{ "Event": { "published": true, "date": "2022-04-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-12", "timestamp": 1649808182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3d9f8781-e3a5-42ea-8d65-2bbef4ef5b6f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fe3fd7-babb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649807403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649807403, "uuid": "65afc753-8c28-4edd-a15e-a331f88c10f5", "comment": "Malware payload (Mirai)", "value": "e399cfbb622bdf06872a146fd05655cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649807403, "uuid": "060c5780-afc9-415b-a266-6dd1cfc13d0a", "comment": "Malware payload (Mirai)", "value": "0023f54ea7e345d6791921be8c8636a22c7ef8edcfe9d64971d3cbec0c3b1a91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649807403, "uuid": "cb1c2af8-2fa1-4634-aef4-edc9a6dff726", "comment": "Malware payload (Mirai)", "value": "a1c988a49cf44053f7ad6db046eb89032cb4e16f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649807403, "uuid": "953b9cca-34e8-4402-b758-ec2ef5b83e70", "comment": "Malware payload (Mirai)", "value": "41b5bf490dd895ed8711eeadcd5744255623230e4f6f897e4084269150e38ea5dd7db5890d3da393fbd7169d80f31fba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649807403, "uuid": "81d980dc-e23b-4a4d-8692-9929d6f4a573", "value": "T1DBD34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649807403, "uuid": "69451cbb-90e0-4db2-8656-c44ea5509833", "value": "3072:f0DvinprSHrDqtVGDB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeGDJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649807403, "uuid": "f570f0d1-abb0-4ca7-aaa7-fef17d7ab597", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649807403, "uuid": "f19f3a32-505a-4620-9c35-729b93576579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649807403, "uuid": "a844093d-be84-487e-a839-0cd6abf1281d", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d339b7a0-ba7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649780152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780152, "uuid": "edffe1d7-0b4f-4e37-ab13-f721ae8ce75d", "comment": "Malware payload (DCRat)", "value": "06b94977048278523e94fdeba078485a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780152, "uuid": "ffc04633-7d17-4abb-a22e-f28c1a28823e", "comment": "Malware payload (DCRat)", "value": "0061019f4b7c75ebcebec039688eee3c12a7a4f057cbc2dafa12d36e1b2761cc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780152, "uuid": "d93dadeb-306b-4610-9f04-ece2dc5bf908", "comment": "Malware payload (DCRat)", "value": "92ecf2cd5e5bfef4c014a6c151c7c0d0c1168446", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780152, "uuid": "bf82f058-94f8-4fd9-b33f-a8b8843a8f10", "comment": "Malware payload (DCRat)", "value": "39e257c87e9aaba449f6c2604065dcee1106f6e1bbb4e836c45b290246eb413d123f2cc47e0c60348338e4260533cf8c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780152, "uuid": "beed621d-3972-496c-8d21-53e4033b7e15", "value": "T1CA74C079EBECAA43D69A137994C646B087F25510B093DBF7706A2BB43983350DC1E18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780152, "uuid": "7cf3876b-558e-40bb-a639-cf74cfa5b8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780152, "uuid": "cc73b30d-61f9-4ee7-82a0-824c1329194e", "value": "6144:lqvhJhz0IUSR3T08h0ZrMQHyBrACty1gMEN7jy4uKAsrKcqt3:EHhYCQ8h0ZrdyrACtcl2ZzrKcqt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649780152, "uuid": "ffbd7392-b9af-4a1d-9b3c-7a188a0e5658", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649780152, "uuid": "a59f123c-cd34-45a1-a6da-1cf30ea1b46f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780152, "uuid": "4c68bccd-3996-4bcf-9963-ce693b02ae3d", "value": "06b94977048278523e94fdeba078485a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514a9b18-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1649775639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775639, "uuid": "682558c0-1c85-48a6-8016-0fd4615506cf", "comment": "Malware payload (Socelars)", "value": "cb9907b43f18591ba254cf7370b87969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775639, "uuid": "47ff5bd7-d132-4fc0-bd05-a648c3ab7781", "comment": "Malware