOHOOOOOHOOOOOHOOOOOdsGP:Fk1tkixFudq9OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393738, "uuid": "a91910ef-eba2-4d24-926d-f4a5a3bf7956", "value": 597096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393738, "uuid": "27d030b3-0977-4cd8-bf76-a34351f199aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393738, "uuid": "f85498a3-db6c-442b-a886-2cfb5f3effbc", "value": "Payment Swift_645547366353646.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5504fe3-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389687, "uuid": "c4436056-9749-404c-a748-2dfb05acba50", "comment": "Malware payload (Mirai)", "value": "6829bd31605e02668ff1a34df49200e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389687, "uuid": "2c6c374c-d7e1-44e9-bb0a-ab240cf01b56", "comment": "Malware payload (Mirai)", "value": "b8d0b8318240ba9276e3f07f6035323e3657471b2b388a5eba4e114974ffc031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389687, "uuid": "0403b0c6-1e69-47c3-8df4-9547fea49607", "comment": "Malware payload (Mirai)", "value": "84e7afed11bc227a48564e7e672ff2064b750fc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389687, "uuid": "417fd79f-8ec4-434a-a498-190eb794f89f", "comment": "Malware payload (Mirai)", "value": "361e515ce36e1215c644b400eaf073053310da75fb2d33d59793e7988cfb9eb1f894f537afabd5bd866f75b5b88c7d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389687, "uuid": "dc45b2bb-c958-4e28-9f49-604194c3de4c", "value": "T16CE38536B7619EB7D80ECE7305A985121C8CD98702D92B6BB274E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389687, "uuid": "03346d27-3094-4de7-acec-2fb9ade52ef1", "value": "3072:34yA4MlDX2PW4aJC1mauRshTp4jmrThPaLEnvPrNb:34plDX2P5aJ0dJHQmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389687, "uuid": "db21d24d-3e29-495e-a338-ff0c5b273094", "value": 155572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389687, "uuid": "05904ddd-e719-473b-8b75-3572ab7ca4e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389687, "uuid": "1ebda79d-7c8f-48dd-bc3d-70b5546c573d", "value": "6829bd31605e02668ff1a34df49200e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdb72e8-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389324, "uuid": "6ed8ba37-6735-480d-a24e-2e9768ea4da3", "comment": "Malware payload (Mirai)", "value": "5c839e69133a5fc829f49ae4dc999e18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389324, "uuid": "3ba58fd6-0b76-475d-ae4c-f19d703077b8", "comment": "Malware payload (Mirai)", "value": "b9eb4b3680c4aaf5ae06ca8b1718bfb341d150b4ac626260336a1575db91ac5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389324, "uuid": "1823986c-70c2-41ff-aa4f-7c5c57c4a1a0", "comment": "Malware payload (Mirai)", "value": "e144e6aa75c9c0d95eeacd1c77824bf519f25fae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389324, "uuid": "f56869b9-dfb5-4242-9b31-e3fe0db42a84", "comment": "Malware payload (Mirai)", "value": "ee606922f5a26cd07f365af6d02f42222712416427057adf70780641b6b8ca104af5af4cd1eb0848d0423f1814aa48e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389324, "uuid": "c58fe310-1653-451d-9ad4-918042f200e3", "value": "T197B30872B804DF66F40AD6B604D78B267E30BFA30EA31662731B39669D331D52863F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389324, "uuid": "0effa8ef-8d63-47ed-b16d-fd5d4b065780", "value": "3072:++JcZq+zTfJLUdMWkmCHy5/kGZmm/QcuLB1niDNb:t2n/JLUdM/y5cGZmm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389324, "uuid": "880ac3b1-bcbc-46c5-9218-2592a3dfe80d", "value": 118074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389324, "uuid": "2b7c5a0e-ef86-4ede-9bc6-158cc8d3172b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389324, "uuid": "c4f53640-95bd-4d14-8e43-bed0332d85ab", "value": "5c839e69133a5fc829f49ae4dc999e18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeadbc14-c784-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679360819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360819, "uuid": "a1f74678-c073-418f-9ef9-871b8c8a35e9", "comment": "Malware payload (Smoke Loader)", "value": "b21b126af349ba74241d034f0023b02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360819, "uuid": "e3e71e51-181a-4542-8440-3d06da807862", "comment": "Malware payload (Smoke Loader)", "value": "bb5a42beba01b1bdfa2474ca6554c79a8128e4ef4328886bce909190aee395af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360819, "uuid": "12774d44-a979-4bfb-b2ce-f1b922886735", "comment": "Malware payload (Smoke Loader)", "value": "5f740e0343b16dd1699a356f669e925a266d0e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360819, "uuid": "3ff3ce1b-6200-4a8c-937f-dc4e443007a3", "comment": "Malware payload (Smoke Loader)", "value": "b2e4ad618dde448a2f2c3061f77511cb13f95321a59cecf8598d9605d2c5c5c1021f15a0e8073b1794a134e41848ff63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360819, "uuid": "363035b7-499b-47a9-a515-df11180d88e0", "value": "T126048D039AE17851F5168AF54E2EC2B8BA0EFCD1CE5D676E32085E1F08B3163C5667D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360819, "uuid": "3d38e891-7cca-44bd-9f19-d962aa9b1ca0", "value": "c7e43254116cf1eb594def3fb89b8588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360819, "uuid": "634b3443-c516-4ebb-b6b9-995438fab37a", "value": "3072:Z9EDd15HFoJfFj0QaJ8oif3cG2qhunxih7pDfo+2kZ:MDDEfp0QDhvt0i1LV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679360819, "uuid": "83c1d135-52de-41ed-a6b8-4fba023881e8", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679360819, "uuid": "05ff35bc-32e1-4e8a-b714-3bee91d57154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360819, "uuid": "9fc55a3a-2666-47b1-b660-34533a274da2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d02bab4-c7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679405404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405404, "uuid": "ee642841-8e10-4340-b4bb-979ac9c3e092", "comment": "Malware payload (Fabookie)", "value": "ddd1f0c35557c3cb9de6d19c0cade01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405404, "uuid": "ba6694a3-4195-4af7-819b-703561d6ecfe", "comment": "Malware payload (Fabookie)", "value": "bb7b0935273ea7fc462a193d7eaa2a30ccc4c808bf152f389125e519c22a9069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405404, "uuid": "7b20f100-c926-49f6-8a0e-d85194e9759e", "comment": "Malware payload (Fabookie)", "value": "6f4e5676e9f90e766a32470000793c3ae5aef683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679405404, "uuid": "470845cf-8a3f-4d59-8b1a-e6deb6b9f924", "comment": "Malware payload (Fabookie)", "value": "df93a035a133959b30a2984cdd737a5c7d52bc819acaf0a17455ddc2632d5844f36a64b5552ddc2a3e5ffb977b0c7d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405404, "uuid": "d6240f6e-48df-4f1f-99ea-084e712f98d7", "value": "T1C2156C5EB66C00E9D0B7C179D5439A03E7B6780B03B15EEB139147A63F276D84E3AB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405404, "uuid": "57b3b3f6-b75e-4091-9aef-2a48e3b8f698", "value": "ca4024c0e7ca045d1b257058baf9658b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405404, "uuid": "f45094de-c6c7-456e-b018-19cd0f07a426", "value": "24576:XyE8JiMHnEBiehIMZR9CjI21FiWOnoxkNMu4dXxbfat6Z:PCiMHEBieK+RX21FiWOnoxkNMu4dX9aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679405404, "uuid": "0b9d4870-49a0-4397-943a-1937db647e69", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679405404, "uuid": "f5285325-2575-4f7c-bc35-b015509d89ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679405404, "uuid": "7c62645d-ae7f-45ce-8f9a-ab6f76217f57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef433b4-c7bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679385999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385999, "uuid": "15d9833d-2b60-4d17-b0bd-729d90d06be1", "comment": "Malware payload (RedLineStealer)", "value": "24c2edb4035c503ae03f5f679221a8f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385999, "uuid": "ccff32ff-e981-423f-8049-2384025aca0c", "comment": "Malware payload (RedLineStealer)", "value": "bb7ddac522b909468b1f330dcfb974c6fd70696b404214db837d58cc9b11ee7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385999, "uuid": "9f10850f-0546-4792-b7fc-baa738059171", "comment": "Malware payload (RedLineStealer)", "value": "d959770e38addf4ea6773881a20936834f5969cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679385999, "uuid": "ca79e1c2-6bd1-4c9f-8ba5-980c48528f42", "comment": "Malware payload (RedLineStealer)", "value": "6d1c0e2a7dcf542e00a779a32409820ef6bcf9535f280207e449f02bba60a8915a7e1ef49843676b9cd55947e1669f3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385999, "uuid": "91806433-44b8-485b-bab5-30058c537b48", "value": "T19B45021382A27D55DB1ACB729E1ED6F8775DF6308E49775632086B2B0AB13B3C223711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385999, "uuid": "179abda8-ca91-4837-9d20-0ac224b1577b", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385999, "uuid": "9f7d0e06-5089-41e7-9133-4873ce158ed3", "value": "24576:p1x4Y79vRMcmZBqkztFhjyDcLrai+hEmWF6:p7469vicSBl8f3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679385999, "uuid": "f139d84a-ace6-4e38-9cea-889b8be2b895", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679385999, "uuid": "cde9aa3a-c2f4-4bce-ba7f-d1e5dfd19614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679385999, "uuid": "6c4117ad-5773-40d5-afea-21fa05252b74", "value": "24c2edb4035c503ae03f5f679221a8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5516ebf7-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393740, "uuid": "01c54058-1008-40f4-aadf-9061877946e0", "comment": "Malware payload (Loki)", "value": "92b3f4af756205dec49a32982d363fe2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393740, "uuid": "f0e421a2-0acb-4eeb-b14e-cc3d1e2b9d3f", "comment": "Malware payload (Loki)", "value": "bcf30106a228da272b7ed9299400e475b51a9dcb4553e179fd94ce92f2580b8c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393740, "uuid": "1fbd82d7-2ea1-459b-9232-c571a9878da9", "comment": "Malware payload (Loki)", "value": "c675a5abc27f9d0fab8e0d304f88c6643b2e7f13", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393740, "uuid": "abaa0369-6cd2-45b3-8a5a-b376172e9eb2", "comment": "Malware payload (Loki)", "value": "7f9063a2ff8055e8ec63b15c25e0cbd4cb386208d04c73bbeb5f74979549085adc6e802db837aeed257e385fa1144108", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393740, "uuid": "ad70e5b5-7cc0-4419-adb7-1795de3bb8d2", "value": "T1533207A56C521556C08FA3B68F9A047FF30B95EE8839506539FCB2E45B043106FBF4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393740, "uuid": "06f086f9-8998-4811-a8fa-7e95a5e822d9", "value": "192:GKLMPuI1ZCdJtEUmuqlgYPXmRSaCcv87+X6pyfEhhY7:GKiXqJtiu0lPXmREijCa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393740, "uuid": "f6a8564d-1f31-40f2-8d05-cb9c57521529", "value": 11935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393740, "uuid": "f740b9d7-7190-4dd3-b463-c8c9c8d03bf0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393740, "uuid": "99e4ac57-c37c-4ecc-b9c9-ae1f3fff705c", "value": "P.O Sheets.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1190ca7c-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (BluStealer)", "timestamp": 1679415961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415961, "uuid": "67fc1471-c92d-44ab-a6ba-2fb10cfc1b25", "comment": "Malware payload (BluStealer)", "value": "fbcb9635de97b002df00f4dc9f725e6e", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415961, "uuid": "8c454fc2-8960-4e25-8c29-e09c34855acd", "comment": "Malware payload (BluStealer)", "value": "bd3939614126a2d4f1f34c18338872065d3c6f02f4a8ed01a2c864e6a83aa2b0", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415961, "uuid": "27ff0eb2-e305-4047-9f6f-ca2e02ce5f83", "comment": "Malware payload (BluStealer)", "value": "3dd5989c06a079e74789c574fd8851b0433786af", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415961, "uuid": "6427a2d5-f92f-42b5-ac57-5a8d1f7d21d3", "comment": "Malware payload (BluStealer)", "value": "5bff6331e2d50177e4de2ef71f0e7bd0c6ef5ae82abe1fd056339b5de7ded179d0907db90918345903d35a6f3d49c952", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415961, "uuid": "81048ebf-a4ae-4635-9cb0-711ddf123a1a", "value": "T1B02533C4F3C033197CEB5F22394E3A39AB43E5FA1A3DE742B11AAE15215E6514D12C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415961, "uuid": "a2c03426-48bf-49f7-b105-87f92eaa2e50", "value": "24576:47vvE/sNtaDUWFuxU5S4btFyfnBVNc6Obf8uf9tDZx8ehYL:47XxcDfuufFyfnHNpif8+3Df7hYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679415961, "uuid": "2cf51561-8b60-41c7-b201-b7a5998399af", "value": 996622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679415961, "uuid": "f92e918b-52b7-425d-ba4c-701299822b50", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415961, "uuid": "5fce1716-9144-4bd5-9fca-0adf0d46e3d7", "value": "QUOTATION _RFQ# 1043999_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85b2fa8-c7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679398739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398739, "uuid": "447470b4-0653-4539-9c70-7838c40df9fc", "comment": "Malware payload (Loki)", "value": "db68a052dcc09a21823a95c0fc9d8277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398739, "uuid": "3efc25c4-0065-4dee-b81a-a172766c847b", "comment": "Malware payload (Loki)", "value": "bd39fed12fc1628ea0d32be8de963054fba43b2786e173ab93df9bba9421c07a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398739, "uuid": "cc2f3366-c807-4b08-8267-942357c9bb90", "comment": "Malware payload (Loki)", "value": "956ea013b0665d188de0a214755093cea718aafe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398739, "uuid": "56a578b2-4181-4647-abcd-445edbaea20e", "comment": "Malware payload (Loki)", "value": "7fc47090d0f99ecbb6468d603709f6dc72ee0f6966007fcdcf9d6369819853adcee73efdc88fcbaba519f9e961840d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398739, "uuid": "2566f4f4-c5ea-45dd-859b-0c01e3f59ec6", "value": "T1D4254A434DBB51C6E8BB0F5C547A76880B38E866FED8503B3CC8B66A4FF965260463D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398739, "uuid": "7baaafce-55c3-468f-ac69-4f404c5afb93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398739, "uuid": "c85fa519-cf03-44c2-8158-51deb684abd5", "value": "24576:QoUwaiKmkqUKka3FE2JTxsEvhVivyMBxrbMR:awDKmkkS2F7vhZMTXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398739, "uuid": "1568925a-dfb9-4651-8345-9bd269951ca2", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398739, "uuid": "da88aa41-2f75-4d83-997c-70f7b60eb1d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398739, "uuid": "2fc0dc23-56a1-48ad-8d4d-23ca4ab7a7b8", "value": "db68a052dcc09a21823a95c0fc9d8277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d808c7e1-c817-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679424025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424025, "uuid": "24a7e373-df61-40d6-afa0-e0ba39bee398", "comment": "Malware payload (CryptBot)", "value": "adcf4f2d9028c52a8b7b7b7880aa5d6b", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424025, "uuid": "88a1b363-9d0e-43eb-a005-6ae56000239d", "comment": "Malware payload (CryptBot)", "value": "bdce60e92616f204631ebac6d57c74fd2214c9591c6faa2a76150c6ac15c6ac0", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424025, "uuid": "de67ba2e-8a01-44b2-a5cf-1ca6aa15ae0e", "comment": "Malware payload (CryptBot)", "value": "60c9c134ff2cd2847b9f8ff58aead722e9ac43a8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424025, "uuid": "1c2de15d-492b-4d10-af07-c0b87a26ecf8", "comment": "Malware payload (CryptBot)", "value": "bcdba3ef7e5615908bac104b0adc3525c10515e4b78108aed7c5f1c2f8b150a7c6f26bd53b4de3c2da7a4565a3f98365", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424025, "uuid": "7d6252fe-b0af-4469-91d4-5e1aed0665aa", "value": "T13E76233A11771727EC4A9C35843BEFCEB1B24692EB40B87076E6FBE510326D4D562B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424025, "uuid": "1825d922-1919-4769-883d-48d6804cb766", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424025, "uuid": "8ed8c0ef-d138-4f18-b036-4da99eec9132", "value": "196608:0dvbLD+bI92rDvjxLZisgOb5nEqc93TkNboL:0vbLwrLjxLZishuT8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679424025, "uuid": "9dce1db8-f2e5-4abf-ac21-2dd2239c335c", "value": 7160832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679424025, "uuid": "cfa4b342-00a5-447a-9933-3a580329b3ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424025, "uuid": "e1e466bc-fac9-4139-abda-b7470f11573b", "value": "adcf4f2d9028c52a8b7b7b7880aa5d6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593db551-c7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679378715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378715, "uuid": "69b194f7-d6c6-49d9-bdf3-a488e41e6a2e", "comment": "Malware payload", "value": "f448d2bbece9ffca6d35b72ad699c545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "expert-top.com", "colour": "#BD0A95", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1212", "colour": "#1DB870", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378715, "uuid": "ef60e746-c033-4543-a20a-63db05d9dd02", "comment": "Malware payload", "value": "bf83c57f5b1ae62b3a671d93d263d9704c4e5dc82a4b381b216afd7b1d4764aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "expert-top.com", "colour": "#BD0A95", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1212", "colour": "#1DB870", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378715, "uuid": "66af9752-5c42-4b43-88d1-7ae74d080076", "comment": "Malware payload", "value": "acab3e78eb72b8cde7f686a7adce243e819fa5ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "expert-top.com", "colour": "#BD0A95", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1212", "colour": "#1DB870", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378715, "uuid": "0571e0c0-1033-42fa-a028-c31761034e82", "comment": "Malware payload", "value": "817e7b4a110a148933364a19c76e866c1cef5e2f9ee5d306dbe3604f6b0dba8547d1905a3313a5d41480bb6843dc6eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "expert-top.com", "colour": "#BD0A95", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1212", "colour": "#1DB870", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378715, "uuid": "fcf697df-54c8-4a2e-abe6-a22951d1d516", "value": "T115A63333A39D00C0C5D48D3A8937BEE9B8F61F775B06B97AF9A67AC10132594B311987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378715, "uuid": "2fdd6ca3-8980-4172-bb63-ae8e65c2034a", "value": "e9fa0dc321486a0834a2759b64589900", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378715, "uuid": "1c7e7346-a650-431d-9fef-ad9f8799adff", "value": "196608:BhzWfNRbFvKkdDlGBpcb5jIxprm3dbeNYieb6ifmhDEZmnr/KVx2B9to:BkhqBpcNcPr6beSOr/mxoHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679378715, "uuid": "51b90716-d026-4e46-9752-83037a8db780", "value": 10371193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679378715, "uuid": "cb5ed3f8-9786-4b76-8646-23ebe3311035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378715, "uuid": "a307c6c7-25d0-4ea6-b527-052d6ba5a9e8", "value": "PC-SOFT_Set-Up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4780441-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393041, "uuid": "963f3dbf-43af-45cf-81dc-0c2e24ec9f23", "comment": "Malware payload (AgentTesla)", "value": "b14676ecbec5e59d096765ee28d1f596", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393041, "uuid": "9f091e80-a469-48b4-8a30-9c05dcbaba3b", "comment": "Malware payload (AgentTesla)", "value": "c00e7ba029d32b993035a261afb4b0a1cb9b5496710a761f46f5d41e7f7bec03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393041, "uuid": "6c000449-25e1-4ef8-bc01-6d2fd978ea4c", "comment": "Malware payload (AgentTesla)", "value": "0a934658ad8eb722b35f0e6d4c2b268a5331b259", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393041, "uuid": "6772575f-9f53-43a4-a7c5-3b15eb7c17f9", "comment": "Malware payload (AgentTesla)", "value": "27fe5c65b272848290ef0e67959a0ffec24033eb23cf4e12af8f685323d7d453b2165313879b2a1281fb518c1a534050", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393041, "uuid": "c7ce0593-2642-4dfa-b605-16525b98bbaa", "value": "T124D20817FBDD43B8075111B3621E4AC9AB3DE63E7351509178ACA27433AD82D42BA6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393041, "uuid": "3671b739-6be6-4a2b-83a4-02fe937c1d8e", "value": "768:kFx0XaIsnPRIa4fwJMqAeuc11SB6Fzl2ELipu:kf0Xvx3EMXeuEl52pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393041, "uuid": "febc2cf4-c821-4042-9fef-fb8426d66d0f", "value": 29682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393041, "uuid": "f4d58823-779d-4bd7-b460-e1b675cde85e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393041, "uuid": "2736f359-3f90-43be-a1c8-20d2588241ff", "value": "AWB773436656153.