payload (Socelars)", "value": "007f88e667328e823a9c87104828f87807801dab329d433eeb41fab3986bb981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775639, "uuid": "9b4df76a-b200-4524-994a-68d08824b5f3", "comment": "Malware payload (Socelars)", "value": "674a40c1f057d1af00d3b02a92aa6076344b94de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775639, "uuid": "965aa132-79d7-4d0e-98cc-d503627d445a", "comment": "Malware payload (Socelars)", "value": "25f92c66294f5725a417d49d564b717307404770cea4bc70b5dc54d6898ed49e2279cc0b0183ea6c130c5969ed64afa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775639, "uuid": "2836d16b-fa39-415c-b91a-48a6fd16914d", "value": "T1EA658E11F642A036E8E310B381FF4AFE8D68AE21031854D7D3C47E6A5A715F27A37A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775639, "uuid": "c10dc57d-f224-4faf-bd06-a3bbda56c28a", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775639, "uuid": "c52a5886-1f49-4ad7-a196-a855b4918abb", "value": "24576:rwpk4V9rRM1oDb+enGs2Q6E9ZBJRPHJTrFSJ84ufAgKFqng:cpRc1OMcV/sJjAAgKgng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775639, "uuid": "da1e7b53-aee9-4c80-a56d-ececb0111777", "value": 1488896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775639, "uuid": "f55570c0-4783-4046-b19e-48d2f9fbd4d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775639, "uuid": "20be6a87-1a0d-413e-a01b-7ba85968a999", "value": "cb9907b43f18591ba254cf7370b87969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2779b7bb-ba31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649748082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748082, "uuid": "cc73aeec-00d7-448d-bb09-58084042c879", "comment": "Malware payload", "value": "a3a74538351cf431ef2e62b4d0e6c2f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748082, "uuid": "a31f8c47-afff-4114-8ae9-5ce20c57a56e", "comment": "Malware payload", "value": "00a8ed24783404c076782dd5ac42ccce3259b46541d9d22edc705acae4cb0517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748082, "uuid": "687cdc22-5a27-4140-95c4-f45cfac14556", "comment": "Malware payload", "value": "d2682714dffd4da4ba1626f92c60e0a78cebfb2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748082, "uuid": "1502d1d4-5efe-4db9-a691-13753fc1971b", "comment": "Malware payload", "value": "70a2fa2e1c5630047c6d92c3e0e05b934a9addafa60f46bd724b86b89627fb75fa7bab09c1175fba7fa5691362380800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748082, "uuid": "6343953d-e8c8-49b9-80df-0d3d46b935be", "value": "T1DF839D13B9E2D476D958163004D39FB41B76EC300A169B439764ED8EAE2337A9B36363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748082, "uuid": "2b5e8ba3-ecd0-409f-8036-0342fec683b6", "value": "5fd2c5ccd5d64822c225de4a88c9c76c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748082, "uuid": "f1e36188-9cb4-4dc3-90a5-4368b45f76f4", "value": "768:ZaZBE97vF7pZRaS9XAtyzukyGmC13gorFSzDbZxmrurObxX9mWsaRog2/sVoDuT:CBU7pZfxg2FSLZxm6qbZ9bsS2/4oDuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649748082, "uuid": "b01d52fc-6e6e-465b-92cc-fa59583839e6", "value": 81961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649748082, "uuid": "4c0f8f5c-418d-4cd3-837b-09d30c863cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748082, "uuid": "ef3954fe-9a27-43c0-9058-b01cdd9ba172", "value": "spikes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d391c0bc-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649764262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764262, "uuid": "ebdca675-9271-4683-8c0c-9cfa60eb94e5", "comment": "Malware payload (RedLineStealer)", "value": "3ba69872f94f58572425e1c32cd92131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764262, "uuid": "fe2ee22c-cf90-42bd-91eb-73e27a5e7280", "comment": "Malware payload (RedLineStealer)", "value": "0118358128946efef9fa03d752c2687347d4a43e5d387110058e9567c8668854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764262, "uuid": "fc13e992-9704-43af-b67f-f7965eb498ce", "comment": "Malware payload (RedLineStealer)", "value": "11a585d778e1818a3c6f3d8013fe7bc6bb6679f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764262, "uuid": "1e9eff5a-333f-4203-91de-930871274677", "comment": "Malware payload (RedLineStealer)", "value": "13348457c4fba8dc6e967a51a5cdc3cf74c22daf5444d5796c925bc09f9a8578fa5f2613206aa9c73ea63c4c0051bbf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764262, "uuid": "a4045e20-4ac6-401f-97d3-8767456266c8", "value": "T1A184CF00B6A0D035F1F766F8497A936CBA2E7EA05B2450CF62D536EE5634AE1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764262, "uuid": "5894ebf7-698f-4793-9a19-937bbf63ab6c", "value": "da226befdbef45462493cbd252b0858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764262, "uuid": "588258f0-8f87-40f2-ac3b-ea31de14b356", "value": "6144:XlpN+cejklXak0AS/1DhU5s1ciW8N3A1rAUpmQbmb8mT3VLpAXkBqiWxiE:Vp04lXaJAS/PUs1lW8N2zmQKomT3VVAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764262, "uuid": "e09d4aff-2f15-4c08-804b-23a8746e4ae3", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764262, "uuid": "7e9fc9f7-e92d-4e74-aefb-3cdb8c814539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764262, "uuid": "41016a17-2e35-4a27-9d28-2255f1b60b06", "value": "3ba69872f94f58572425e1c32cd92131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e07eb10-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649747690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747690, "uuid": "4de0cb12-304a-41de-bed9-29a4b146582e", "comment": "Malware payload", "value": "9363e3cb3c15c40e89ccc835155073a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747690, "uuid": "1bbf6349-cd76-44ba-aae7-455dd8a9de05", "comment": "Malware payload", "value": "016ada110d546e27f20d7bb6abb36f4e9461c434cc5d876220c25db66d2920e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747690, "uuid": "c8e968fa-6ca9-46bc-a033-fd3f3abf8e8d", "comment": "Malware payload", "value": "d414547c7373a612fdec11da7c99b308cad0f8b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747690, "uuid": "a4e5a9c1-397a-40f3-9b7b-240430d368c7", "comment": "Malware payload", "value": "ce73971abd128411175669f74b2b5add6e3779f51a61ceec1987d97e954d1f43ad898154e06bed5e45c164feab5f5356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747690, "uuid": "d15f55b4-b972-44fe-bc96-0a9ffb59e082", "value": "T183B54A01B7539177DDA62170846AAB244631BF702F32D6DBAE507A0EFD317C169323BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747690, "uuid": "eeb737af-49f7-49f0-97be-858adb96f9c8", "value": "b06090332cc8fb8aeb9b846fdd7ff33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747690, "uuid": "8fd962d1-3c1b-491b-b55e-fed6480cf3a4", "value": "49152:2B+B+lgNl9qC6B4lAlEDkYOMwwnMb4PmyV:wlgH91/lAlpYOXwnS4rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747690, "uuid": "15420cb4-b4bd-4b19-af44-669207961d29", "value": 2407396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747690, "uuid": "520eed68-4d28-44c9-ae0e-3f875f4daabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747690, "uuid": "472eced5-5d2d-4d44-ad87-d78216e327be", "value": "IEXPLORE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db48bb7b-ba12-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649735069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735069, "uuid": "daf35f9f-3160-4e63-9593-8807b040e436", "comment": "Malware payload (AgentTesla)", "value": "d449003014d8afb85b9e0065cb25f2c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735069, "uuid": "76a7874f-6afe-47a5-94d8-abfc6a0e6af8", "comment": "Malware payload (AgentTesla)", "value": "0173601f1ea39ad10aacbcbf5ec51ffb25c788380c0d3903844c0a7d753e7165", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735069, "uuid": "157a0e36-cc93-46ec-93f4-3df3e9069759", "comment": "Malware payload (AgentTesla)", "value": "22275a510251cca1dacdd9422797911d96a8c3cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735069, "uuid": "62f62774-b748-4c2f-8d2f-160cea29ea25", "comment": "Malware payload (AgentTesla)", "value": "6e2c5551a878221e8877af4c7bf11206c9050888fe4180c7d760a1e41c52fbb13b48230dad6a788eff63f16081d79a45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735069, "uuid": "c7b5e665-30b7-4e78-983d-12e0145be46d", "value": "T181E4F11576FC8A25E5BD07BDE03901904BFAB227682BE3BD5A0660D92D633C0D60777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735069, "uuid": "566cdf15-9f7f-4bd8-8f10-f9945b877b08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735069, "uuid": "dd79ae08-a4f0-4fc3-a316-7e2bedd9dc26", "value": "12288:xkKUk6X+4qa6NkDhwzPw+0QnNfhsg87ORbDnUnFRam/16MpjHLepgVgz:xkKX6XVqa1aMcY7OVr8Ram8cLXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649735069, "uuid": "88c66fbf-2a97-47f2-8583-7db06bd01bf3", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649735069, "uuid": "04d30212-81df-4d1e-a205-fe21579cef8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735069, "uuid": "8be3b598-6679-4a2d-b264-6b592f17719c", "value": "SecuriteInfo.com.Scr.Malcodegdn34.5123.23892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1300fcb7-ba3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649754060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754060, "uuid": "681f6762-d31f-42fb-a6cf-8d6632db754a", "comment": "Malware payload (Gozi)", "value": "9750ea86b79ef36ab12334c274b9ff36", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754060, "uuid": "684a2fcd-3d8f-458c-b584-da1fea2380de", "comment": "Malware payload (Gozi)", "value": "01e8ba234e77e6cdfab386f76099188cb7c754493ac9dd6147f9118f29abfcb2", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754060, "uuid": "0c073f07-76ee-4c59-9767-5334791a109e", "comment": "Malware payload (Gozi)", "value": "ca7ae7ea92ac2ccce1dd6af310104df266f6069a", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754060, "uuid": "730e2599-52ca-42f0-8a87-447c021b54b0", "comment": "Malware payload (Gozi)", "value": "f8e697e0816a33cd83573810bc60770e62aba4c7a5c94262d7c338491911fc1c7342d541d46ceb1738c302402f3bca19", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754060, "uuid": "18c447e6-6150-4fd0-9c6a-1de184a2fd95", "value": "T18DC42338E2ECF87EC1E4167EB8572BC1B6E00184979E1A4C35A07E253156EBF3716176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754060, "uuid": "6835b2f1-dba1-49a3-a6f4-b6bdf927885e", "value": "12288:UdVXnCjKNdexLWp44U6A5uen2VJ2cWbEnA0uN3dFxUeRu:IVXWy0LVVerVSNdUKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649754060, "uuid": "5b56b765-8c31-4394-9750-ee864b9bca54", "value": 593095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649754060, "uuid": "1d5a9c46-7f58-4005-b833-9a5f2e1110a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754060, "uuid": "49711b9f-0356-422f-bb4a-1dd3cf747ad6", "value": "request.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72852d7-ba6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649775005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775005, "uuid": "0cb10ad5-5423-4d2a-b5b9-975f5eb8133c", "comment": "Malware payload (Mirai)", "value": "256c567324d04c044fac9f2f03bdb401", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775005, "uuid": "50e53308-6136-473a-bbbf-affd58ce6fd7", "comment": "Malware payload (Mirai)", "value": "02cf070d6e4c4bb97f57082291242f6499bb34f1a735c76fc1396456d31d8fbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775005, "uuid": "301c9a0c-f025-4af3-a99e-1da4012c8ada", "comment": "Malware payload (Mirai)", "value": "feec40c73cdc051a99b0a022bdf40f13fce71357", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775005, "uuid": "73304457-2d0f-411a-8167-2069f8e3180b", "comment": "Malware payload (Mirai)", "value": "d80cb5997a9b2bdb2f4a61fb1963912cf4a38a00680e75d8bb69c0ad02773de8f0b26b97c8203651573b75653262ca4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775005, "uuid": "ccae518b-871e-4c64-bf0d-e68dc56a7455", "value": "T183D34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775005, "uuid": "6c72330d-eff8-461c-ab7d-c08a028123b6", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZT+HHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CsHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775005, "uuid": "bf7621ab-f183-43c5-8ce7-86dab3d4a103", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775005, "uuid": "469e5a51-81bd-41f2-ac4f-e0bb23e25212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775005, "uuid": "fbff4dc5-7202-4a25-bb1e-4e87f6f5b872", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9989367-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649777989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777989, "uuid": "0b5688e3-b40d-46c6-9bc7-e8bdb4134fa9", "comment": "Malware