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1280d52c-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (BluStealer)", "timestamp": 1679415962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415962, "uuid": "7c2b33cf-791c-4890-a203-52aa1ed59366", "comment": "Malware payload (BluStealer)", "value": "e434e422d6bb9bc02f9a4be0b1c41d1b", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415962, "uuid": "51d76780-5174-4fbc-bb79-2fcb40085580", "comment": "Malware payload (BluStealer)", "value": "c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415962, "uuid": "c3c679c0-c698-4adf-a999-79faf18656b3", "comment": "Malware payload (BluStealer)", "value": "af7347b789fb43b26a83f4864e50eedf7f62095e", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679415962, "uuid": "f2919b0c-9f47-4b45-986d-08008bd48d20", "comment": "Malware payload (BluStealer)", "value": "bf79d87e8d509993818765ce4c893319c0dfd30aef774e1ff8ceb51d429004018df3d95515c6084f766b4babbce9d3ea", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415962, "uuid": "ca3ec198-c3b5-47d7-b2b6-3e298e98e539", "value": "T11A35230772575E6ACA3DCDF88A211A8053B2B7666B0BD3ED3ED518DCD2F0BA65110363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415962, "uuid": "25d4c951-4bbe-4346-b9af-483d01c3696e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415962, "uuid": "063eda19-0bf2-477d-9e58-adefcd121214", "value": "24576:nVlj9vY9URDvRtWBQDtty/ziBgqMSAqzQYkYJrrzZL:nVB9g9YDptWuryduIA1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679415962, "uuid": "e87e1278-cd0e-40fb-a65d-2620748bb533", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679415962, "uuid": "59214162-bf95-41ff-b6f5-3d2163c0002c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679415962, "uuid": "6b6542cf-5ba4-402f-8c36-2255a5690f95", "value": "QUOTATION _RFQ# 1043999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d1886c-c805-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679416297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416297, "uuid": "b79b19bb-4b33-46a4-a66a-c31751e90e93", "comment": "Malware payload (GuLoader)", "value": "f1b02baa260778e7bf1dfbad96a29187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416297, "uuid": "ec7eb4a4-76d5-488e-b687-a97c99468d34", "comment": "Malware payload (GuLoader)", "value": "c3c6f77dc28878ca65ed3f6d590307f459ab15a0a3b02069c4d54462b3e1bfd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416297, "uuid": "1f516bca-30e0-4999-aa23-f54603f4f728", "comment": "Malware payload (GuLoader)", "value": "838b66a630791054fb4dd72c9a9c2864f58bc19a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679416297, "uuid": "a7d5809a-e962-4d32-8731-7ae82fb2eadd", "comment": "Malware payload (GuLoader)", "value": "55adf0058042e2a8e2bdb63912f87275e3a4615dc017f259c59cf556717a80180f2c1a77dae7c06e15acbdd14dd792f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416297, "uuid": "40ddb1a0-0d63-436b-bdab-100b53597642", "value": "T15184CF115725CE03E390527C4096E7BC9E265ED4BC5BCB236BF9BECB7914726282E183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416297, "uuid": "e0813455-47d1-43c9-aac2-0d91d2913c54", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416297, "uuid": "02db9862-c048-4d25-9101-3286a2200b49", "value": "6144:GspNjlsvCnvxZGVGGMrYfXcHQ1ucjHkt8PwbHot0ygmnxf17HcSOM5xNgt:GcBw1u8Y8mot3Xxf17HcRcPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679416297, "uuid": "5d8b95a8-5a3e-484e-8588-2f5bd1fb38f8", "value": 380800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679416297, "uuid": "79da9ae7-b4c5-404e-9724-d5ba07d65d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679416297, "uuid": "5e230c94-60a2-4570-bd30-259bc7f2b485", "value": "rCreachy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95a982a-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393050, "uuid": "4386ce6d-1cd5-45d4-8254-b077722d3310", "comment": "Malware payload (Loki)", "value": "373d4e1062b50a06f75c4466f7525cda", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393050, "uuid": "679e66f6-0eb6-4f85-821f-9547d40f801f", "comment": "Malware payload (Loki)", "value": "c3ce18f51c86cf5468df6fd3b2524e02cc77a425511b448a23f065b4b103bfe4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393050, "uuid": "023bfd79-4181-4fd3-a641-1d2fdb3e9882", "comment": "Malware payload (Loki)", "value": "f54bc22b0fe5629f327c6abe6bfffb4158789b42", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393050, "uuid": "5844d4dd-606f-4218-99e5-a8d98e11250d", "comment": "Malware payload (Loki)", "value": "914c7563b128863e8d1a4e3f8a8ee9077ed946e4278d06715dca90754a154a5a83cc9b366cd9976557fadb59c2dcd645", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393050, "uuid": "1df2c5fe-accf-4c95-a605-ff8167c158aa", "value": "T1CD350213F9C55D46D44247F92AE37599232EBC627BD2A2C72348B70F5F78AE08A4710E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393050, "uuid": "4baa11e6-5c05-46e4-be99-b59370b511e6", "value": "24576:aLKJWQmmav30xj+MXUu9/45+MXUu9L3bVR+MXUu9p3bVAicubCdOQafIFi8:aLKYQmmQ30p+MXV9c+MXV9L3bVR+MXVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393050, "uuid": "8045b02b-74e2-4e81-b78a-d98f1ad46715", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393050, "uuid": "ce2382f1-5aa6-4ce0-8c6f-bd74fe666eb4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393050, "uuid": "c7392ba5-4d0b-43f8-98a8-0c7c0f796459", "value": "Maltrans SOA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f0fa48-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679397528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397528, "uuid": "92726df7-c6b3-4172-8ad8-f8393135fb1a", "comment": "Malware payload (GuLoader)", "value": "6e73708e3d21f04b6f18aa31a68f582e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397528, "uuid": "b64ecba7-a2a1-4b01-9bd0-b92cd275bb8e", "comment": "Malware payload (GuLoader)", "value": "c46e251d3f75d5171ef41c926444aa590b089eca868141b1abad8ec0930b506e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397528, "uuid": "15270bb7-3dc7-434a-93eb-f408a24f523a", "comment": "Malware payload (GuLoader)", "value": "b192ab28546dccb6efca9a9ae7a73823e6255da4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397528, "uuid": "b5b26b2e-e1a3-4273-9ffa-d1ab6a296d7c", "comment": "Malware payload (GuLoader)", "value": "0be1a18b2332687627622dd6e551c5b43c9ee40cc10789a7ff611a597a6166427eec25d72370c5d139631c9d607e9c7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397528, "uuid": "d2ddad36-527f-4191-908b-16e121cd16a2", "value": "T163C4230423D2D22AE9638F72ABA3A9D9DBB2EB0146331507771C3FAF7732552851DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397528, "uuid": "9aefff74-9b76-44d7-a3c5-1d892118773c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397528, "uuid": "131bf1ff-3b7a-424a-85f4-f1e5a71cb97a", "value": "12288:cqp+8Qve8l8AFe57GK1BoBXAPl0666xTzLSS0/K779NKKc06Kux:48Ue8l8HGK12wPl0666pF58h06Kux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397528, "uuid": "60a71915-91db-497c-b50e-0ae729174126", "value": 570442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397528, "uuid": "0e04ad34-65aa-492d-860a-5550a431f5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397528, "uuid": "3de30e19-29ce-42e5-b715-7b78a9b6a8d9", "value": "6e73708e3d21f04b6f18aa31a68f582e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096cb80c-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389318, "uuid": "3d06d96b-def5-4a92-a65e-29848bc0d737", "comment": "Malware payload (Mirai)", "value": "293c9f1d9ca30d963fddeb9be7619748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389318, "uuid": "68d57939-ae66-4ba2-b02a-40810040a75e", "comment": "Malware payload (Mirai)", "value": "c55721591a6f037a173e2f7dec1fe2ee5978678bca50e781615c0f0f1f8d11c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389318, "uuid": "9cd693b5-c872-48fe-beb4-bd769abc5d81", "comment": "Malware payload (Mirai)", "value": "d879922a9c8740993b8cde5796780d2c27a97253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389318, "uuid": "cf616c52-967f-475f-a006-b5f60e52854a", "comment": "Malware payload (Mirai)", "value": "a531dfa88be13059880564f94ef601cb598e0bda882bd9abf3040dedf180b21cc37d3ad8315bdf9186b77de125f9c3c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389318, "uuid": "8a1f94c5-23dc-4eed-ac2a-d33028b53293", "value": "T1C6C3E770E8044B2BC2D223F6E75A869E3F351E9797A733115B3879B02FF27991E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389318, "uuid": "8459d954-bc55-4ec2-9332-7c35f0bcd826", "value": "3072:7H6j03fR3CAfOq3KbzvrX+a5m7/L7QsvmGfIiNb:OjqR3j53KbTVm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389318, "uuid": "5ebd914f-9086-4543-bd41-38021db18e48", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389318, "uuid": "95bf8990-2c50-46f4-b53f-5adfc5173c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389318, "uuid": "34259446-4c21-46e5-99b5-348786fbe549", "value": "293c9f1d9ca30d963fddeb9be7619748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbc0096-c783-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679360197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360197, "uuid": "01bef4a4-fa8f-47c5-b987-8d1c6b6869ec", "comment": "Malware payload (RedLineStealer)", "value": "2b3725cc020a49dddfc49f3cb9e07076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360197, "uuid": "161a097e-ea5a-4b22-a733-1bd9ac0d7fae", "comment": "Malware payload (RedLineStealer)", "value": "c680ecc3840184d2530cc3e6f36c2ee34225337869bbb0a6d878a547d7f51e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360197, "uuid": "69860abb-cd56-43bc-a262-d4599901e233", "comment": "Malware payload (RedLineStealer)", "value": "604cbe6b787ea157035a7e915c71c00d8cbb5f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360197, "uuid": "8bd2ed95-d6b4-43c1-89ce-342d6a5c2cba", "comment": "Malware payload (RedLineStealer)", "value": "aa5f95fd711788405a79ae8b1827314804259249da9c86db0bfe9990040ee0cd389262607088e833b8e7137a0e8ff031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360197, "uuid": "dff5cfb1-2648-4817-8891-4072237a1733", "value": "T16104C41437FCCD11E1BA5A3F6961A06086BFD8026852F25B76C767CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360197, "uuid": "93f5b43d-ac70-43f5-8798-05b35ae1c954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360197, "uuid": "939df589-c9b4-40c2-9300-39458dae9fde", "value": "3072:FxqZWJBaKULo3f5HHeet5FthJjxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwz:PqZIRPth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679360197, "uuid": "9f348619-5f18-4364-ba35-52b822447071", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679360197, "uuid": "c51082af-bcee-4fb0-afc5-638a0fdc9f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360197, "uuid": "0c950779-de89-4cec-bfab-326653f4d291", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebc8ca8-c791-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679366403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366403, "uuid": "cf57d1b7-6fda-4d52-860e-a366bff33ba5", "comment": "Malware payload (AsyncRAT)", "value": "0c2353b8b6923a16f523944d6514bb8f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366403, "uuid": "f78ad638-555b-4b62-b3ba-67c28a0bfcd1", "comment": "Malware payload (AsyncRAT)", "value": "c69b81e6499b64d01ed7b231985f9061e8553309cbd64b00d1699e71d58fd4c3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366403, "uuid": "d0c0d741-2e18-4af0-9711-6acfef21f023", "comment": "Malware payload (AsyncRAT)", "value": "d66baa60bcfbc057466b3ca0ef3076c5fd02210b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679366403, "uuid": "cae8b8b0-83a4-4dce-9637-8a4d82a08e13", "comment": "Malware payload (AsyncRAT)", "value": "c585ef3ce60a22ea791bf5d4cd17be033d8fd576c414c4fe411a7a3c59f8b1e7cf7baf9e533d1b8066a0dcff3a26bc7d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366403, "uuid": "c7dece1a-d4c8-4c92-ab82-2c9c1378e576", "value": "T1F2237D443BD8C13AF1FD8BB5A9F2914582B9D2272D03DA5D6CC810AA1F13BC596436FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366403, "uuid": "e62808ef-00bb-4f37-90ba-cae52b494ee8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366403, "uuid": "0995f0d5-daa9-41c3-9f8a-30e3f0c931ae", "value": "768:OV9TQo2oIL4+M0+Li4ciiyYb1ge6eez+/vEgK/J8AmVc6KN:OVpQoVsbRbSlnz+/nkJ8AmVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679366403, "uuid": "67b1f4bd-3e88-4b34-bf91-682471c91058", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679366403, "uuid": "544d6f42-2f34-4928-ac70-fb6de636fb45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679366403, "uuid": "1a801da3-c1ef-4b37-82bf-15ea5ffa78a8", "value": "Testing FR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858387c7-c78d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1679364616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364616, "uuid": "633ff426-ce74-4be8-9a04-fea2c03083fc", "comment": "Malware payload (RaccoonStealer)", "value": "915d4d0507f8f30e5992d0aae2422125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364616, "uuid": "9dd93180-2702-49be-8f94-f4e766f0993b", "comment": "Malware payload (RaccoonStealer)", "value": "c81b03aebedc837f9f8f0b20fa3ed3d6e81a53b2279de3670fbd235e51d0ccd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364616, "uuid": "79f93f13-4db5-4701-9614-9a1d24c32fef", "comment": "Malware payload (RaccoonStealer)", "value": "784a91d74dcd4afb9c378f89c9223b2e4fca2abe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679364616, "uuid": "12906c2b-efac-4e57-bf58-f79422239f80", "comment": "Malware payload (RaccoonStealer)", "value": "63606376c5048716df56057a60c78f74b8a494acfd0ac847bc4a8bfcd341e0b37393c561736951ca703c41c0398d75c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364616, "uuid": "8e7c2f27-d82f-42a3-bb9b-ff1c169129f5", "value": "T1B48623B3A9660204E4B2CC398527ECB432F60E7A6A427D7D54DDF9C129334A4F623D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364616, "uuid": "48a74272-d694-4568-856e-c480b9bcdbcd", "value": "f0e8db307701582115b12426e04e3928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364616, "uuid": "d9961df0-6d6f-4616-9bb4-afeeb8bedac8", "value": "196608:Jdj1WcTeKCVpVAKegYv6Pvz7xCVfQeYDprOtiN6x1Cd:vReKaAlRgxMfvihODxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679364616, "uuid": "33c3317f-9a22-4a40-8435-008e6c47e9b0", "value": 7839744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679364616, "uuid": "31fd1656-1d2d-4b2e-ba7b-71d8b8bed3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679364616, "uuid": "1b316428-e4f8-4dd6-80df-f16203b54d70", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c995de-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679397709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397709, "uuid": "42056a86-5bc5-457e-aba2-687c4bc65f02", "comment": "Malware payload", "value": "8c00f332655cd2ac0436d2fc35be1d12", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397709, "uuid": "0f2e67fe-b713-48a7-8d49-fc95835690c2", "comment": "Malware payload", "value": "c8ba7ddc561ad5964d98240a2fd3716780f64f9860e7404cdf1a0af5eba5f6f0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397709, "uuid": "9132a65c-0f09-49eb-a673-8513910377cc", "comment": "Malware payload", "value": "4856a2793362194abb31c7f7ba3f054701881fd9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397709, "uuid": "38b0987e-9747-4b55-9ae6-a7bef2d3c20c", "comment": "Malware payload", "value": "9f1a1aa51383dd27201f88a60ed0a7537c68b29e4fc87030a29a19ccd03de42d5bc95a35ee6339fd8ad9ae4b35e21ef8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397709, "uuid": "d5347535-3477-4fbb-898c-82dfb5b35f2b", "value": "T14C14B307BF07263490B0C6929A29EC6BFEA62E6BD4520415B58C70940F357DBD6FD2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397709, "uuid": "6020e4c6-ce20-4fd5-8118-a0ceda0718ab", "value": "3072:izNTZyx35/CzDae0xULdcMdZrKcynPWq84Vx+4oomLCNZlL1PN+jg3T3:izNTZyx2Dae0xULdcJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397709, "uuid": "0549a0ab-4259-4d56-b9c8-f02b6921143d", "value": 201185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397709, "uuid": "e45e92d0-601b-4f59-b6b6-e56597dd2f34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397709, "uuid": "2f468ed3-a71f-403c-888f-c67e9da5175f", "value": "OffScrub_015msi.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66677cd5-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679398923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398923, "uuid": "b26b6016-53b4-4073-a551-fba660a4199c", "comment": "Malware payload", "value": "630c23cf96b27920c3ec56172eea948e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398923, "uuid": "2daf5f2b-2e2b-4675-b32c-f11f08a00b83", "comment": "Malware payload", "value": "c99c666af40a931497de5f907523a922fe9b7655a4cd94619f71bd9cd15189fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398923, "uuid": "28518b55-d672-4d1c-98f1-47a653dbc85e", "comment": "Malware payload", "value": "deb5a5296ef9a73ba2422962ff085c728570f796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398923, "uuid": "2b513065-0288-4fe8-acdd-e94fbe300535", "comment": "Malware payload", "value": "4ca5c80cfbf562ccb83ee4892374b560c13b0035018d678679204a6201ba6bb3c592f9d5714132589e79c33a13167063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398923, "uuid": "4cb6336e-f9b7-4508-b15f-7146cd5a47fc", "value": "T159952373226900C5E9E2C936893BFCE5B1F202BE8B419CBDA5DA5DC23D135E5E253943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398923, "uuid": "038f6a60-44fd-4277-8814-76a5c8073914", "value": "1e0761929bd134002c60e7c6c91967be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398923, "uuid": "7cf3b176-18de-48bc-b0d0-6bc18b6da376", "value": "49152:tRPdFLxu5RRCNLYtIz7EQM13lWblKcxFHH53:LLxu5RRCyIzQQMzpcnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398923, "uuid": "c70f1fa7-e88f-46f7-ac40-f0b7c582f530", "value": 1885366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398923, "uuid": "0d31caa6-a3e2-4889-9a09-c1e3762c2113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398923, "uuid": "36e312c3-b5c5-4627-bc7e-1269fcb50e20", "value": "630c23cf96b27920c3ec56172eea948e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e57cf6-c7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384848, "uuid": "b19d1471-c774-44af-8376-cb581b7d0a59", "comment": "Malware payload", "value": "b655dd2db99b3fa3c3acfff41adf4c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384848, "uuid": "ca7ff322-88dc-44f9-b3e8-53fb9c30a619", "comment": "Malware payload", "value": "c9af5486fcea9fdfb10eb9d9048f11c8eb337183e772c975156ac76ac7f947e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384848, "uuid": "a553dcd1-c502-420a-858e-1f4a8bde738d", "comment": "Malware payload", "value": "e806e9ae9268e0bc1ab5ce611a29ec60e7dae3f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384848, "uuid": "e29b2e81-285c-42f2-b23d-b8b91f117046", "comment": "Malware payload", "value": "3b758633ffe7cdb48797538c39bb0b2cdb22167fd26235cf79d82a1898d9298038041814775091cf1f9ec9323499fb84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384848, "uuid": "7865384d-1cf7-49a7-a5d1-253bb0dec6b7", "value": "T10AA58DA138C04C72CC5306309A59F37DFABDA57C4B3E41D73295AA1CBE35C835A2E56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384848, "uuid": "16b0c07d-f9b4-44ca-acea-49c37635f1c7", "value": "6c0f09c6388b06f9f0f4dd7565d0124b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384848, "uuid": "35c1c1ee-5013-4651-86ab-0d398fd8bc46", "value": "49152:8tgp9P+FDwoqgVbUU6IZIg3VgRLBQag5pE06m1IPTmpA6d:8OpJADwLgVRZISVgRLBQag5pE06U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384848, "uuid": "8e5ecc61-25b8-4693-8e53-22d7d6a4b1fd", "value": 2228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384848, "uuid": "90c12104-ad90-4cc6-a525-84993a5bd9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384848, "uuid": "71053ea9-e707-4ff5-bf47-67a7fac87507", "value": "B655DD2DB99B3FA3C3ACFFF41ADF4C02.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4b9f24-c78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363258, "uuid": "16abfb87-bbb1-4382-b173-100f2c269008", "comment": "Malware payload (Smoke Loader)", "value": "9e0bc6e0c0d933bea58bae640be036b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363258, "uuid": "bf03cae3-7fd9-4e7b-b28f-0ad00228ae2e", "comment": "Malware payload (Smoke Loader)", "value": "ca58f46dfe3a84290399150599e37c124e435bf0561bf75a46cc0e653b677561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363258, "uuid": "2f2d0942-25ff-48ea-9a44-5e4ce09ed986", "comment": "Malware payload (Smoke Loader)", "value": "1a69a45575ff2ce8eddc11cb86720d5eb7198d42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363258, "uuid": "1124860d-81a4-467b-856b-737c2b3c2036", "comment": "Malware payload (Smoke Loader)", "value": "caccba29c1c07ad210972e09dfdba7737e983a4c4117791fe5257fd8d02625bbb9d0709b50a4f15f31359bab744205e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363258, "uuid": "2dd058f4-b766-4b4d-b8fc-d1ad96005e41", "value": "T184047C139AA07855E412CAF1CE2BC2F4BA1DFCD1CE5D6BAE22046E1F08B3162D5677D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363258, "uuid": "959851e6-9b5d-454e-b709-b8c993fd66ca", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363258, "uuid": "fb9f683a-ba61-45a7-bbb2-905bf0668110", "value": "3072:PstsPCWC/WiYW80fJkmwlDUOHOVp4xr5Pz4GKFZ:nC5q0hk5KtPorha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363258, "uuid": "fff634e7-ff7b-4922-a947-7c0f19734f8f", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363258, "uuid": "e4502951-45c6-4862-9f12-34a62d2383f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363258, "uuid": "c9278ebe-e7fb-4f15-8ca4-9892508406b0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9487c9-c78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679363987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363987, "uuid": "1dbd057d-0e6c-43dd-a563-130fd7b16f4a", "comment": "Malware payload (Rhadamanthys)", "value": "12c9ffd6da618549ff72192b588354b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363987, "uuid": "9aac09b9-9107-49dd-ad48-69cbd18966f5", "comment": "Malware payload (Rhadamanthys)", "value": "cc551bcb062e26f7f34be3e568f915b3bcb2927ba89797e55780e0ed99ff8655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363987, "uuid": "1ae8882a-9cb2-4318-abbb-5f779dbd6856", "comment": "Malware payload (Rhadamanthys)", "value": "b5686190f602449fe4db14da7a31e541d29aad49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363987, "uuid": "8ea1d6f6-78be-468d-91d0-8f3ea963b363", "comment": "Malware payload (Rhadamanthys)", "value": "31cf90ae92609a6c070231f27a952a6673b45c6feea3b8b5d7b8f97d4237bd1023dfe3ca88291a8657c247b59fdfc1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363987, "uuid": "ec0c620a-c1d7-43bc-bfd0-3c47b2a6774a", "value": "T1D4F5BF835BA07821F426CAF15E2EC6F4A60EFDD1CE6D575D22046E2F08B3162C566BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363987, "uuid": "4bb3fe4d-8ed6-4847-9878-20f4dfdb0e78", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363987, "uuid": "a176a6e1-ec00-4319-a219-fe7b995ef488", "value": "6144:p6UdHJVyuyJMHJKCEGoAEzIeALtJ70+p:sUdpAuyJ8KCEP8eAL70u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363987, "uuid": "c677a0b5-11f4-4a53-a2e1-33ad62e95f75", "value": 3404800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363987, "uuid": "1961f20e-7fb3-43df-976f-489159afa01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363987, "uuid": "08c505b6-8c08-4547-9175-d3e8079f56ff", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387e92eb-c79e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loda)", "timestamp": 1679371788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371788, "uuid": "c22867ca-d9e8-4736-a997-259b05191e62", "comment": "Malware payload (Loda)", "value": "588cd06833601b361f843c87056fd5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371788, "uuid": "93a5d68e-e325-4ba4-83bc-164c5ff5a167", "comment": "Malware payload (Loda)", "value": "ccfd30e42f2dbb38fa3ad9528c74c6ecf6cc45ab167838200331ecf903230db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371788, "uuid": "6cf5eee4-97c1-4d69-bb13-5f871bec95f2", "comment": "Malware payload (Loda)", "value": "36fd19550588e46b7ae12639421e9768f6172f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371788, "uuid": "9be10738-81a3-4af5-8e61-1257f5f08c50", "comment": "Malware payload (Loda)", "value": "8b580477bbafdd7728a85b31e2e6fa899fb1d8d91036815d0e31a2f7083b11362884599becd61515460b047d69c26de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371788, "uuid": "6b35331a-9b99-4b82-9c86-d02799bc634b", "value": "T1FEF533705609FBEDEEF29F374F8A44316328CECE5D96144D086F93A1C51829E8696FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371788, "uuid": "0a478f68-f13e-4025-9341-ff3f0e60cd27", "value": "0df92f59b17ff0c45cd25748e8895808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371788, "uuid": "80a2f938-c3ab-47a5-b593-5f12d02a6975", "value": "98304:cPMHpHh81TVkOjPdBx425wr7MARYza/PnrHT86b4GGsVJxz:cUrkTiOjPn76hCa/PrHlrVJxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679371788, "uuid": "d7d402be-569a-4ac5-9289-234887e0d287", "value": 3514896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679371788, "uuid": "de187348-70a1-4ede-b87d-f2c023c77557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371788, "uuid": "0cb1ab1c-151b-4078-b2b1-814937fea86e", "value": "MOL.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b31d06-c7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679377823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377823, "uuid": "bd427b15-5e87-4ff4-a840-cebc8d614752", "comment": "Malware payload (STRRAT)", "value": "abb2293d83d7bd6fdfa200f8339dc927", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377823, "uuid": "950f37f6-45b9-4aa8-ba20-df67e9428d2e", "comment": "Malware payload (STRRAT)", "value": "cd0a939ab3390793fccf74744d85e709b996651aba471d0b01a3efcc273182de", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377823, "uuid": "d9b29acf-3146-441c-bec9-7d0205c7e36c", "comment": "Malware payload (STRRAT)", "value": "4a1a207469a660ce141187012dce1733b44f7f2d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679377823, "uuid": "cffb79e5-96b5-4a5c-a404-7acde6366871", "comment": "Malware payload (STRRAT)", "value": "f847987b8fc2892122536aac3676cf3794cb3947c719f0e64a1350e3d94687350ad50ba79d26c57b47b9daaa085d73b1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377823, "uuid": "97b795d1-9a64-46e0-8102-fa978d80ea23", "value": "T1FE63028AFF6EC7A9F64B3C7E1540FC065A3980E76116E5074ABA3CAE4124D9C431BEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377823, "uuid": "2c961146-e928-4a0f-9e0a-a43de8441530", "value": "1536:2PzoSWfsWWVtM+Tqas4R6txocBIOKVQ36pAzdYr8qI+Z02KiqrL0iuA:2PzoSWk2YktxoQwQKpqddqI+Z80iuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679377823, "uuid": "805cab23-8457-448e-ab40-a6801425aa6c", "value": 71590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679377823, "uuid": "0bc2dc61-3d8c-4c61-b06f-928f444ffffd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679377823, "uuid": "89f4e3e7-dd10-4b36-b1ac-34002c435a5b", "value": "shipmentDocs9807654.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855719b2-c7bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679386090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386090, "uuid": "4d491ea3-7c5a-43ce-9f1e-9bf006ac70a7", "comment": "Malware payload (SnakeKeylogger)", "value": "e12a21934d82ceaa1e9b08ff661adc05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386090, "uuid": "eedc0cf7-0138-488e-96fb-ff4d1da599d1", "comment": "Malware payload (SnakeKeylogger)", "value": "cd8c99a4fed75ed8c857c44f20e517e7218a1da17a4577b52250523a85cc658e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386090, "uuid": "a81ef3ee-f508-4fd0-9cc8-83c0e6ad38a1", "comment": "Malware payload (SnakeKeylogger)", "value": "1cf713836c795801aeb0d8ac3fdd1a02d81d64fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679386090, "uuid": "51de8379-1a33-40a2-b015-1548c51f308b", "comment": "Malware payload (SnakeKeylogger)", "value": "12a38c874d472cdd27d04bb7da80e7dd9e151fefe5d478b648b8d35e63a63cf2463dd573574513afe185e80e4bd0ea97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386090, "uuid": "ec43ba8d-bac3-47f6-a0af-6dbeca7c18ac", "value": "T15CF4012E7B555902C29D493AC1C3552413751C8763B3E7483ACB22991A0FBEAAC4EFDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386090, "uuid": "f3e13fcd-187a-4444-b6b3-bd3722846734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386090, "uuid": "1681f84b-cddb-400c-83e0-4198e1a4537b", "value": "12288:pZtq24e+lOj3vSl3IfjDMs/5vTVEGPlzkL4moKChxRoQSpfg1aEGDEqVhe4+8DN:p/V+lma3IffMGVXlAoH9jZaEN/4+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679386090, "uuid": "77882e62-77d1-4c55-9559-9576aafa1adb", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679386090, "uuid": "56f3cd76-5c21-4d11-ab74-2b84d2fbba8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679386090, "uuid": "c6fc79de-678c-4590-b54b-57bca79b1732", "value": "ITB_TGPP3-MR-MR-011-PROJECT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1404c147-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679392772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392772, "uuid": "95b5ad7b-9b5b-40fb-8b84-0fbbd1119f12", "comment": "Malware payload (Smoke Loader)", "value": "4e1d821132655589a8c1000b136c62b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392772, "uuid": "3e7bd5eb-76b0-420e-aa64-1bceec10d6ac", "comment": "Malware payload (Smoke Loader)", "value": "cdcbb21e732b72f1a15a8a4170b69cebe5e77c5995ba85a6a8b602025c24586e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392772, "uuid": "2b84c133-0d79-4058-9646-87210c471b38", "comment": "Malware payload (Smoke Loader)", "value": "70c2c22a416d462b563b757fe7819dc7ec847388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392772, "uuid": "47653f93-415a-404d-8e26-20a8c7e53f9c", "comment": "Malware payload (Smoke Loader)", "value": "0acb409975baee00951f2fc2e3a0dfb2860d66b256ef3aeb022fd5c9ae516c5b926f92d08c9944551269204dff45b711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392772, "uuid": "d9786718-83c5-4cf0-b0a9-74d514d3e023", "value": "T1C4443B1393E27C61EB668B729E1EC6F8765DB6708F497B663218DB2B04701B3C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392772, "uuid": "2a1a435d-d346-43f5-9a9d-6a61fb5252a7", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392772, "uuid": "195c4ffa-e185-4908-ba52-00fa04529528", "value": "3072:SsTUZqf6LdCmxUUXe40GFG5MmmVIbhjTEvvVdPrbG7RF5aD9eORDhGFpy10wZ2Hp:7f6LdB5e40RtbhEvD3G7RSha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392772, "uuid": "48a1977e-abf1-4431-8815-b96adc006713", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392772, "uuid": "210e820c-a364-4996-a83d-65b9a8cf71f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392772, "uuid": "4e927c9c-2f85-4ba8-accd-112d3caec4e2", "value": "4e1d821132655589a8c1000b136c62b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5772662-c819-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679424933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424933, "uuid": "0ffbeee7-e87b-460b-92fb-cf3e5c61a3d4", "comment": "Malware payload (RedLineStealer)", "value": "76feee748612466fbd3f219b1adae8b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424933, "uuid": "ecb2e5f4-1331-47b8-9bc6-88d5634b586f", "comment": "Malware payload (RedLineStealer)", "value": "cdd1125cafa756dfb6540442ae0e7c8210fabd387a96ece172ece1e20f5ba0c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424933, "uuid": "6624826b-a758-4b21-a4a9-6da352eaa1d6", "comment": "Malware payload (RedLineStealer)", "value": "9055ee09f47edc884819f34b83bdb05cfec68578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679424933, "uuid": "199c1225-5178-4551-b111-be02d611216b", "comment": "Malware payload (RedLineStealer)", "value": "8d37800ccabf883253d483693e63fb4c8883dc282a6abbf860e0c45fce259dbe2d8ecee3224e7309513a08b5827c8166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424933, "uuid": "c4f6953d-2158-49c6-a561-97b3a64138a4", "value": "T15535230A36F86232EEB4277068F717534A397CF166B852977305CCDF29A2792B471326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424933, "uuid": "ba2baa02-2680-4465-bff3-b788721faf64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424933, "uuid": "ac6d057b-bc80-4f5b-9a89-f712052814c7", "value": "24576:RyQ0IjSE/yI5YXqHkyZm08/CdGqQqDK5wyK:EJIjgIBm08qdGqQ8K5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679424933, "uuid": "6f3fddf6-6d85-4e50-be0c-dc05fc449ab3", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679424933, "uuid": "df9421ff-398c-444c-aa67-ebcd4c1bd8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679424933, "uuid": "08bd3f5f-26b2-4451-9a40-86ba1ae59585", "value": "76feee748612466fbd3f219b1adae8b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dbbd4f-c7f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679407965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407965, "uuid": "b5eb1f3d-8e93-4e6c-967e-f7e7c0c42e36", "comment": "Malware payload", "value": "ab631ba0445bcb7386844bb0f4adebbc", "object_relation": "md5", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407965, "uuid": "35bf90c7-4fbc-44e6-a2f2-9e7433ec7d23", "comment": "Malware payload", "value": "ce2ae4e0d884be365d532d051db9379796e39185ed7aa0bbd28098ebf1350384", "object_relation": "sha256", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407965, "uuid": "db12a671-b4cb-4fa8-a411-69a3b567848a", "comment": "Malware payload", "value": "9443665b6f9eebf91c67f2a6e74c26489b6ee238", "object_relation": "sha1", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407965, "uuid": "0192373a-921a-42e6-a365-fc2a81042625", "comment": "Malware payload", "value": "08265a5adf8d5d36bb1f6e619bd790577d078e1d8b475bd89bea233a0cfe51bea3aed22225717a4657f960570f62611a", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407965, "uuid": "fc0e5f54-6458-4922-8ecf-cb93d4645544", "value": "T16E018520BF25E84843000A903D4DE0D4EA3873B86A256CE8B6C3AC54D12ABF633B735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407965, "uuid": "a05f7efc-8b65-42a8-9fbb-a880cab868d7", "value": "24:i2LDwOQEKIKF2NLDwOQEKIKF2uvkczLDwOQEKIKF2UtAzLDwOQEKIKF2zzLDwOQK:p6EsFE6EsFOk6EsFha6EsF26EsFlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679407965, "uuid": "333979e5-3e46-44ce-b073-244cb95d5eb8", "value": 771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679407965, "uuid": "d877872a-e5ae-461c-a5eb-468e68062043", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407965, "uuid": "bea60113-b5b4-4d51-be76-6e79340c8479", "value": "hkXzSiTS.