payload (Mirai)", "value": "45acdc39545318c6f6fc9fa7c219bff3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777989, "uuid": "23664f4b-957a-47a8-bbc8-a02a0c735863", "comment": "Malware payload (Mirai)", "value": "02eef2e14b792edd8acbc0cfca09051271b4a2992ad008a2d19cb50e17023876", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777989, "uuid": "12c3c740-e1eb-4f39-8ab2-fa17525041ae", "comment": "Malware payload (Mirai)", "value": "1a7ab18f3ea21714e2ce6f818ea9965641472978", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777989, "uuid": "f624c83e-34c4-479e-83a4-55c41fe3256e", "comment": "Malware payload (Mirai)", "value": "816b20707d6d540e6001c2d39bcf2c923ea6a20af86b19f2792b4c3a4277337465607a4dfd823cbc337d3e4b454d2039", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777989, "uuid": "960920cf-24ba-4463-ada8-57d762cea1d8", "value": "T1BC63F852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777989, "uuid": "c58ce75a-2421-4953-ac3e-81d01b7e5091", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777989, "uuid": "aed892e1-d308-4fa2-adcc-5c0563e9b6b8", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777989, "uuid": "13c18b52-ee9c-4cdf-8684-b232b9ad715f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777989, "uuid": "ddb35ede-0bd4-4681-82d1-cee641117fa6", "value": "45acdc39545318c6f6fc9fa7c219bff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d15a958-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649764573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764573, "uuid": "b86acccf-41df-4da1-ba7c-3c0f240318f9", "comment": "Malware payload (RedLineStealer)", "value": "dc5f75ecc5957d7ddb28bbe2ce9c6c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764573, "uuid": "0fdcb603-0d31-44f4-97b3-8d02a08db2cc", "comment": "Malware payload (RedLineStealer)", "value": "030031967edc4442758b080c291fa29e2220d299194173c0a7dd484609f0ad15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764573, "uuid": "47554d35-6756-47c6-8927-a5e5e34821ef", "comment": "Malware payload (RedLineStealer)", "value": "96ee5a0c5ef0dfbb92e3effb2e9def6969bfb582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764573, "uuid": "2402e16e-cc16-47be-a9c0-a1e1f98fcc73", "comment": "Malware payload (RedLineStealer)", "value": "78ce52e3b4a8ac89381de93eb86ee677663708b220aaf1b1f10d0856f7be7d5234ae4bdf0a3179309c47cb15482b02d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764573, "uuid": "07cac17c-87dd-4249-b4e0-2418e118115d", "value": "T13E84CF00BAA0D035F0B716F499B6C26CB92E7EE2672460CF62D576EE56346E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764573, "uuid": "18deb721-17a0-47c3-af60-710e7b6a6f33", "value": "b2491f91b932b5e67844520efb025825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764573, "uuid": "b032c627-aa60-44c0-b12a-e4cf6a71eb81", "value": "6144:UgBZQPaqu07xJxIrGdEnF5EHJCcvAv5IxI8bfGUcCNYavGCgih/mqT:/BDB07xJCcGF5kgQ17L6oGCg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764573, "uuid": "08ba203a-f3c7-4199-86da-bcf7d730065c", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764573, "uuid": "c7342d5a-5253-4a35-bf1c-f7df178e953d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764573, "uuid": "429be95a-9424-4103-bba4-c0f65d053bb6", "value": "dc5f75ecc5957d7ddb28bbe2ce9c6c23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb6d798-ba63-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649769912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769912, "uuid": "84bf2261-8b6d-4dc4-9873-efcefc5d9a80", "comment": "Malware payload", "value": "f1cb8abe8e79430bf71eb50e365f89c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769912, "uuid": "100330db-5d98-4349-979f-89eb1dcdac34", "comment": "Malware payload", "value": "038d9c2e5e9bc9260120ee7f0d0aa8f3136bbf5d72a703a023b06b0c8cd9f8a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769912, "uuid": "3846c265-7f33-45ef-8316-a849bbf05d2a", "comment": "Malware