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe698de-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362620, "uuid": "f0156010-fab0-4cdc-8668-c645f9577df7", "comment": "Malware payload (Smoke Loader)", "value": "a785a9c57a14c724fa4e33262d971e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362620, "uuid": "471bd459-5ef3-44d4-9de4-e4fa496f2982", "comment": "Malware payload (Smoke Loader)", "value": "ce936a1bd7a8687c32b059e1e6bb7cd211a4b6f9487d673902feac2857128ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362620, "uuid": "2acaefbb-790b-49ea-8709-085aad109368", "comment": "Malware payload (Smoke Loader)", "value": "7e61233c473b328d110fbb607eb16947ec59111c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362620, "uuid": "9e0c8d53-1528-43ab-9845-a60d908d1c21", "comment": "Malware payload (Smoke Loader)", "value": "e49c54f8ce15e9e1dd0f02698e376d8dc40957b3a21b8b7def793d6fe761530bb2498fa115d07dc2e574a310237b3192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362620, "uuid": "5eb40150-ade6-41ec-94d4-ec1093bfab6e", "value": "T11D049F135BE0B855E412CAF24E2EC1B4B60EF9E1CE5D276E33186E2F08B3162C5667D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362620, "uuid": "c2ff2c99-09b9-4875-b635-11b7ab930e98", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362620, "uuid": "b193b528-6127-49a1-bb04-777106dbf52f", "value": "3072:C0Jw46GypcmW/BuLOURJWopnuGa2Kw3cZ:a4l7rYUoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362620, "uuid": "34fa8321-daa0-4c23-a1c8-66fbf665755f", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362620, "uuid": "5eb41124-64e3-4dd8-bfd3-3e2985436cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362620, "uuid": "90426b1e-cc95-4137-9f24-335e7506d43b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9676a18c-c7bb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384401, "uuid": "a4908a20-8686-48f5-ae90-0b63cca7c758", "comment": "Malware payload", "value": "28125694ef9c9c9c6cc68b34ff289c9c", "object_relation": "md5", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384401, "uuid": "63c2fcc0-05d9-4967-8627-dcd777bcf158", "comment": "Malware payload", "value": "d10a6df70ccbd813af1614eecf8da1485cbb45889ab6a87b410dee10e98fcfbf", "object_relation": "sha256", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384401, "uuid": "b20fa592-6391-4ec6-aeb9-7b3e6fb48d76", "comment": "Malware payload", "value": "b80e8177259c4c22fdbe8ad3edcd4cc25927aa4e", "object_relation": "sha1", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384401, "uuid": "d8c1e041-d70a-47ea-9a37-15f0bdb92e08", "comment": "Malware payload", "value": "c2e7f38f1cff084b1560b95e390839b52d866cf1189a0c0fa30bbbc1e1b7d407f34a1d9884c460e39c2c67615d4759a2", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384401, "uuid": "d1d12c4a-929b-4b75-a7b2-6c810bbb72cd", "value": "T15CF095E95042E1EC064B7FDF952945C2C54301602255F1D1F119CA5E0957748D25484F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384401, "uuid": "238601d1-d968-41c8-a52f-8df2ab482892", "value": "12:60HpVP8ZsnoxyJRcYVOZnPVrehX0HpVP8ZsnoxyJRcYVOZnPVrem:60LPZoxyOZnPVrep0LPZoxyOZnPVrem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384401, "uuid": "5715a76d-441c-4e37-8f3a-204e8abc2c1d", "value": 512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384401, "uuid": "499e5a48-5c55-4834-8e8b-017ab4893f0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384401, "uuid": "d7c5c7af-be16-4e65-9688-6ecb29bcc2d3", "value": "RESPEC1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b072f6-c784-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679360858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360858, "uuid": "78b51c5e-16ac-4327-ba02-c393200d0402", "comment": "Malware payload (njrat)", "value": "754b3b2d761c6995235b0e9fb31e9125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360858, "uuid": "ec00cc78-9fd8-463c-b437-0c3d2e39e299", "comment": "Malware payload (njrat)", "value": "d11cc7508d420994e19a1df2327d313303117948b62d386b00d8120e17666be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360858, "uuid": "7f18a28b-0e48-4d71-99ab-e5d619d252a4", "comment": "Malware payload (njrat)", "value": "09f19eb8066047aa657edbf54b40c513aeb5f85c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679360858, "uuid": "429a0d7b-4f30-4d2c-86dc-7121f7ea9ac7", "comment": "Malware payload (njrat)", "value": "c3da9f2b72a8606091aca1f58e5b4bbe71153aa30616c38974c3bd9de42b44f6587526f6e8a9d5f625edb140eda2e0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360858, "uuid": "1c391433-4ac6-492d-8eb7-27f5e99f8ecf", "value": "T1B4048D726E738445FBFCC5347CD1B3A055607ABF9CC99F96E858B2CA76272C052708A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360858, "uuid": "91cdc108-7819-4f72-8b78-8aef588087c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360858, "uuid": "73c14302-11cf-429a-99e6-8f18dc16f8dc", "value": "1536:GvuuLUekYTqYlqmgzbuHYTF0ESsUcKETeovvQ:nuv7Wvmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679360858, "uuid": "a82e8ef2-fa8b-45e8-bf18-26b0611eb457", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679360858, "uuid": "ec374e28-65f0-4ac7-8470-b0314389307c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679360858, "uuid": "8712107e-142f-452c-a770-1b073e6dedf5", "value": "bKEr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe4d4e6-c7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679403691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403691, "uuid": "9515bc7e-6c15-432b-b4c4-d621fefa3acf", "comment": "Malware payload (GuLoader)", "value": "f63809d17e11d6e0d719d44a2ef45ca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403691, "uuid": "418cc3d7-e0e9-4aa8-b4c0-295ff1f4e973", "comment": "Malware payload (GuLoader)", "value": "d209b6fe66d2f2c856a3f56d6386a1963381a681c2cde6367840a24d717427e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403691, "uuid": "e88725d2-e424-48be-84a1-84ff2027bcdd", "comment": "Malware payload (GuLoader)", "value": "58a52ad6005886660cf54c7abbc21b7b31371894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679403691, "uuid": "5d5149aa-64a4-44fe-aaba-06425aa92c33", "comment": "Malware payload (GuLoader)", "value": "e2e2b74e63069c0f14b03dccb4cb113cb8618ad7bec0c7e84ad9e8c2a01136b01763218887b6deba0fe23e48f1d417f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403691, "uuid": "fee3539e-c07c-4a5f-b9b0-e851f597acb9", "value": "T1D684CE516751CD03E781527C9552E7BC8E266ED4B92ACF2367E8BCDB7904B272C2E083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403691, "uuid": "1dcfd6c7-bbbd-4e4f-8c26-e4951c260de0", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403691, "uuid": "0d2e5f14-03f9-40ff-8058-876e870b15fa", "value": "6144:sspNjlsvCnvxZGVGGMrYfXcHQJsOjGXve0i489/8zvZKcrAc2uxMK7S+2vhv+k12:scBwJsON+zHrAzfK4hGko9HJSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679403691, "uuid": "e3aa731b-042a-4a7f-a114-be2366abd2cd", "value": 386112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679403691, "uuid": "0f5c6204-7e08-4f55-ba8f-57dc0836ac94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679403691, "uuid": "daf14cb0-9320-41f1-8d02-19d95221039e", "value": "rBrancheforeningers123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50372f7-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392666, "uuid": "2bdce0a9-cf72-4396-b0fa-3f0ef3db5ac5", "comment": "Malware payload (SnakeKeylogger)", "value": "001efaca423a2a941c370fcf0acbcccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392666, "uuid": "209bf03b-9c50-4dd6-bc10-fcc0df2d92ce", "comment": "Malware payload (SnakeKeylogger)", "value": "d3ca1ae43635e0ce29ef504685bb4486750fef8644d24400313493a2087ccaa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392666, "uuid": "9c0b9a23-5040-4a61-870f-1d1ab8d54923", "comment": "Malware payload (SnakeKeylogger)", "value": "7a75cce2853d3c056c7ec7bf03ea37de232d94dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392666, "uuid": "aada9421-a5f1-43c3-8de8-ee9d9d1c9d62", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a74c8de6186f2c6d0c05de424ffc4105e23006cdf5ea1b102109e246ab418eb3a131e1ff88f88712bc63b4db73642c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392666, "uuid": "3fc2bbb0-4342-4db9-8a91-51f5c9289027", "value": "T1C0255B424DBB11C6E8B70F5C547B76880B38E966FDD8503B3CC9B65A8FFAA5260063D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392666, "uuid": "26e52203-7f4c-4513-8bc6-7406b2502478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392666, "uuid": "cda4f985-3d6f-4f30-ad6e-ad4b0e5f3c1a", "value": "12288:43NW9e96WLMvodea9WXE7l3FTK3NB/eqS1BErk6fBhYaEPL7Z+nkkIz3Xz6TWG9R:qyoBWWlJeYqS1yVf7BgqbCmaxl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392666, "uuid": "3d925faa-1330-4c18-b8c4-743b7b891a25", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392666, "uuid": "57d0521c-9f2d-4a09-be24-fd34da25d2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392666, "uuid": "562da125-0007-432b-b67c-f1da41bbd5c0", "value": "001efaca423a2a941c370fcf0acbcccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d8c896-c7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1679391654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391654, "uuid": "c7066d99-0a8a-4fcc-8e47-2b68c88e810e", "comment": "Malware payload (LummaStealer)", "value": "aa755552111760cbec58b6732f2911fc", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391654, "uuid": "a262db9a-4a05-4cc0-b0d1-4437519a2200", "comment": "Malware payload (LummaStealer)", "value": "d3ec28c089d98942413d9d197ff38b0bd2c336df708564307467edb58f23ea37", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391654, "uuid": "0496564a-e760-4e9c-b8b2-6333085f1ba2", "comment": "Malware payload (LummaStealer)", "value": "3c77f0366d7d492e3cdf16006b2fe312f3ee89b8", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391654, "uuid": "d3b429d4-5a11-440f-93c9-6579454c7327", "comment": "Malware payload (LummaStealer)", "value": "c5fdb59a5598d5f24899451cff2158d7f78f7dcbd403a975bcb42c9f57cb173a27acf52103186d3228f44fddae7e8930", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391654, "uuid": "625451e5-cef1-44c4-9e53-114c555d81c7", "value": "T119154529F0853621EC8DC6B409F02EA403E26D79126B47C42371359FDB67F7D9A78A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391654, "uuid": "86c3d8b8-889b-4f7b-8007-8787ec6c6b2e", "value": "384:ynnK9MGosyer556ig9WCc8BN9gCjUslRfDhGkjr/eaLgCbo39dSrYC:ynKe7sPR6N+NsLFGGr/HgC836", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391654, "uuid": "fa95cdfb-702e-4194-bad9-a22fdfab29d7", "value": 876410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391654, "uuid": "3e1b65ab-65e3-4b28-b8f6-b29988535777", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391654, "uuid": "20819fff-da1c-4620-a1cf-f866bdfae464", "value": "particovl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac989d7-c7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679397535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397535, "uuid": "88f54a2c-9673-4f86-ab73-225a8773701b", "comment": "Malware payload (AgentTesla)", "value": "2414aab964b19e19cb8b57ccc6b3e6c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397535, "uuid": "b325ac38-d727-4720-ac76-bb0ecb8ceb05", "comment": "Malware payload (AgentTesla)", "value": "d5387c42e8059092e86b896c525002d61d173b85bdc4047f6fd4923ea90c7695", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397535, "uuid": "a943de20-db54-42bb-acb0-edfb3ec7b5da", "comment": "Malware payload (AgentTesla)", "value": "707c2b2c1f962a07264b86bdf747228d5c4416fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679397535, "uuid": "e7619dcf-b0fe-407c-9242-693334bca4e0", "comment": "Malware payload (AgentTesla)", "value": "90affd42c03b887936362a6638bc75249aa62799f37dc53de5c19506a60b2b8b24c08aadf91082177cf97d853fda2e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397535, "uuid": "6bf66b7f-8540-4a25-b0c3-0ed9da18e8c4", "value": "T1E1355B424DBB11C6E8B74F5C547A76980B38E962FDC8503B3CC9B65A4FFAA4360463E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397535, "uuid": "064ecb27-f46e-4cb2-88a8-13431d9947f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397535, "uuid": "68591a2f-2440-439b-93e8-59719befd2b3", "value": "12288:y3NWXFgRVG9523g1FG+J3r3cTj+fsdYmyq4klEy6itpiqZTZqT7DB+IZD1aWGlvH:/Fgc2yPtr3wiE+m6kWiOqZTcTZjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679397535, "uuid": "284a97fc-3879-45e8-8810-c8df88531665", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679397535, "uuid": "e0f6e4f4-a36c-4879-aef0-1244964dd5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679397535, "uuid": "5531639c-fa0c-4474-aad9-e4def3cb2e4e", "value": "2414aab964b19e19cb8b57ccc6b3e6c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751ebb00-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393365, "uuid": "34a14af4-baab-453a-8325-9791428fb6c0", "comment": "Malware payload (Loki)", "value": "de6fc7d0e2f09392c8cb71f654630a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393365, "uuid": "9da63497-fee7-4383-b530-a43f78952f6c", "comment": "Malware payload (Loki)", "value": "d8bcf863b8af5d3a0622ab2fe468752219a1e80e85ccb1e7d29608cb49350f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393365, "uuid": "e28873b7-2ba9-42e9-85c9-0f84e549bf61", "comment": "Malware payload (Loki)", "value": "0ca91ef01e929c91cd5aff5d1623623a0d21eb76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393365, "uuid": "63685db2-6cd4-4c67-83c3-1c3637ef617e", "comment": "Malware payload (Loki)", "value": "7d6f072ec45b16f6b08a1e993a2a7e1e1d1898f13a5dd6e7dd68b2bf1f182ced47840189fe4f5420c8d16165558be354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393365, "uuid": "77783f6c-4a60-4dcf-a33e-08b39a12eeb4", "value": "T1FEF4011A37A99917C34A5470C1E345181371A9836B73D7883ECE13961E0E7EA9D8AFCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393365, "uuid": "146b7727-2a9c-4a39-9d27-9645685b5ae3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393365, "uuid": "a8f928ed-eaa1-4ce8-b226-c2da5d6f918f", "value": "12288:jEJnFe40pox9o4+QYa80uAg9P5/iEta/66briG23oEf5WNRtuDZNmLIIjMOLE4XP:I4jIzuAIrgfBEoSWYDjmUIjMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393365, "uuid": "99048b7b-ae44-4247-91b4-c97e66fdc12b", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393365, "uuid": "589d6d11-6f3a-47d9-822e-9f336e58d7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393365, "uuid": "423e47f6-0af0-4b93-b25a-74a884a263a2", "value": "Fedex Invoice-XXXXX4210-02032023073135894221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eb9aaf-c78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679363588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363588, "uuid": "68b7e1cf-64bd-43aa-a78e-f2718a675bee", "comment": "Malware payload (Smoke Loader)", "value": "0dc82954201970479ce7248911a2ac14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363588, "uuid": "b8cdb477-7fe0-4c22-8a9f-a1baa5335bdc", "comment": "Malware payload (Smoke Loader)", "value": "d8f2dc4cefb85694d686f72056cb8ad7f00bf39de2a545478e2b36f15d2f5ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363588, "uuid": "50df66e9-eb93-4ab4-9018-c2199c37046b", "comment": "Malware payload (Smoke Loader)", "value": "e57db31a85811db6531e05ddeaccc56e11534945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363588, "uuid": "8f06863d-8891-4150-8790-f14781ad03cb", "comment": "Malware payload (Smoke Loader)", "value": "f6e65d0d4373cc0c2919eec33536638b3b81de0f6c965ea2bcc08d80248117b93974d7f650bfc16b3404cb616ec4bf03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363588, "uuid": "ff99087a-8449-486c-943e-6face2509ac8", "value": "T1AF049EC392917862E4168B368E2FC2F4770EFC95CE59A756E3086B2F08BC1B2D563751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363588, "uuid": "127c1f1e-4694-4991-89e7-ff2383271921", "value": "b6299cf22bb1b2b906c76a98a991dd84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363588, "uuid": "fa81e774-7385-4185-b32c-f05e5ae1201e", "value": "3072:E0I+VUzA7IfN+5ouiUOxAGh8T4VdWW82l4/4:6WUkdouuOGhx822", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363588, "uuid": "d578bb4a-4bc3-457d-b56b-1a147de8d5f8", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363588, "uuid": "84a1ece5-059e-40b9-bbd8-3f8a11327eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363588, "uuid": "523eec38-4c19-4b7e-be9e-a36d34c67730", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cd6fd4-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389693, "uuid": "a5539814-2139-40a6-bcec-115d76ea8929", "comment": "Malware payload (Mirai)", "value": "2f513f80f3e1edfcfc172bc23d7318bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389693, "uuid": "c76d759e-1a1b-4913-9178-10cad60fb43f", "comment": "Malware payload (Mirai)", "value": "d93fbe3b594a0f857658adacdae121fadc409cd9258454350effe5e28431aea7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389693, "uuid": "6426f480-0765-4956-a640-d481ef9ad885", "comment": "Malware payload (Mirai)", "value": "e040d73acd1400369284100a5c3d62618987c4a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389693, "uuid": "aa509874-d0d1-441b-a21a-d6483c704861", "comment": "Malware payload (Mirai)", "value": "53f76eb698a7738ccd99d65bb09b9061c0793a0c560ced0f59458071f313cd0e5aaca133f7990f09aa4285d7cdeba619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389693, "uuid": "5c09a839-9f23-49da-95ec-1eca7496c8b1", "value": "T1D4A3F732A640D973D04305F212A7DB660D32FDBB1A6A9E99E36C3CB0DE360C5B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389693, "uuid": "d3ccb313-300c-493a-ba2a-6aba3a59ad9a", "value": "3072:GC2Tt66UTxHfPdj4QkhpgR8vmmFVcqq0GnDZT:GCoyBXSZgR8vmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389693, "uuid": "eb082fd3-4b5c-4ab9-93b0-e1af03e0218f", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389693, "uuid": "be2229e1-141e-40ab-8768-59a6b4263d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389693, "uuid": "406cb328-4380-45f8-a2c7-b2b38982cbf0", "value": "2f513f80f3e1edfcfc172bc23d7318bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d9d56f-c7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679378256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378256, "uuid": "25ecf238-df3d-4888-8cb3-78773d0ba5af", "comment": "Malware payload (RedLineStealer)", "value": "7b045051cd841f38caa046fa369f30d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378256, "uuid": "e0f69398-f368-480e-b9ee-3746a92dd112", "comment": "Malware payload (RedLineStealer)", "value": "d960247ea3ae337d1bcf85a7f6a872a33d60c65711dd6256be183d9985b3a7b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378256, "uuid": "db549a32-2515-4d06-a242-d74c3c54f5bd", "comment": "Malware payload (RedLineStealer)", "value": "e1d1f13375c5daae34005906ede8d77e30b62798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378256, "uuid": "13393742-c595-4d2a-8705-b6a96e2d4427", "comment": "Malware payload (RedLineStealer)", "value": "18609574c80135c4a44c7f6c7b64f8fb24280a3aa68ae644e655b3d724e10c645fef9240771ecee351ab2847a80fe8d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378256, "uuid": "0203f067-5808-40a5-b7f7-1902194a0805", "value": "T1BE45021352A27C50EB268B729E2EC6B97B5DF2304F096B6732185B5F25B05B3C263F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378256, "uuid": "0dfdda75-78f2-4a7c-934e-46f618bbccb6", "value": "d46275297bb5ddf343b2027130d69c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378256, "uuid": "5bf8f6d6-eca6-48f7-a937-2b5200b2413e", "value": "24576:zHfuxw0/qJSUswER4HdocDeBBR+7PppGoB8v06y8AQ:znxqcCcD6Bs7PbGoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679378256, "uuid": "b6cf1f7b-dd1f-483b-ac55-1d25fff72444", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679378256, "uuid": "15d32d5b-1f28-4025-b093-b6fde9b8da94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378256, "uuid": "3fe2e758-eb61-4fbc-bb3d-bb28e615a6e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14b0d24-c7cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1679392231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392231, "uuid": "45c7d7d9-7633-4b9d-b193-41efb64cf682", "comment": "Malware payload (AZORult)", "value": "e95513699fc482656195fbde55356a3e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392231, "uuid": "c7447306-2483-4bdc-ae3c-ba5260714916", "comment": "Malware payload (AZORult)", "value": "da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392231, "uuid": "9f418569-588d-4c7a-81a8-7fcaf9fff903", "comment": "Malware payload (AZORult)", "value": "0fe81c9795cf8f69900282d0f221d7bdcc6c7dc0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392231, "uuid": "6c575b9f-c3f6-4e31-8827-b2e980c36698", "comment": "Malware payload (AZORult)", "value": "6506a759f79062d020837a0a8f0d764cba4ba75f03e180ecf0a5a50d12764e282ee315d6a1ca4354899c4cfea5e19379", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392231, "uuid": "5b7112a7-2d26-4217-b849-6fd1ebbd29fe", "value": "T18465A2D2912AC84EE1CF2B75E91A6FFE8183DE24C311191F64537D0A7CF916A432E52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392231, "uuid": "91a96e59-1d79-4581-afa4-7e636138c405", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392231, "uuid": "2bb8852c-445a-43e2-ac37-68faa0b475de", "value": "6144:e71cs+BmGGNzFb8JVQzB6fx2CxwXL/O8VNkNXfY1MTrFWLrUxoooooooooooG6d3:eRcczFbUVQzUYO8VNkV5TrFed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392231, "uuid": "0e704c32-7b0a-48ea-86aa-912597d0fdef", "value": 1479168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392231, "uuid": "eeb1c5a7-4772-4163-9448-44e6d8cbc6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392231, "uuid": "c77fd7bd-f7b8-4195-b696-b3a33265932c", "value": "Company Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861a0c4c-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679393393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393393, "uuid": "ca0300db-7df5-4f34-b774-b37c3dbf7227", "comment": "Malware payload (GuLoader)", "value": "7f5a72fce10b2cdea0e20bc6fcdfc156", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393393, "uuid": "a6b17019-4747-45eb-bf93-c25c20e5c7cb", "comment": "Malware payload (GuLoader)", "value": "db19a753c3b30fefe4c2cad16fc3646fa1c4d4d3f662d1fc6e58fc8b61d44e57", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393393, "uuid": "5cf149c6-0796-4aed-8004-a8bbec1a79f8", "comment": "Malware payload (GuLoader)", "value": "2f607bb5b006a795160fa0cebafa10760aee8bf7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393393, "uuid": "d819f792-ac9b-4471-8800-1e0ea7af6574", "comment": "Malware payload (GuLoader)", "value": "bbc1d5781fa72246a748391cb9dafce3f946ea9408cd5e5e7505f14eab3057cf31a88599c749d0b81ebc819c0a003d29", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393393, "uuid": "4aa80060-1a84-4a45-b40d-4134b358b609", "value": "T11A44125361A024F7F16256F10BAD7ED5D3B9735801A0105F2BB4E7B73FC53C28A2686A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393393, "uuid": "39faa70a-9fe9-4ddd-a4de-6c0797f62a6b", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393393, "uuid": "2e2e0493-e026-457f-b82e-87b8a06a7194", "value": "6144:B6dHcc0krbiEX4jvA+DfegMY9QELC5nmkZtzJ8gfi+W87brhem:rcZrbXX4jvpbelY9QEoNZtzJ8Wi+v7br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393393, "uuid": "772eefd7-114f-4cbc-a0e6-974fd378a679", "value": 275688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393393, "uuid": "3baf9f1a-1fb3-4ae1-a99a-2d61da8135a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393393, "uuid": "c083e29d-e9d7-434b-8aac-ff43b2549255", "value": "DHLINV001267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997e7b1c-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393426, "uuid": "5eba4174-4db8-409d-95e7-78659d816c59", "comment": "Malware payload (AgentTesla)", "value": "8f9c6417c10ad2069533546db25d2a09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393426, "uuid": "30aff718-7a77-422f-a1e2-ed535991b2cf", "comment": "Malware payload (AgentTesla)", "value": "dc00a4aa9f15e37fab5f971dc7d0d253e73ab981c38650c0a5ba865cd40333bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393426, "uuid": "4b04fda9-a188-4612-8dfd-9aab96acba3e", "comment": "Malware payload (AgentTesla)", "value": "5de9727135bd67063f39bb7c12c0f2be16420578", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393426, "uuid": "3ff7c044-fc55-4a19-8b1e-60f679338985", "comment": "Malware payload (AgentTesla)", "value": "2aecc319cfdb7d7dcf50bc688fa83585d996faeadb0e1bad35dbd9a18e0b76ba26ca1684a7425f3bed02c200da72c69a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393426, "uuid": "0f58468f-3135-4b62-9e1f-ae9b4ae1ad09", "value": "T1842502707AAA4659F93B1BBE44B0615013BB6FAAA643D10D14B53ADF77333030D91A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393426, "uuid": "0c7b7212-ae9a-4839-b4f0-f35fb0b38842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393426, "uuid": "104048bd-14d0-4e8e-a66d-28a8f9c06b49", "value": "24576:3OPx3PtGzCt/TLIsVXY2XlOy2Rprt4Jv5JGc+:ePl4A0stYQ2RUJv5JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393426, "uuid": "4b174248-3ddf-489b-a2b2-00067c8bbbd5", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393426, "uuid": "ade06905-c363-4317-b0cc-3373ed9ec3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393426, "uuid": "5e30f3e3-ef87-455a-9b37-6ce88e0ff34b", "value": "DHL Original Shipment Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffcee83-c7f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679407556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407556, "uuid": "1b1a2a41-ecb9-40a4-b4fe-67402a2ba45e", "comment": "Malware payload (AgentTesla)", "value": "6d62ef994bf72f5ca8fbc72b6ef798af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407556, "uuid": "503eca4d-6dab-4cb7-a154-2ae382d1d34c", "comment": "Malware payload (AgentTesla)", "value": "dcb42fb2487eeee3ad0a36b6dd2b6ff674cb4f130db4ebffbfc6e933e18123c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407556, "uuid": "b49e368a-35da-436c-9996-e02632f26206", "comment": "Malware payload (AgentTesla)", "value": "1aec7583b7404e79b321ee6844ab6e76d5e2af4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679407556, "uuid": "0da41e25-c4f5-4fd6-b2af-aba93ff3be8e", "comment": "Malware payload (AgentTesla)", "value": "04c6fa29e82fd037cf52f5a898c721ef3e54c478f4e290b43863b32292d1ebb2557da1333437c31eeb58f5ba7ee62e62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407556, "uuid": "3423afaf-5a06-4aa9-92ff-dbe85fe6459a", "value": "T11F1518425EBB5085E8B70F38547B76880B34E963BED5903B3CC9B61A4FFA69360463D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407556, "uuid": "82dee5a0-4db2-49a1-b80e-180b8d6a66b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407556, "uuid": "adfd8b45-8aea-49fb-9922-c2071b9f10b1", "value": "12288:8OE9GqODR8Kbjf32BaKk3GZRpoqYmZ70fwnRXTIF3kX9kyp/3KrlWGy627OJ:8p90N21RZRpoqY8ueHp/38WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679407556, "uuid": "355417e0-cb3c-4df6-88c7-1e15e63c8675", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679407556, "uuid": "0b930dd4-62e0-44ce-9bfc-af96111b6adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679407556, "uuid": "c7ef5281-f33c-474c-93d7-3f35a5f7d551", "value": "new_bank_vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3963e6-c789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362959, "uuid": "ea6f517f-20a4-4b94-903e-2c69c16e252e", "comment": "Malware payload (Smoke Loader)", "value": "2b106180d693c4de5cc11dbdb413efb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362959, "uuid": "52732f73-5705-41a4-92f3-8af0ab20ff84", "comment": "Malware payload (Smoke Loader)", "value": "dd7367ac0ca5f7fe88851b8e419dce7de3c06e40d8bda6acc65842622188aeb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362959, "uuid": "930465de-4768-4ec8-9403-5dc9be0ed3ea", "comment": "Malware payload (Smoke Loader)", "value": "9574b78d53f971d25650319d831487d98b257a75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362959, "uuid": "4fa37b4f-9b90-4c2d-b4cb-ef21dc75da99", "comment": "Malware payload (Smoke Loader)", "value": "cfb3bb53fbbf9bc57f0816e8f1c23f7e6eca3e68a8ab2e5c1c2fb5f2c0e90f4524a18826b33c2bd05d86eef1f7ce9453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362959, "uuid": "59468e28-72e7-45f8-b5e1-235a01cd9710", "value": "T1B9047D139BA1BC61E412CAF19E2EC1F4B60EFCD1CE5D676E22086E2F0873161C56A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362959, "uuid": "fe7a878c-c4f2-4a09-8db8-617f7062f396", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362959, "uuid": "f1227b41-027f-41c1-88af-f169aeb4af20", "value": "3072:EoDmq3WX8XWlN+zzcVTfqH4bVnO2o2DeeYCcdgZ:QqmOzzcVrlO2o+VY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362959, "uuid": "99427de0-7323-4b7b-86b8-d176f5a317f4", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362959, "uuid": "2d9ad725-7ef4-4c4a-a6e1-d8aac46d5517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362959, "uuid": "e760ed24-6fb5-43ad-9788-1fe3ec05e577", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16cd63f-c790-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1679365951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365951, "uuid": "7892c1fb-6d78-4177-a156-513811b58783", "comment": "Malware payload (OrcusRAT)", "value": "184e63d8cc64364cc3878378e56874ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365951, "uuid": "b9b08851-4748-4869-bb12-4180362c67a5", "comment": "Malware payload (OrcusRAT)", "value": "ddad33460be1dfc2c1739e69a6be544049fb471346c489da162926ef44acfe60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365951, "uuid": "22e5d3c0-9a5f-4d3c-870a-ba820a76ce48", "comment": "Malware payload (OrcusRAT)", "value": "29b0f6419e8d44ac70f0a8a8e91175b46238d093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679365951, "uuid": "1302a5c9-eadd-4dcc-bc96-571824c4aad6", "comment": "Malware payload (OrcusRAT)", "value": "3d1c1a0fd3d26e0f71c09088d0ec941e00a68dea1ed53a8d36c1d0be452b67992063e500e5f21ceea821577fae539239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365951, "uuid": "575476ec-a205-4fe2-a197-7154dd51c7a4", "value": "T14115BF013FACBD07C1BE3679B7732ACA07B8E90A6052FB4E095451AE1D9BB01BD15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365951, "uuid": "c5df575b-bd50-475c-a1cd-ed51984acda2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365951, "uuid": "4eb2ecf6-2479-4c03-8840-7d351c98e4c3", "value": "24576:9Aw4MROxnFj3IrkxrrcI0AilFEvxHPTToo4:9WMi1UqrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679365951, "uuid": "fb71869e-951a-485a-8fdd-35bf54bb60a2", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679365951, "uuid": "efd29017-ac28-448f-a2f3-3592b3cce970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679365951, "uuid": "685c736d-fe2d-488d-a4f1-e01a54bae0a9", "value": "muff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8658636a-c7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679401983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401983, "uuid": "d0d94e69-c335-4d2f-9c29-b09c85d74124", "comment": "Malware payload (GuLoader)", "value": "ff6acdd6bacbef7565b628d04440887a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401983, "uuid": "98135fa2-5250-47ad-a862-55bc0566184e", "comment": "Malware payload (GuLoader)", "value": "ddb85289a979cc5af18e8e6082830f1815f9ace54a8cdcb0765b029cf50d0ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401983, "uuid": "fd2481d1-cb73-4237-be3a-6ed4c75b4cfe", "comment": "Malware payload (GuLoader)", "value": "728ff09cba264b720e54e856a81c3bcc898efdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679401983, "uuid": "8b3e13c3-be82-43a5-b56c-229a796894e3", "comment": "Malware payload (GuLoader)", "value": "0c954eec90d7992041884ad4e6a70ffbeca0027af3ef16172ea414ce0e865439de4ad7a9fad7e1138d80a473519aa810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401983, "uuid": "3307d480-f875-42d1-a56b-566225c81398", "value": "T1388401D3518444ABEE920BB18873AD1561BBBD3C39B0E54E5B5ABA726F732C35013C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401983, "uuid": "49bbc04f-e693-43eb-819d-8ff96e310cdb", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401983, "uuid": "9bf3f6ed-c860-484e-b1a1-837ace2b6caa", "value": "6144:y6d6ryCbi6j6od7R6JQW06Jei7uyrpnEPwrhIjk+06dZO:myKi0F7R6K5S9RrpnLrak+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679401983, "uuid": "3eed95d7-dab0-447f-baf8-086d664a9a32", "value": 391936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679401983, "uuid": "332a4f0c-9694-4a8b-8b7d-8a9356d022fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679401983, "uuid": "4bb9e93a-a485-4daf-8ee4-35ca1acdcf70", "value": "Scan pictures.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b2fcb7-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362304, "uuid": "279e8e5a-3ca8-4bed-9e26-7cd5b71f8eff", "comment": "Malware payload (Smoke Loader)", "value": "b8e39868d1d20d3359654579da7a9f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362304, "uuid": "83329f5c-27d5-4720-b4ff-de94df07102c", "comment": "Malware payload (Smoke Loader)", "value": "ded4d2b27385aaf986ac59f59c2c3c299c3c90d7b8f3c640c6121536d0d90fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362304, "uuid": "cbe772fc-a871-4ba5-8c6d-3e315fbab904", "comment": "Malware payload (Smoke Loader)", "value": "188ee80886b198a61f019d0ba2af8971d164cf10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362304, "uuid": "1f8bade6-6665-4298-8881-545d8e732c3b", "comment": "Malware payload (Smoke Loader)", "value": "c828a9262d86f526fea5774682bf81fe4e50a1ca796aae0645bc35f2a9e46eb1724d13d11c1d50d05d6282c6d303cb8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362304, "uuid": "d0fddbdc-c2cb-449d-b3b1-a9e5aee05c2b", "value": "T120049E9396A06C61F421CBF28E2AC1F4B61EFCD1CE5D676E72046E2F0873161C5A67D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362304, "uuid": "24a242e7-e42e-4172-b088-72b0db0c3907", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362304, "uuid": "7b1c2d55-8215-4cfc-9e82-f903817bb665", "value": "3072:2C1wYlQD4MfuNW8tcKbu74qY8ehYga5JJSR1R1oZ:DXleCTy74dVnaXJS51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362304, "uuid": "c5e8faff-d46d-4157-8b05-3f6bb31edba9", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362304, "uuid": "d4e70f9a-c8f1-4925-b557-7e623d40df41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362304, "uuid": "5d391262-9ff3-4acb-b208-c12b78e02b91", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d61509-c79d-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1679371520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371520, "uuid": "d9d56339-83b3-430f-9ae3-913adfba80cc", "comment": "Malware payload (WSHRAT)", "value": "8eb05c68a5880d8f15fa787b02192709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371520, "uuid": "80d6ff9c-8031-4ae9-a11d-81dfc8ebf0be", "comment": "Malware payload (WSHRAT)", "value": "df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371520, "uuid": "68fd0f26-a94a-4939-88e1-3c79d27c4c24", "comment": "Malware payload (WSHRAT)", "value": "45813931de14ac2f4f66d412caf9cf6fd236c5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679371520, "uuid": "f7a19629-ec0e-4ec2-9dd0-ab1c99dd85eb", "comment": "Malware payload (WSHRAT)", "value": "5c770f238b2ac061c3ac08a52c18ddc433a52e052478917bb72890c0018f2a7c0a3002cf7ffaf8960b37e3f75f5b13b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371520, "uuid": "d7abf542-6bc2-48ed-8d94-4d0927cb0fc7", "value": "T139A4236C28DDE9A2D461933128B1A327F7F3875F209981170F855F7BBB604CECB09596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371520, "uuid": "2c09ab0a-231e-4fc2-9bec-14da31bd3f97", "value": "ab6770b0a8635b9d92a5838920cfe770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371520, "uuid": "acde4cb4-33b7-4742-855f-827a6f208c77", "value": "12288:BjKiWwykMpBMs3qLVmNwCIWaONK6ezkf4BBe/wKA3JIOb2:Bj5bMpf6L2wzWnW38zA3Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679371520, "uuid": "c9c82278-f3a6-41b2-a966-e337d64cc62e", "value": 462845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679371520, "uuid": "c0883711-80eb-49e3-a3d1-e0bf3afa737c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679371520, "uuid": "a9e477f9-4e33-4eea-852e-571fae60a03e", "value": "DF15669F7F948ABD95D1A4C326AA0443F0CC534513B25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01e4825-c788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679362513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362513, "uuid": "e8d98593-c9de-43fe-9151-9ff33b36700f", "comment": "Malware payload (Smoke Loader)", "value": "9fd7b705a23a00ced0e92b3c6986f4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362513, "uuid": "86fda5fe-b441-4a44-9542-b0c0d7d68815", "comment": "Malware payload (Smoke Loader)", "value": "df635f4629823d3cb105d4f0abfa1f7731f373f76ffab52e3b985ce506bde541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362513, "uuid": "ed12e99d-ea94-4bcb-a556-5c6c244358fb", "comment": "Malware payload (Smoke Loader)", "value": "140a0160b852c8ecefdb7ace50d8606b70a1450d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679362513, "uuid": "721aef9f-222c-4902-b2e4-1e82b13de3ac", "comment": "Malware payload (Smoke Loader)", "value": "4a483f2e9b4c993b4f9ca6f490e54977bd9d29cb1333e57eb8f62585b9980642bc44388cfe6ba082d79577489c8ccb56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362513, "uuid": "97aeb7c0-57c7-4d49-a62f-4b948fc3ea16", "value": "T11F048E035B90BC91E522CAF25E2EC2E4B61EF9D1CE6D676E32046E1F0CB3162C5667D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362513, "uuid": "e8842f0f-2444-4590-b703-f5e866e3f3c2", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362513, "uuid": "3040f380-c0be-4ad2-b99d-0588777726e7", "value": "3072:5O1ERRcfFCZDNWOhv7HUBYDnm7J+c/wGBRTZBfZ:cORqSHH7q/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679362513, "uuid": "324af5c9-2714-4fa0-914e-23161fed5fcc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679362513, "uuid": "0297c5d1-98d8-4e0c-8810-bf916d7ca574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679362513, "uuid": "f5ce79bd-e935-499e-829d-67a012f91ec8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89efd73-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392672, "uuid": "13fc6b49-5c91-4d92-979e-37c11d7c2437", "comment": "Malware payload (SnakeKeylogger)", "value": "810cd6b375c5819a6e1af4ed15072400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392672, "uuid": "09196e77-1ecd-4fda-999f-a013b5c6b762", "comment": "Malware payload (SnakeKeylogger)", "value": "dfb272669ddf81bea955bf23038984ee46e1e6a86c4c19dad99e200b49a0a9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392672, "uuid": "285bdd40-e76a-4e6e-a0d2-1f4bc97fa9d3", "comment": "Malware payload (SnakeKeylogger)", "value": "0e247a435e1c885623afd78923766756b3716c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392672, "uuid": "5e95cdbb-24f6-4cce-b211-67fee9d42eb0", "comment": "Malware payload (SnakeKeylogger)", "value": "edf2b5575273f3124508003aa9cd52675682b539492bd8acbb0cc826e9733da84822f42862b8ba01c83b8fe5dea43c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392672, "uuid": "5162485d-1114-47bb-9c63-42c5ba6ad563", "value": "T10E150132AABB533AF63A57BF91A12641A77E73A36703D54D0CB101C84767B060FC2667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392672, "uuid": "faa4a5f4-0241-48d4-98d1-868d87557720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392672, "uuid": "ede62948-cb26-4f2b-8058-19fc0cfe3d8a", "value": "24576:QZXwIguXRHrydEbbeBO8VPWfvlivCzKNYCbJ:n4BzbboMvkhGCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392672, "uuid": "8ddb40ab-3554-4a01-a375-854d8768f410", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392672, "uuid": "e49d070e-2e47-45e0-a1db-13d63712158b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392672, "uuid": "c2487645-dd9b-4c2f-9922-3259a85859b3", "value": "Proof of payment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f431b9e-c7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679406750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406750, "uuid": "c89cadd8-0048-4e89-abce-fb0134d9fc3e", "comment": "Malware payload", "value": "ff7ffbf4009d85e704d3e9a67c2dfe0c", "object_relation": "md5", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "stage", "colour": "#42A1D8", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406750, "uuid": "5a717d84-4902-4efa-98fb-390e0ac538b5", "comment": "Malware payload", "value": "e149346625c6757b0589a5f9ae597468d9197f4181bbebc6a002949718c0950f", "object_relation": "sha256", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "stage", "colour": "#42A1D8", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406750, "uuid": "1a89c949-30a5-4719-89c2-a127ef43869f", "comment": "Malware payload", "value": "b6082521f47190b8e997a73f9d21e1a68ccb5b6a", "object_relation": "sha1", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "stage", "colour": "#42A1D8", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679406750, "uuid": "05529e7a-a20f-4c9f-ba52-b9426db87a56", "comment": "Malware payload", "value": "3f86a7f00ad2f6465a2164448d88201b64543f346a48a4c9bff5ded3ae8e239d2c7ab88475286f196dcf43ae5b4eaea6", "object_relation": "sha3-384", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "megabiger-com", "colour": "#5B3870", "exportable": true, "hide_tag": false }, { "name": "stage", "colour": "#42A1D8", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406750, "uuid": "8d0ca606-cab3-4708-82b9-7ba2a72ad5de", "value": "T1F6E2BE161D578346FE9D2FCD4E2897666CEC0DF9A71CE5C608A274072882B092F62E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406750, "uuid": "a5ab46a8-c401-4006-a27f-a44e51670d11", "value": "768:0m3elEEEEg4JbB9LSNhsqIZT/S0U30U+6DFQK:0fgcWEqIZbS0UzbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679406750, "uuid": "31f3fc97-20db-420a-8722-8931f859f2d7", "value": 33668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679406750, "uuid": "bdf4df23-8e6d-4204-8542-6c9ef105b7c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679406750, "uuid": "c5e3e65b-746b-41d7-9a6e-d34711fadcbb", "value": "documento.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4229824-c837-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679437682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679437682, "uuid": "9afd0fb5-598b-4953-8a45-0f15f4204899", "comment": "Malware payload", "value": "b1a10568aa1e4a47ad2aa35788edc0af", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679437682, "uuid": "24be2ce4-3be0-468f-a817-1250826a3090", "comment": "Malware payload", "value": "e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679437682, "uuid": "694cd1c5-2105-4c16-ab9f-161497872089", "comment": "Malware payload", "value": "dd6ba6ae1680e4245f5ecc22ee12a18b9e16db2d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679437682, "uuid": "bf0c1c18-2a9b-4a58-b0c7-a73185250643", "comment": "Malware payload", "value": "fd0be759f888fc7c5a34ddd98f80b848e18d26eb9dcf79e83f9533850c234f120f0e3c58cdcda30ac0c71e019ed9e493", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679437682, "uuid": "a8bc5688-3189-4ab8-bf5d-8ee4d67ece62", "value": "T1FE546C2AD7D018A3E55A0631624B6A9251B718736558CF0E13CFF38E2F97B70EEB1C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679437682, "uuid": "5db8b540-e3d9-45b7-9cac-f0c04b44b01e", "value": "3072:e57pvc2vetOepE76wtghUVkJlD1HUjCuitewu4UhKg+jbJDDO7UckjjwQV:u1veXwtVElijRLwuzKg+jb1UkUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679437682, "uuid": "d6d873bb-4699-41ee-b0d4-eacefb919e35", "value": 287696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679437682, "uuid": "aee977df-addd-42bc-a6f3-6b40b382325c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679437682, "uuid": "f6bce173-9d78-4043-9e0c-7c4cedb4ac19", "value": "03.21.2023.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96efb895-c7bb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679384402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384402, "uuid": "6a774e48-9c3f-4062-be48-e9fe5efa386e", "comment": "Malware payload", "value": "257b948a8e52bbb085b1ff6f1e136e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384402, "uuid": "3f4b2c87-038c-4ae1-a520-87452e1e177d", "comment": "Malware payload", "value": "e297f61f94f4a71f9b70309a115fee62711dc72a66d33a9709e5cff71a234da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384402, "uuid": "1511e5f0-cff7-4042-8f30-2c2a5e92ecc1", "comment": "Malware payload", "value": "e1180e9fcdda03ae42a84d1683a62d3889e3b72f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679384402, "uuid": "1acf815a-35e2-4da3-b5a5-38b2ba048db1", "comment": "Malware payload", "value": "ac5c146ad5854c83f1d193392321907febe2876a69dde8a1d660d6705dbc6f54ece1c24b63d9eea289fab5e0bd0001ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "youtube", "colour": "#C0150A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384402, "uuid": "d9675a33-c6e9-4a84-8bbc-a1d6bfc5319e", "value": "T15BC4CF41B6C284F2C9351D334D14D7310BBEAE208D65C8EF73F64AABDF706D2AA19916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384402, "uuid": "8db3b209-9747-4f2f-97ac-b1a33ed2feb1", "value": "a733622aec00fdd5370c5273a21113f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384402, "uuid": "063d4a45-dd2a-41ac-885f-902b81815ebb", "value": "12288:BDSW/dI9mMb/AjPhfwVr7k4y9tI17hSE6:D/d3fw5PMyNh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679384402, "uuid": "e310a24d-a594-414c-ad1c-1b2348f6836e", "value": 555532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679384402, "uuid": "b04806e8-389f-4c64-9f16-3ad85ff385cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679384402, "uuid": "183c84f5-e69e-43aa-82fe-ed96445f77aa", "value": "Setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086d1a70-c7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679376432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376432, "uuid": "f121a13a-ceff-45b0-b448-a4cf67562dbe", "comment": "Malware payload (RedLineStealer)", "value": "119fdbd248c8ef5bb893dd3acc0238de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376432, "uuid": "5ee0651d-7a18-48f3-a61e-9384ab4ef383", "comment": "Malware payload (RedLineStealer)", "value": "e2e138502ef3e8e83dbbf02d02db73b021e383e592b39f3b658f68446a963da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376432, "uuid": "7a32fb26-02eb-4056-aa7e-b2031e151854", "comment": "Malware payload (RedLineStealer)", "value": "4e1fcc7248748a44519aa2b62fb5191aeacba1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679376432, "uuid": "878d4c9e-2e3a-4b10-989c-0b5f04f8f7bb", "comment": "Malware payload (RedLineStealer)", "value": "3415b38233aa73853e33bafb99aa4982c22c872660e1ad82f843597ebea59e59cfdd6dc109102c1e54d9a8340e883d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376432, "uuid": "a5fc4eeb-b7d4-4a54-aa2e-026f3f1f725b", "value": "T16135120247B1B921E5238BF18E6587D0A61FFAD2DC6D276E3218DE1F0873252D176BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376432, "uuid": "1bed7fda-dcc0-47b2-a48d-11392541a5d3", "value": "ca355b09021bdc6df9b31e9df58406c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376432, "uuid": "c8fe39cb-dc1d-4172-8965-00d11dbede7c", "value": "24576:mx9AMUUdzbF054Lzkiun+WcEtB/PWwufJzW16hK+wyzWY:mBl24B+JHWwkJzW1oRwyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679376432, "uuid": "f7ec9986-4506-42d3-a9c1-bb513c1583ab", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679376432, "uuid": "52d5b153-922e-45fc-97ef-c5be90586a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679376432, "uuid": "189761cf-71b3-4697-8f40-852d1e05d57d", "value": "SecuriteInfo.com.Variant.Mikey.145680.25705.20743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c2dafd-c826-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679430484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679430484, "uuid": "8a5bb526-1db2-4c34-95b5-c5507f805529", "comment": "Malware payload", "value": "a966945076f3ac5eb3282a0d1dc2101b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679430484, "uuid": "3fc4fe97-ff47-4761-82da-773a40f6e8a9", "comment": "Malware payload", "value": "e33b554abd174a255530352bf7e640f04935eae8bee36034914c131e99c6c339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679430484, "uuid": "acea9b97-290c-40e5-978e-fb09f46c7f68", "comment": "Malware payload", "value": "71c4936cd89ec51e5d8988e6736d9584d6a18b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679430484, "uuid": "77554bba-8f40-46fe-b350-46da7552c7c7", "comment": "Malware payload", "value": "03c66676b63c6e6453e743d8d33a77c5fc1af8d985787075974e4193c084d556c74e7988fe8657663fbb645162a60e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679430484, "uuid": "7ad382a5-416a-4048-9c55-e7ff22d7fcb5", "value": "T1CCA4E15A4809E438EB4B87B021A3DA132D7DD0F902EFD58AE7D505C50B4ABF8F45AE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679430484, "uuid": "98ca395b-1715-4232-ad7e-2263850e95f4", "value": "ae02ebc1e8c04c1e04fbf9093bdee9f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679430484, "uuid": "850f8396-eaab-4a59-9b31-bc8da7ad67b3", "value": "12288:NdBCCL9DFn7TvTswnmsyzNkv4Yp2yYiL39g:NdBCCL9DF7Trswcw4k24g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679430484, "uuid": "8a78f0c6-4f16-42fc-99bd-53c474146b2d", "value": 468230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679430484, "uuid": "a930c60c-0de3-4a4d-b7d9-b1a944c7083f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679430484, "uuid": "4325ffbc-b25d-4614-bc86-e85d5fbe4989", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19759db5-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679398794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398794, "uuid": "b34706f8-9621-4420-a42f-adfd23640e47", "comment": "Malware payload", "value": "1bac2e90dc029f8e231b975a926d316e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398794, "uuid": "d93ebeb2-e527-4ca2-980f-4fb864ba2907", "comment": "Malware payload", "value": "e33edc5b1840e9628f8d82cf9d32e42f43158472c0f38769d8c37f27cdbb4db2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398794, "uuid": "dea11ff7-1827-4fb9-95fa-b3754f7e5699", "comment": "Malware payload", "value": "258d536621f858eb36961f931ff0b9b8c5f5e6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398794, "uuid": "14de5e9b-7150-4bee-b247-5304cc43009b", "comment": "Malware payload", "value": "1df367dfbedcc9a984b8835ade459d429c4c11fdc1b403ad3143d9f08b04026b8b4a7d8c619912829e3ac43557b48379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398794, "uuid": "cf1c702b-d95b-4502-a552-da1d2a456f0d", "value": "T1F256335823A408F9FE7A943AC562060ED6D0F892A754C16F43589ABB0F77BE07D7B710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398794, "uuid": "6b75abc6-fb81-461b-81c8-90ed6bdb2daf", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398794, "uuid": "a80b009d-fe70-46f7-b03c-9eac2845b74b", "value": "98304:t2vLdnkAXQWwPpEfpy/ijzb71QGQCPDbZfx8uOqV6lXaNC51Bu3rqkVpKAzXlN37:tALaAXYWyqXdQmRJ8dA6lXCy1ArqkVpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398794, "uuid": "e5202e11-5812-419a-8155-3dd370508cc0", "value": 6186250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398794, "uuid": "3ff72ed5-673c-45e3-b277-f10b133fabb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398794, "uuid": "c73e3561-87e7-4e4e-a5df-6d8fcfa6c776", "value": "1bac2e90dc029f8e231b975a926d316e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565efde6-c7ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679404480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404480, "uuid": "69c48e29-8af1-428b-b198-f8cf19ac9d1a", "comment": "Malware payload (AgentTesla)", "value": "74c19f1bc6b945e189f9bef5b4d9e3a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404480, "uuid": "c3c99f06-543e-4aee-b0fc-02c339b91d13", "comment": "Malware payload (AgentTesla)", "value": "e3af30d7f34d716ab2e9aa6aed7f10e04f99b804b33f9cba851ab27bfa7a2390", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404480, "uuid": "9d534972-387f-4753-9b8a-d002585a1a6b", "comment": "Malware payload (AgentTesla)", "value": "1584b2f36c819f1c4c32b94bbf29ebc12a8ee885", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679404480, "uuid": "2c1015e6-5eb2-4b4a-8d93-01ccf02f96d3", "comment": "Malware payload (AgentTesla)", "value": "97f2acce2337e3c9ed55141ad0d9df577cdaa8c7595ddec500ea4527718234e30cd4333cd0126eddaf7e185009277c3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404480, "uuid": "27d0acad-7097-43f9-a7f3-ebec14f0df3a", "value": "T108A4122822D32753ED6CD3FBF66A636087F56A2610A6FAD15CC299C749C33405781F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404480, "uuid": "be070d95-3ab2-4d15-a7da-ae380a16cdee", "value": "6144:8TEVAj5rieQXnEhTST21QHI3U4GzEN08fMRk21JEl8yPOD0di+jpPRJQAQe4nCVy:oS8uKNnU/18EeZlNPOyZRuAQiAccD7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679404480, "uuid": "2ff751f3-5a22-4f4d-aaa2-be97c023093e", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679404480, "uuid": "f8ba44cf-4201-416a-a4ba-2515d7c01b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679404480, "uuid": "8f126622-9e60-4307-a839-bcedc4c494a0", "value": "p004575839574947i48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ec9572-c78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679363355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363355, "uuid": "4ae84df9-b1c1-45a3-bbd2-51f6664d36ba", "comment": "Malware payload (RedLineStealer)", "value": "845cdb48c99f7a79ed1a25e74164db60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363355, "uuid": "676adb03-c98c-462e-a705-76f1594f309b", "comment": "Malware payload (RedLineStealer)", "value": "e4169cdd8170b82e2d75f368a8740561a533b047de2f4219147453279f176e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363355, "uuid": "9e1803f6-bbe9-4d7c-aed3-cef07fcf01ed", "comment": "Malware payload (RedLineStealer)", "value": "dbeb42a162d2ca279d57d4b06e1f6d38c217d67e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679363355, "uuid": "71879a41-8683-4678-90e1-0ab631d83cd6", "comment": "Malware payload (RedLineStealer)", "value": "42762144e0f87339be5e9c4d67301c5bc9d82d1900c10f7099693f320e4e6c0b81fe13bda5e568086701e4ecec6e4ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363355, "uuid": "a93c68a3-04e3-456e-8f03-8b9249b7a047", "value": "T168047D135AA0B851E416CAF59E2AC1B4F60EFCD1CE5D6BBE33046E2F08B3162C5667D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363355, "uuid": "930cd973-a25e-4f55-bd24-72f2f8cffece", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363355, "uuid": "34b12462-133a-4442-9545-81ff15571f95", "value": "3072:nMPgC23s0W6WEd1IOlf2PXqx0lm+lagn1sItZ:zCEsi+PAc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679363355, "uuid": "c28afdbf-92f9-45ff-b90b-dc3d80677bc0", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679363355, "uuid": "a8169860-770c-432a-ab85-d239d6a7fd03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679363355, "uuid": "26e32083-c23f-4120-95ff-223298f9d443", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1450bc51-c7cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1679391914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391914, "uuid": "069fe258-c729-4767-9ec4-e4be016f8f15", "comment": "Malware payload (LummaStealer)", "value": "c6e68eb8a3bcae30c16eb1fbaa75f2be", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391914, "uuid": "8cdafed8-152f-4d58-add5-27ab455c19ae", "comment": "Malware payload (LummaStealer)", "value": "e49cd4e3394a954621fb820e36cc86b933538306fbda873cf2000a33fe1e8db1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391914, "uuid": "d8d87d34-4df7-453e-bf24-801146846e20", "comment": "Malware payload (LummaStealer)", "value": "933b14f0ef18bad1d7ddd82b2c012c3dc510d80a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679391914, "uuid": "58347e91-acec-422e-b609-bccdd46bc69a", "comment": "Malware payload (LummaStealer)", "value": "f9c31917d75498b0a1a7e233e7863dd8cab4e36e827f60bb5b53c5c4c0b901ea8906d0099a655538ce98a7f729999a6a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pcworldgetin-net", "colour": "#74E5D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391914, "uuid": "1e9c060d-00c7-4bc7-be89-2d614a700d7a", "value": "T13182AEBCE86CEC90DE91DAB51D21D3C41E56FB2445F934EB31543AA19CB340082A2EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391914, "uuid": "a7f05d67-314d-405e-b572-7760bc019483", "value": "384:BuxSDrAxSD3LjQuhGRiwsoaZUpfXXNPW+H3xTHhHcK99oFvasnXmwD:UxgrAxg3L8xRiwsoE2nHH3xTHEasXzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679391914, "uuid": "76214dc2-4f72-454f-a374-a95103bfe9ed", "value": 18999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679391914, "uuid": "ee8ca457-0110-4ad9-a960-4438df877d13", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679391914, "uuid": "456d690c-af6d-461e-b6ae-1d31572c2ddb", "value": "c2sock.