payload", "value": "cb64a8a1e4363dbe96f76cc5654a3a1531e6f4c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769912, "uuid": "ec346b92-912a-44e0-941f-3633b887c143", "comment": "Malware payload", "value": "6d2db072f29df2fea8345635df0affe6c9f0befb0096463a6c8f42ba9517d8e1e3f53373b864176ad62644bb71bf99a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769912, "uuid": "198a8b36-da8b-4aa6-8443-ce1a9b60d930", "value": "T1B9B1514A8314866BF36ACFF91D33481C6E68154293A7423A75820DCEFEF3EA1B806755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769912, "uuid": "0b4f0470-ae6a-49b9-8d94-6a8b5a3c4b2d", "value": "904f72e576a2d4d4dd46b7f580cbc4ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769912, "uuid": "d11f7fc4-d699-42f0-86e3-c92eb4a22a29", "value": "96:5Llbss5FBBQbmcIXqSwC+IXq5k69/qiDxvhn:5L1RiSnXPX09x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769912, "uuid": "cb9681c9-c78d-4b83-9b58-8f11e4a52515", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769912, "uuid": "e8233ae6-f73d-485b-976b-5ab030c433ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769912, "uuid": "f33cb4bf-cd09-4896-b53e-86437dae61d4", "value": "SecuriteInfo.com.Generic.NSIS.Injector.A.F3F2254C.26277.9329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be286a94-ba4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649759501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759501, "uuid": "1cc6ca0a-dec8-4149-be44-cad7d15bbfb8", "comment": "Malware payload (Gozi)", "value": "9cf986a644dd4f06d9387f25a6da6085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759501, "uuid": "37a232f2-bdbe-47d6-b859-de137f86033a", "comment": "Malware payload (Gozi)", "value": "03bd708a5f9411d190d3ac363d0b01eaa4d0c8625d9b68951e5a6448d659495c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759501, "uuid": "224dd8f2-c675-48d8-9228-9ac3fd794107", "comment": "Malware payload (Gozi)", "value": "80a3cdfe0972a699c38e044a539d49c70007d22b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759501, "uuid": "e1022b3d-5e06-44ae-ab19-cd5b11177545", "comment": "Malware payload (Gozi)", "value": "3feaa867c107655dc228c11116ac1ba986f808b532ba66ff2ba37a0f5e96699545b659d4ad963a58f2911f61c8709413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759501, "uuid": "d12ecf2c-b805-42af-85aa-fdc7629ba620", "value": "T17CC45C00B692E03DE8B731F94FAE912DA51DBED0172050C753C51BFA9B366E07E3166A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759501, "uuid": "1c52401b-e946-437d-844f-b2c141916ce3", "value": "3743526d94457fb013584724635b7f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759501, "uuid": "11b255be-7bf6-43ec-b951-ab933881c1e9", "value": "12288:et1GYxq+AVzmKoXmysHMZmaOeVIKjoiUBZ8TOXXGN93Wa:etQkQmKoXmysHMZDVIDWUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759501, "uuid": "7c16d010-fce3-45c6-a85c-b2c4b565b5df", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759501, "uuid": "34e2a7d9-0970-4c96-bae7-688edf757ad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759501, "uuid": "e9673eee-170a-489a-b00c-20cf5b59b5bb", "value": "03bd708a5f9411d190d3ac363d0b01eaa4d0c8625d9b68951e5a6448d659495c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6d7a64-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766535, "uuid": "dae6522d-60f4-448d-9b24-61b0961d4fcc", "comment": "Malware payload (Formbook)", "value": "61f703d12b6aad73b68849f1608db00d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766535, "uuid": "3a626315-c6b7-4793-8c38-6837196c0f87", "comment": "Malware payload (Formbook)", "value": "04b751d8d2bee0880babadcee34e68f6333e4b0a636c7321e06361da1618cff1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766535, "uuid": "37959d23-bac3-431d-89a4-c6be83b19e12", "comment": "Malware payload (Formbook)", "value": "38a9b18ba35ef9822d404dd72fd9464ddf1a548c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766535, "uuid": "c21d06f9-8cc4-4b1b-90de-4892d926b00b", "comment": "Malware payload (Formbook)", "value": "8c98ce3092625c42442959df00c17c7b241fec450959882113cdc9f43ad4faef464ac0c8c6b18ee6629291cee70fb86f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766535, "uuid": "9dd6ec5b-d934-4110-bb6f-00ddb9ed76b6", "value": "T1540488F0F2419335C795053CAB14F5588F233E6A54DA6EBE31CA3F2A267E9E48611B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766535, "uuid": "fd8039ce-de41-4318-818d-11988e11429d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766535, "uuid": "dd909b0c-76bd-41b0-9646-b79029c541e1", "value": "384:MmwcDG4afffffsZXKZ4YeHTeHfCC+TQYwnNrNQfbZOyFCatB:M/cDGYvXTVwNrNQjZOQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766535, "uuid": "eba978be-b063-4bc4-a16a-790171407d57", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766535, "uuid": "40fef40b-4e36-4aa9-99b6-d3ee87c97113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766535, "uuid": "03955a6a-40a7-423d-8824-ccd493cfc1d3", "value": "61f703d12b6aad73b68849f1608db00d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0c7cfa-ba24-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649742538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742538, "uuid": "e1ccb7c3-f2a1-4665-b561-e5e81c861cd0", "comment": "Malware payload (AgentTesla)", "value": "b6e37d1cdfae5575f97de4b7daefa8cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742538, "uuid": "585613cb-001e-47b6-ad88-70a650117af6", "comment": "Malware payload (AgentTesla)", "value": "061d795a8d41112adce13006d74898971acba50ed57ef62942d23fa583148735", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742538, "uuid": "d910ddd2-92c4-4542-a465-0c33ead9f9cd", "comment": "Malware payload (AgentTesla)", "value": "d7d34c87979779758c6e4183bd76da1b7dcad9c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742538, "uuid": "2195eaa9-da95-4ba9-a482-77cb45f7d243", "comment": "Malware payload (AgentTesla)", "value": "4d4aa2390e99a88eec83a32a08eb0037557aa74e2da3517f73591e0b2ab86c10861ad32030e7f7ce04e3b40c274607b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742538, "uuid": "a9eb1c90-d45c-4acd-9fca-45717de51552", "value": "T16F55E060A781A4D3EAF50A32091BDE7077E17DD89126E3AD38C8BE7F3AF559181403D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742538, "uuid": "702e7586-3fd2-466c-b81a-449c36dc5fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742538, "uuid": "03b9bea1-4a94-4bd6-9fdc-3f125f46ba1d", "value": "24576:FtdBqCebfeuXVgOnZTgxwMJtURhwocrEyB6sYbEkcMMMMMMMMMMMMMMMMMMMMMMo:FtdBqCafeEVVZTgeDDTPJEkcMMMMMMMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649742538, "uuid": "0347fa0c-9c5d-4d1e-93bf-e896fcd66741", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649742538, "uuid": "6e7a313e-c490-472b-b920-987d2e5612ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742538, "uuid": "5bba872c-1a4a-47c2-ba46-ff8ad0793170", "value": "Overdue_Payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec1b6b8-ba91-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649789406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "85ba98be-15a2-493f-bdae-57feb9209cd3", "comment": "Malware payload (Mirai)", "value": "940b29ad2e32d5a0c2efd72bc634636d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "f42f8afa-18f5-49b1-bf2a-0e40308a707f", "comment": "Malware payload (Mirai)", "value": "0646b02d7e767a0c50546f2c1444ffc0ac0990d4a5ddb962f0647024d5607710", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "d50c7609-f01c-458e-bbd3-ee3da21d1fc8", "comment": "Malware payload (Mirai)", "value": "4b4e9dbb5b9d137b8b29f71d065d2dd65dc0b4d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "0d699d20-cb20-4a1c-8232-c28f980fb8a2", "comment": "Malware payload (Mirai)", "value": "30db197a7794af0ba1caa051d20d755353c3821098385a91c1cade8800a0e73078479a9356d1b0c7afb9a09a596b0015", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789406, "uuid": "7d50e206-db28-4d93-9473-47365eea3830", "value": "T1E7E2E09DE672B8D6C7AC4ABC92BD47BB16C9B604728B4F8D12010C8CFE6715B304C1D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789406, "uuid": "c095a7d6-1fe7-490c-81b2-3b99273b0efe", "value": "768:PVlH1mjA7/vvi7OixXSUkbcwWYKNNvDtYYJsrvNQWWU1r:PVlVAkXnixXSU+9g30qI1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649789406, "uuid": "44541ec4-a111-4b