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7f638f-c7f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679410401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410401, "uuid": "cd79cf7e-33c4-41ef-ada3-f54a7e425e10", "comment": "Malware payload (AgentTesla)", "value": "66fee78a5766bdc6eba36de7ee05018d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410401, "uuid": "df182557-92b4-4470-af51-896118024e26", "comment": "Malware payload (AgentTesla)", "value": "e55ca74b486500a84610ce9cc300aa83aa6d34953d82b2bbf1b7a4dfab0b1098", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410401, "uuid": "9a43d16a-66b5-447a-8577-aebc1f50870c", "comment": "Malware payload (AgentTesla)", "value": "222d40a32f0c577e7cc535188c1adb8773053b04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679410401, "uuid": "94088ed4-2a30-471c-a9cf-bc60e0190644", "comment": "Malware payload (AgentTesla)", "value": "bb73173148e29807284513afcc843d69a15b99e57e50d9b0f4086a18110c26bebb3bea2f67b1dc86abe9f77812b30d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410401, "uuid": "fef08cee-9b82-4907-aa86-c7b3905b9b9c", "value": "T11415F058BA98DB05C53E0BFAE43050F043736C29D512E75B9ECD7CEA3D727858A0AA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410401, "uuid": "025b4f2b-1d8c-4395-927d-0f6663517c6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410401, "uuid": "421301ce-3775-4084-a42d-8ae8e3fd4a56", "value": "24576:al+yynEmDKw5Y39qMpAUPxVQMqAMmZaGrgjT:anY/VMpzP7QkzZgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679410401, "uuid": "0448d933-1246-40cb-9db7-6ce3b885be57", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679410401, "uuid": "12452147-ba87-4f7b-b493-ca980304302d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679410401, "uuid": "bfc9caee-29f6-4101-812c-97e930b6d47f", "value": "SOA Mar2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70d4058-c7b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679382335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382335, "uuid": "9e91cfc5-77ec-4c65-9e71-38d6dbd2f91f", "comment": "Malware payload (Formbook)", "value": "03ecb3a5a2aff490f00d04a40f53c194", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382335, "uuid": "3c43d63d-fc17-43e5-83ad-dcab67c6f569", "comment": "Malware payload (Formbook)", "value": "e5dcec3e5e5f9efeb20bdc63ef435653560e9704e2895ae77457266c7ec8ff3b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382335, "uuid": "f1d31a53-3162-48c0-ac16-3d7e7ee0b7a6", "comment": "Malware payload (Formbook)", "value": "a6e5d701b6d23323b9937aa9a37b04f5113050a3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679382335, "uuid": "18f370c6-e1ab-4e73-98ab-5224e55ae1c5", "comment": "Malware payload (Formbook)", "value": "97dd5ad7f645c99b6ca119290519aa468a6d5542a75d72d85c10678905ad7d639fb138ee86f260d653540196f393e5e8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382335, "uuid": "98a2ccb5-9c4d-402c-8e58-a22aabfebab8", "value": "T1CF3422B692FE22A355D5E52341776ABC0DAB38F346BF5BE0520342E2863235104E76E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382335, "uuid": "a7532ab1-165f-4448-8513-0719cbdfb42b", "value": "6144:BT5pa12DjxD1gb+rnMtB0jAD8adcNEuYUTOEqqNWAh3fLxmIui12:bC2DC+Tq08DLeuuYSTdPVdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679382335, "uuid": "26912100-8b12-4363-9334-2827dc315004", "value": 239709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679382335, "uuid": "637daa72-8793-46de-beec-bee7a2bec715", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679382335, "uuid": "c0394380-1bda-4da8-ba13-62fdb6ceb1a8", "value": "DHL Notice_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2126e19a-c7fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1679412551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412551, "uuid": "6b3be93a-3ae0-4b03-8293-cd79151c4d51", "comment": "Malware payload (Guildma)", "value": "193d79f2e2675d899586abf11d8536fe", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412551, "uuid": "2735181e-446d-461b-bde1-ee883e610338", "comment": "Malware payload (Guildma)", "value": "ea0d9467f32d001123d6f5c799640544e9095ddaa9088fedd4f0ce9beaaa835d", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412551, "uuid": "22707ed9-e5ba-4661-b58b-41868cfaea39", "comment": "Malware payload (Guildma)", "value": "99e1a5a0a7405d0dee4bf44ba2942cbdfaf8e189", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679412551, "uuid": "88637c5c-6b3e-411f-a949-31c515938f19", "comment": "Malware payload (Guildma)", "value": "d81b29a1825f3e93fa2404bfd86bf607e2f67c867e1860121409a5d468d7d8d1f37ea749582737abd54e550d19c7223a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412551, "uuid": "0b5d256e-bbc9-41a1-ae52-b8c8c78af05a", "value": "T195D2129D310BB7D726B193A2DBF70209F317907399249D52F89C89D21D7822823B5EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412551, "uuid": "64627ccb-9d73-4171-933f-010c5f673b70", "value": "768:zwjyTSrRj410XhULKCqB+h68dalIux6Ki:zwfSii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679412551, "uuid": "5502db23-23be-4491-aa2b-814eff767565", "value": 30334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679412551, "uuid": "c488690a-3590-4406-b153-de6e523791f8", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679412551, "uuid": "743239e0-f60e-4cf5-b921-31cb8d0dbbb8", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ce556b-c7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679389339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389339, "uuid": "9f2971fa-ae29-45b7-801c-d243d047f0e1", "comment": "Malware payload (Mirai)", "value": "723da50f4df1235c3669184fa5e26330", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389339, "uuid": "037fea64-4937-4f3a-92b0-7d6528d83373", "comment": "Malware payload (Mirai)", "value": "ea90699a0a702614fd8f533961a45c1c3d1c0ea1da96ccbba4ea745e640bebe6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389339, "uuid": "55700d0d-81cb-45f5-8b1a-ea467b99189a", "comment": "Malware payload (Mirai)", "value": "78a2a2bca0c788adf0cf2dc9e69e5b841d3675be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679389339, "uuid": "0b1cb004-3b8e-4098-9c5e-2410bc21d571", "comment": "Malware payload (Mirai)", "value": "b1d5aae75064bb42aafdde1faacdfd54c0542ee147bf3f8bd246b6af78bef698d6ab2d64899088f96b66af017c0f83f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389339, "uuid": "201e7638-6b79-4321-99f4-dd405ed210e3", "value": "T16AE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389339, "uuid": "dd32fd03-4651-4308-a8ec-861126b7f1aa", "value": "3072:nWhzYxYCS1bxmjwLkqkmksQnGXmrThPaLEnvPrNb:WhUe4uk9GXmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679389339, "uuid": "4d8fb9fa-77c3-4466-b787-5e62c105ea7c", "value": 155524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679389339, "uuid": "e93691a0-2997-453a-83d8-c4f139ed1619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679389339, "uuid": "39caad37-35fa-48b4-91d3-89b45a682bec", "value": "723da50f4df1235c3669184fa5e26330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25173169-c7a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Conti)", "timestamp": 1679374762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374762, "uuid": "e8551c33-2285-4a2c-a7c3-50c85229b841", "comment": "Malware payload (Conti)", "value": "b7b5e1253710d8927cbe07d52d2d2e10", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374762, "uuid": "3d9f70ca-e498-4ed8-b114-194cd9a6a2b5", "comment": "Malware payload (Conti)", "value": "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374762, "uuid": "81c8104e-7e3f-433d-a2b4-487d7a1bcd8e", "comment": "Malware payload (Conti)", "value": "596f1fdb5a3de40cccfe1d8183692928b94b8afb", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679374762, "uuid": "48f5188a-fff8-4176-bbcc-5f4f9f39f521", "comment": "Malware payload (Conti)", "value": "3e2aa12a77e0aa4d84d45041fb092329d701af6e72d20a728c7ae3ff840a72b4bf433348fc369f0351962efddfa628f8", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374762, "uuid": "0d4d1f31-14e9-40ca-ac78-584f87b71943", "value": "T1C1A38145630D1BEDF69EA4B5A6A93C3364CA583C139F85FBFBC684451582BC220B4F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374762, "uuid": "8d85fa42-eb72-4310-9f3a-5692239849e7", "value": "30fe3f044289487cddc09bfb16ee1fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374762, "uuid": "4dfff809-62c7-4e6c-a142-ab2bf87a63e8", "value": "1536:YzkzMy2546PtngS719+T0gdGpwW2XtaJp7fd8OUfB4VH9qNwpWblz:RX2C29+4g8wW2XtO7l8OUGx9qNwp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679374762, "uuid": "e3c30175-6a2d-405c-832a-21b77b37881d", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679374762, "uuid": "5fe9b26b-106b-425a-8c9a-adce4e4cfc97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679374762, "uuid": "134ad71e-12e9-457f-9317-9c78f7843efc", "value": "Tauryu1Exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80eda70f-c80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679418725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418725, "uuid": "33f2295b-f0d7-419c-8a6e-cd3092a2cb9a", "comment": "Malware payload", "value": "24a282981a7a557b4b4cdac41c0c9644", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418725, "uuid": "ae5a2d4b-7363-40ad-8282-e96b244f4d5e", "comment": "Malware payload", "value": "eb8602a16232ab4821667b19e1354071946243437e1b9fddb4ebaa6250518eee", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418725, "uuid": "eb987a12-00a4-415e-b281-1c7aaa549367", "comment": "Malware payload", "value": "1936d19ff1409dc39c16a204ba77dbc43ed3dc95", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679418725, "uuid": "5c9d73a5-879b-4aeb-908d-5a27494a3b82", "comment": "Malware payload", "value": "0c8ce8a4db3ee8ae136172e9de70884f1932e95df1cfd74fe30e89aba8abfa16e19cbe66c511062cc904b54c2c6f23cb", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418725, "uuid": "fce8098f-96dd-45b9-bd2f-a12e24136291", "value": "T1D9563947F89095E8C1EDD23086269263BA717C895B3023D33B60F7B82B77BD46A79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418725, "uuid": "ad755063-28a8-44e5-924a-ef890860faac", "value": "49152:1nSxxm+huxbQdcrb/TwvO90d7HjmAFd4A64nsfJXkXGzZlib5ojdc/SP5UjJmPJN:AO8ClgvJf2zEGMlEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679418725, "uuid": "efe2b12b-e19a-4370-b156-d919007c63d6", "value": 5959680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679418725, "uuid": "f7e680b8-ed57-465f-a691-31287922e635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679418725, "uuid": "fb623779-a693-4961-b7ba-f0df10cf2928", "value": "dosia_app_linux_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d92f82b-c7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679393674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393674, "uuid": "90221593-c097-4b15-abdf-5b67f62c18b5", "comment": "Malware payload (AgentTesla)", "value": "93a16bc4ac57dcd56d0aba0c3d526e3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393674, "uuid": "538af282-6746-4a8c-a3cc-58be8b6544c3", "comment": "Malware payload (AgentTesla)", "value": "ed62018b45dbd359db4010e4728f21cc158edf5bf23b302a7a3d86d9eb9b06f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393674, "uuid": "ac629865-d76f-4295-af80-03d4cc9a4b8b", "comment": "Malware payload (AgentTesla)", "value": "a379be766803fa4e05002883b056e737eb854556", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393674, "uuid": "5892bacf-e319-48d4-83d7-4fb9d4714214", "comment": "Malware payload (AgentTesla)", "value": "0a773598be9d770bffde20ffcc9396e2ab69d395ee15d708a72887cc784705bc830e614fc500d7f0ac0b1605289c06d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393674, "uuid": "56f93d03-cead-494b-bf4a-715101b760c8", "value": "T13164ED5234E9040823E1AE43AF67FA5DAB77F1D78D392E5D94CC0D9AB3DE9018422BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393674, "uuid": "5e5f7376-cf94-4981-9edb-ff68e9323691", "value": "768:nK1FO+gdEtrO8rCimdmRqMVi51dF2TFLeTIN:nK1FaEtrO8smRqMMTMwIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393674, "uuid": "623c1c13-de83-48d7-b0e1-d6ae3ced6bde", "value": 326248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393674, "uuid": "edb4f5b5-9713-4f69-98d4-d12c1a0bce1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393674, "uuid": "39e18114-78b9-4317-85e7-b3c9a38cc579", "value": "Teklif Talebi_763734838.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f9113-c7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loda)", "timestamp": 1679398535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398535, "uuid": "f5cacce1-61be-41cb-b0a6-7a0e8e22c2fc", "comment": "Malware payload (Loda)", "value": "2f600fa927fca6f7a23967686636bff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398535, "uuid": "02a996b4-28f7-444f-9e55-ab0f9d418c12", "comment": "Malware payload (Loda)", "value": "ef1f56c780aedb3d86f00706af14d87714636d82cd5ed1241fd0d3ac854b1047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398535, "uuid": "080a0b60-b6f0-4e6c-b056-743ec149bd9d", "comment": "Malware payload (Loda)", "value": "aca7f168cdf32e84cd4fff5f348f64e42856e23d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398535, "uuid": "56773adb-6db7-4ea7-ac9d-afebf8ffffa7", "comment": "Malware payload (Loda)", "value": "1bf13697661b0c06cff5ea4e36aa8881be9841830942227cb279be5be578a54bdb4b54daa946c75f447345a77c778ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398535, "uuid": "cb39438c-ee13-4b5c-98b1-b8135cc7aa5f", "value": "T11535E122F5C58036C1B327B19E7EF76A963D69360336D29727C82D315EA04816B3A773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398535, "uuid": "044080bf-6bee-4ff7-ab17-b927ad8f035b", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398535, "uuid": "c7a454a0-a65b-44fd-bace-05c216e14ee7", "value": "24576:0RmJkcoQricOIQxiZY1iah7d8iRv115NCG:RJZoQrbTFZY1iah7d8iR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398535, "uuid": "a8d186cf-b81e-4053-81ac-5030ec5f4ea5", "value": 1136095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398535, "uuid": "b778a6de-d940-4570-b3a4-83291f5605a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398535, "uuid": "ebc1cf84-b741-438b-849b-70593f09277e", "value": "2f600fa927fca6f7a23967686636bff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45adce18-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679392855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392855, "uuid": "4eb53275-010b-4f3a-ab46-bb311cfee984", "comment": "Malware payload (Vidar)", "value": "1a0ae83da2659119966550728b0ef5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392855, "uuid": "fedc6155-6adf-4545-bb88-5608ed961ee7", "comment": "Malware payload (Vidar)", "value": "efcb0595cb5b73f253ee68105e2c5d10893b080b77a744cbef4dc33018a49e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392855, "uuid": "b6490601-567d-4579-a023-50cc61cfdb8f", "comment": "Malware payload (Vidar)", "value": "b642f364f4726c1566a6a54c07e5a96e67d4a39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392855, "uuid": "9cd6c2ac-03e7-4ea1-bd04-db7428bbf37e", "comment": "Malware payload (Vidar)", "value": "33c13c23b316813192b24a11b88a40a5166e432337b324f0ce6d24bae610478d9950204b5b283986a10abed4fda84b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392855, "uuid": "f7cb3de5-1ec1-4a02-8918-442f76b07413", "value": "T10864D1C292A07C55E426CB368E2FC2E4771EFC51CE59AB65F2086E1F48BC272D572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392855, "uuid": "ee52c087-bb42-41ef-8557-0225b19878b8", "value": "b6299cf22bb1b2b906c76a98a991dd84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392855, "uuid": "0402b922-77a9-4b5b-b54b-b0f38696a069", "value": "6144:Dk5icLlNpW7KdKxTPgId8UFGWy29CzI+erANzlv9t:g5iqxgTY88UAq7wlv9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392855, "uuid": "87365f8d-fed9-44cc-b38d-b8d83ccb1036", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392855, "uuid": "88b0561d-a664-4bb5-bcb0-04aa9a1ea5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392855, "uuid": "9e0e39e8-e250-4de9-80b1-3696df9aaeda", "value": "1a0ae83da2659119966550728b0ef5cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616c697b-c7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679398915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398915, "uuid": "f91b051b-1317-4aa2-910e-c5e1c7a08905", "comment": "Malware payload (Rhadamanthys)", "value": "368acbc1100ac88ba7b178afc94836bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398915, "uuid": "d51eca75-9cc0-42d8-bacf-1f490b4682b1", "comment": "Malware payload (Rhadamanthys)", "value": "efe3552aaaa8fdce760279c54e056fa4132973a17667322ccdeaedcf0e6a0d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398915, "uuid": "66a90e35-fdf6-43c5-a884-757f3384eb56", "comment": "Malware payload (Rhadamanthys)", "value": "6a60baaa898f8f2fd4a9fde1b90fe608b5920617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679398915, "uuid": "8b0e1a01-b1aa-4f8b-9ab6-7aec33911c15", "comment": "Malware payload (Rhadamanthys)", "value": "81efa3900baa46615cff960b5c5c18168a04b282fac632f23399d401a86ca3a531307774e5728d5cab3809ff7be24f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398915, "uuid": "23733566-162f-40a0-96f1-b6f4225f3f56", "value": "T1B044C0135B917851E022C6F29E2EC5B4B60EFCD1CE5D6BAE22146F2F0873062D56AFD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398915, "uuid": "fae942cd-beb1-4abb-86d6-b2faedbfd41e", "value": "ac12c624d35aba3a43856b090f9333e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398915, "uuid": "3746c9cf-ab25-4260-b6c5-3acfc0ada64b", "value": "3072:pW5EyJ7rXDWIM5P5q9E0ywlFXMNkyQKuEnFnbmUq2u3W57kfIOQSZ:9yxlMRd0ywl2NkyQhMFBFu3W57Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679398915, "uuid": "9ebeadfb-b8f0-44f6-b914-3803f9d6e9d5", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679398915, "uuid": "61f40a7a-c34f-43fa-8636-29aba8d0b96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679398915, "uuid": "0e9ccf08-efb0-4fff-93c0-ebcf7f3b3196", "value": "368acbc1100ac88ba7b178afc94836bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80eeb53-c7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679378928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378928, "uuid": "dc88c0f4-8733-420a-9b0e-8e236ea4423d", "comment": "Malware payload (Gafgyt)", "value": "fb339cf69c95dc0cfc2e39212b653781", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378928, "uuid": "d924554c-dfae-4367-8a72-e4752375ccf8", "comment": "Malware payload (Gafgyt)", "value": "f01dd98cb5003b692b097c3e9e2493ddd041511d4e1b2874d85fb6e1bbfd3a9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378928, "uuid": "aeb016f3-63e4-4f5c-9966-478bfc32dadd", "comment": "Malware payload (Gafgyt)", "value": "c3dfc45c904bf581cdc2cd4bb4ae3cd04ae5072c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378928, "uuid": "79e1c90f-5264-49be-a4bb-bd0957fde8de", "comment": "Malware payload (Gafgyt)", "value": "1dcad5c256a49c6238c5c1ade94239a2838623971c88cd442b3b71e7799b3e64f0953928405de996c3e37b98722089b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378928, "uuid": "c146d003-8c6e-435b-bb9f-d504b4e4a54e", "value": "T1D1B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378928, "uuid": "532ac9a8-7a95-430e-9be5-186c13dcbd7e", "value": "3072:C/4g3Kd1rO5hZmxgA9OKdwwjF9GhsR1Ae:O9anO5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679378928, "uuid": "681a32ed-64de-4731-ba17-6d54b3d12448", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679378928, "uuid": "0b804b4a-e2c5-421b-a34f-3d4963dfd178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378928, "uuid": "3ba974b6-c49b-42a5-ae28-726c17033fd1", "value": "fb339cf69c95dc0cfc2e39212b653781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e004b0c-c77c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679357275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357275, "uuid": "5a101b77-ba0a-447d-bfa8-faf76a03942b", "comment": "Malware payload (Fabookie)", "value": "c44ba3eb9ed5ed00991525fa9871344b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357275, "uuid": "a5268b77-782d-4be2-9709-72ab352fd6e1", "comment": "Malware payload (Fabookie)", "value": "f388f35153c86e4d0ea46568f54ed24bf08fe74c0c4d29ed2891cb2aeb892b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357275, "uuid": "d7ff0e81-9537-4ce9-bc82-10bcdb391269", "comment": "Malware payload (Fabookie)", "value": "ae6b8b08ae181447a3f8f28da66d0366ed34a77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679357275, "uuid": "2dc9fa0f-4209-4a93-826d-b6d0333e6598", "comment": "Malware payload (Fabookie)", "value": "e281c66e793b4266c1d0204fab3caeb81d64e34658431b7d0dd8a6d5f2f65fe199ab24770931b3bf8f9f1938e7d179e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357275, "uuid": "870a6a23-4a43-4dac-9bdd-1b9a1324ca1a", "value": "T18AC40802F7A84866F0B3C13485F5D772FA72BA995E20D31F2662C76D2E33A518E35B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357275, "uuid": "fdb00b36-ef3a-4846-ab8a-e44eb2703219", "value": "c76827ca1d1fa01ec761cab183d03dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357275, "uuid": "df0b44f0-6161-496e-a1f1-f59d9ed5f1e6", "value": "6144:Q14SqFpEYpaak+GM+/EDqPz8lEjF52y7gA8vvdI/CO4XXdbHwGcAv:Qb1Yprkp/EDqrf2ysF84VHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679357275, "uuid": "e7400e91-1eff-4b93-9120-87bd8d76dad8", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679357275, "uuid": "59fef54c-7b95-42c2-9fba-dc9cbe1d485a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679357275, "uuid": "d47305f0-2038-43e5-940d-93d1b4324810", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb3724a-c7d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679396411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396411, "uuid": "864b8514-d5e5-4000-9f75-aef12f853f02", "comment": "Malware payload (TeamBot)", "value": "27c49817e971992392fc4659593148ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396411, "uuid": "0435f059-4088-41aa-9215-5726c08b072c", "comment": "Malware payload (TeamBot)", "value": "f5392b7cda5fc0c7a56ff00f6f2d3d47317373953204d1eee18407ff1be667b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396411, "uuid": "1c059947-85c9-4c2c-9b22-8d8565931d40", "comment": "Malware payload (TeamBot)", "value": "ddd19b9de1b14e53b7727efdc051bb18a03c5f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679396411, "uuid": "54d5c466-7dc5-49d5-8201-88ac44c7e048", "comment": "Malware payload (TeamBot)", "value": "d2f785aa8cc1330f0e5309ac12dc80ab5d066f2e22b6bf046da7d8134fe9cae52ed8066056d8a5cae7cf47ca65544334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396411, "uuid": "180121fb-34a7-4b62-8805-e75752e8e920", "value": "T11044495352E27D50EB678A728E2EC6F8765DF6708F497B6A32185B2F04B01B3C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396411, "uuid": "3e2c97da-2d60-4a1b-be3a-b0828e261835", "value": "92388371bf73213f8aec379315b1ae0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396411, "uuid": "92c615b8-8bf5-4b01-80c2-e940247ba0a3", "value": "6144:ffdLDnxYzOs53+ygwplkUb7oBgqrnNMc:ffd/GzpOyDpiUb75qRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679396411, "uuid": "73931a9d-52fe-4265-9f50-14a4c52185c0", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679396411, "uuid": "5baef255-1ddf-4644-a26d-0be872009e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679396411, "uuid": "4f56ca69-f9d1-4b95-a614-6eae5b19ab2d", "value": "27c49817e971992392fc4659593148ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24d6d4e-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679393467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393467, "uuid": "c72938cf-652a-425a-9f0c-01d3efb014e6", "comment": "Malware payload", "value": "dd31b0d43ad99a9a65a60e39f207e8a9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393467, "uuid": "ec532db0-d8ab-46a3-ad6e-dd1ca289845a", "comment": "Malware payload", "value": "f78ad860393007ce617ec92d8428b7c97aeac9291b72073fd85e84a484e48148", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393467, "uuid": "30857f63-d50f-4aa4-bb28-4e775e4759db", "comment": "Malware payload", "value": "b13467953e8478be21671794ef82427d30cbaf4c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393467, "uuid": "4a689896-1e58-4855-95a9-be7dcf686dd2", "comment": "Malware payload", "value": "0606e7c787a66a6b663d20acf8ad218ce0a365ce94b7b79b083945920258ecaab87b1fc9558ec84b0b56185b591de439", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393467, "uuid": "21848649-10f1-46ad-a620-404ca8edb71c", "value": "T18E24029AF50692F5C0C7E278D0C1C7B155A624F8E226D34B7EE871046DA6F634D0AECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393467, "uuid": "7c86d14e-625d-437a-8250-9adc2594d924", "value": "6144:yjAgp/xUkNGDgXhZEtVGlpAdCBY3Ba7vX:yjAgpqDaqtgvAo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393467, "uuid": "143959c9-341e-4c57-9161-e681a275b0c9", "value": 225756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393467, "uuid": "70cc1787-61e6-42f8-9ff9-f9eb723ef469", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393467, "uuid": "5dd86be9-043a-4b0c-a94f-b3a4855433e9", "value": "Order - HAHNREITER.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179875be-c793-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679367008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367008, "uuid": "d74169a3-5e24-487b-882a-3421ee229cd5", "comment": "Malware payload (QuasarRAT)", "value": "40258dcce3671d3a542cffce4cb874cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367008, "uuid": "a106a7c6-c3f2-4fca-9cf6-aa42db5a8e77", "comment": "Malware payload (QuasarRAT)", "value": "f7b9f44883cc004d34cd03dd739cbecccb3ff66824856d30dcdc31d6b5165aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367008, "uuid": "c953d88b-e834-48e1-b70b-b0eae7153343", "comment": "Malware payload (QuasarRAT)", "value": "0a8ef5122aee73d56d914c959845886cab801a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679367008, "uuid": "68ec8c91-e4dd-4bd7-8cf0-d5544ea38078", "comment": "Malware payload (QuasarRAT)", "value": "6330d797f7f8d988a23ed6af5d41cbf660447206c107bd19c346eda8d3d912e954edbbc2344fd6595ade71910bcead48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367008, "uuid": "f0cf7033-ad15-4e0c-9018-4ad75be37fc0", "value": "T184E54A0477F85E62E5ABD3B2D5F0541363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367008, "uuid": "6fcae283-d8ab-433c-bd8b-fd0439de9a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367008, "uuid": "985fa87c-115b-4f09-ac56-e4b91a22f90d", "value": "49152:bvLlL26AaNeWgPhlmVqvMQ7XSKhLL9mzhcoGdOTHHB72eh2NT:bvxL26AaNeWgPhlmVqkQ7XSKhLLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679367008, "uuid": "ee31fb43-5732-4355-8e97-2c8b61a68acf", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679367008, "uuid": "1d3396c7-389b-452e-a9ba-d7102757314e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679367008, "uuid": "a952ce11-5a26-4d62-aa99-aed7ef0c1776", "value": "Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777152bf-c7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679393368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393368, "uuid": "3c84196d-8e18-4491-a6b0-e9ceb922c51b", "comment": "Malware payload (Loki)", "value": "942bf02cb99c9a5817077df0585b24d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393368, "uuid": "375fd859-f482-45a3-9c39-8b73c6ee99cd", "comment": "Malware payload (Loki)", "value": "f8523ed4515d685be716919f9146557177f81a993bc419d5597463d38dba2779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393368, "uuid": "46047858-278a-483d-a3b6-3efa374fce6f", "comment": "Malware payload (Loki)", "value": "7a89ff81172d0747db3f4249a56b15b243459aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679393368, "uuid": "4ffd3f3f-98d9-4285-bcb8-f33e6651c512", "comment": "Malware payload (Loki)", "value": "0ed6bf3ab6fcb6b68c74e5d27c964a5b7f7aae4b7f23be9446aaad461814a7f1090a34c53f8bf214e0567c3fd4adbed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393368, "uuid": "83d9e956-cac2-4284-9f3c-db044a91874e", "value": "T17A0518425EBB5086E8B70F2C547B76880B34E953BDC9903B7CC9B61A4FFAA5364063D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393368, "uuid": "3a2e0876-c05f-4b83-bb83-d22cbf344996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393368, "uuid": "b1760da5-5b0d-46ef-b8b6-0fdf05091205", "value": "12288:AkCHm6mrTm533CvwfOPijDgVcRAMNePUfNUtJ5iM9xxqAqB6N:jTDPuhePUfNyKMPxq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679393368, "uuid": "76aeee25-d8b7-4058-8d95-8decbc6370b7", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679393368, "uuid": "aa12c08b-2a47-442e-845c-76c31e2f8ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679393368, "uuid": "0c65a3f5-4dd2-4acb-a733-2ac357956a05", "value": "FedEx Receipt_AWB#530523204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec4f86c-c7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679392817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392817, "uuid": "e45ecff8-a9f1-45af-93c4-c865ac56929e", "comment": "Malware payload (zgRAT)", "value": "3159b4f6be06bd0a777bb3e2e6bd02f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392817, "uuid": "d5b125cc-9806-4f10-98c9-2de48f529fb7", "comment": "Malware payload (zgRAT)", "value": "f87246f639ed528fe01ee1fea953470a2997ea586779bf085cb051164586cd76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392817, "uuid": "bfe12b50-a26d-4fd4-8ecf-467b2960eba6", "comment": "Malware payload (zgRAT)", "value": "aca6959caa143f20b197ba098f4402546cb603a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392817, "uuid": "4c491581-0d4e-42a8-af8d-28cdd30b1558", "comment": "Malware payload (zgRAT)", "value": "5737510fab6d3b4ba2c8201e2caf055dff2a8fa6c75e6669053786fde646aa7af408d048d28c19917966ffc08f4112a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392817, "uuid": "08a0b70c-d96e-4119-aa4b-e1d64ab45800", "value": "T105E5AEB23293FE86C77F2E7480142A809D605863926DD3CDBCC925A79AE5360DF5C7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392817, "uuid": "16a237f1-4dbf-45ba-be39-ba2993ddfa86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392817, "uuid": "06e46869-4191-4eeb-820b-611e3d2a899a", "value": "49152:RV6k4ktavUM90XCWWfU0g6DMcXF/j06yvkzfKn0CHU7:RV6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392817, "uuid": "f73b6e23-48a0-41ad-a5b8-00f42c652305", "value": 3256320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392817, "uuid": "76007e84-bcac-4c2f-96c3-8723bbb850a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392817, "uuid": "3c71269d-9595-4c44-b2bc-eb4546c04514", "value": "3159b4f6be06bd0a777bb3e2e6bd02f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb336b33-c7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679392650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392650, "uuid": "17d06707-6468-4dac-aaa8-5d860accf918", "comment": "Malware payload (SnakeKeylogger)", "value": "edf5b16cf0338479cc04e8d74e33cd50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392650, "uuid": "bf041eda-5abb-4393-aa7a-ed04b4b442bd", "comment": "Malware payload (SnakeKeylogger)", "value": "fc6948136fe3b70f2516d7f02b785cba33cf29061bda9632de232708f61efe3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392650, "uuid": "90fa0b46-b82b-41b3-8926-c6ab902c7324", "comment": "Malware payload (SnakeKeylogger)", "value": "60b82b835e10d8ea9a0ed797e9e18664e20f6bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679392650, "uuid": "ea260b04-639c-4126-8130-d367f1d3b193", "comment": "Malware payload (SnakeKeylogger)", "value": "8f7f69a0ffc68948abdedcec712f38acdb0d4a4d75488c99ef07b29b8c4ffe938f740dd157188ba2cd1ef32cef12f171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392650, "uuid": "dff38324-402a-4fde-86b6-92d27a4628a2", "value": "T1FD341250AFF1D437E0A3C6721E3A4F5F3F759826A4444A4F17913A2CBE271409ADAB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392650, "uuid": "90e46474-6f19-4dec-83b0-ed93eb940da1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392650, "uuid": "3739354c-304f-4416-936c-23d7d1b84b79", "value": "6144:/Ya6Mh1rGw4p3iqlXI5C4TxLyfKG59sr7qmy8Eh:/YCh1rG94qRI84TEnhth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679392650, "uuid": "643a9c32-0922-4621-89fa-1c22464f068d", "value": 235172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679392650, "uuid": "ba29b2a7-6b5a-4a04-a10c-88f0d0ea57cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679392650, "uuid": "fba98162-8d92-4720-ae6e-cc948ef797cb", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58554017-c821-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1679428105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428105, "uuid": "3ee28be1-59f9-4c55-a34f-c04899038be2", "comment": "Malware payload (IcedID)", "value": "9044436ca8ddc3ed05c5a1ab87cbdb43", "object_relation": "md5", "Tag": [ { "name": "3581911946", "colour": "#4C1E54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428105, "uuid": "16677a12-ea27-41db-a876-cf3f102d8cad", "comment": "Malware payload (IcedID)", "value": "fe908cbcbbdea11d0540e038a23f1a377ab0861ad5f6d013ed22dbf02b943032", "object_relation": "sha256", "Tag": [ { "name": "3581911946", "colour": "#4C1E54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428105, "uuid": "18d1cf98-96c6-4a50-8ca4-0ab1b095af30", "comment": "Malware payload (IcedID)", "value": "997bf9e5632f17bfad671b5252016effecc27533", "object_relation": "sha1", "Tag": [ { "name": "3581911946", "colour": "#4C1E54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679428105, "uuid": "2160c0b8-30bb-4ce9-9d73-321c21035fa6", "comment": "Malware payload (IcedID)", "value": "480fa24298eb507826d51d11fee58029c2a7bd2efe062feb83bc1bcde5036563c26dddaf6a8609f135453f45923fde0b", "object_relation": "sha3-384", "Tag": [ { "name": "3581911946", "colour": "#4C1E54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428105, "uuid": "92465fd0-508f-421d-a5a4-43fb4fc08c98", "value": "T1C6A4E047D6920FFBD562D47FD4815417DB22BC43BF128BAA264CC1523EA39904FA6B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428105, "uuid": "d00cdcde-8d05-4a76-8963-0b2ac39c9ae3", "value": "c90c1d9ea33b38d68a9f1fc5584c8fe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428105, "uuid": "f4c38b0a-8a19-4525-a2ee-365160f73a39", "value": "6144:iF8fQgr9ElYIn8MQpcYMZOFSlAcUwcNQNBZId6Ti6N05/bClsINtFBkoNM:iEhwYI8M6xl5cTc+dId+A/b8sINtFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679428105, "uuid": "9fd2a4d3-38c6-498b-9cd0-d4431476a04b", "value": 486944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679428105, "uuid": "ffb96825-2d71-49b4-8f9c-74b4200e38f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679428105, "uuid": "da96eb3c-b67b-40aa-b574-c1bda7952fe6", "value": "Docs_03_21_INV#15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62053627-c7a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679375723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679375723, "uuid": "3bd0435b-57e3-4d98-a990-7c5b739f44ef", "comment": "Malware payload (njrat)", "value": "e7468e6a89aeedd909f7f838d16140ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679375723, "uuid": "53707573-41f5-4699-a240-f3812daa9bf9", "comment": "Malware payload (njrat)", "value": "ff67d97ad0ddcac29d3081e30029a4014b7f1646a3bcc2541ef49c62ea718df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679375723, "uuid": "d06cb07c-88a4-4bb7-a0e2-6fa0759824ba", "comment": "Malware payload (njrat)", "value": "61a285db4a887ed0bbf36a2291514ba6cbac1e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679375723, "uuid": "6a8217cf-1457-41d7-98aa-390dea6fd7ff", "comment": "Malware payload (njrat)", "value": "bd48c8a61b33d280bbdda464cfbe4d10ca2e4c38410199b5e9a54db055daa28d42bf5e1b671ab881d12bc7930e7418da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679375723, "uuid": "1b81b6e5-7153-4e81-8a13-5e1fb0e831fb", "value": "T19393E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679375723, "uuid": "f983908a-6cb5-4aa7-8534-34f6ef64a53d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679375723, "uuid": "1b2f8c9b-7b82-4586-8e54-5b7e724a6710", "value": "768:JY3zxnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk31sG1:QxxOx6baIa9ROj00ljEwzGi1dDFDhgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679375723, "uuid": "735dc2f0-07cb-4e64-aa8e-6e3a10428fbd", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679375723, "uuid": "e68d4ec4-680b-449b-92ef-d34bd10faa6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679375723, "uuid": "958debb5-92e4-4a4a-b338-3556a75c1024", "value": "FF67D97AD0DDCAC29D3081E30029A4014B7F1646A3BCC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dea2630-c7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679378320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378320, "uuid": "082e5ced-79f3-4025-9deb-e902d70f1588", "comment": "Malware payload", "value": "2b5ddf79c73743b6a8da4f81cb5dd8a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378320, "uuid": "09f61e6b-0a94-41d4-a3db-1cca45100e52", "comment": "Malware payload", "value": "ffbde67adb42c6178c5e76d28d02e4e6808b1d3ca59d4495adfab127b99939e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378320, "uuid": "d3fc2fa0-a025-4539-9a29-be57abfa04d6", "comment": "Malware payload", "value": "ad4bc9669a45d1d34a1c2e5d7b2eae8619e22091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679378320, "uuid": "ac47569e-0c3a-443a-8d35-3bf11a189fe4", "comment": "Malware payload", "value": "e1110446680d542d9f9af946e201b66fcc0824950aab2c55718f00c7e6663286302ee83294afc915351daa1896ba13c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378320, "uuid": "f6b02b06-99f8-4bfb-aa22-e81687bbd089", "value": "T14BC4CF41B6C284F2C9351D334D14D7310BBEAE208D65C8EF73F64AABDF706D2AA19916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378320, "uuid": "5277806f-49c6-43e8-b6d5-a41d08a47189", "value": "a733622aec00fdd5370c5273a21113f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378320, "uuid": "bcbf5edd-eeb8-46be-a0b6-45757821396d", "value": "12288:BDSW/dI9mMb/AjPhfwVr7k4y9tI17hSEa:D/d3fw5PMyNh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679378320, "uuid": "380040ed-4d4b-474c-8eff-2890771c5db9", "value": 555536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679378320, "uuid": "e7495203-0e8a-4a59-8576-8b52b31f46a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679378320, "uuid": "73a0bd0d-8573-4707-a9e5-44e0e6fa4548", "value": "Setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }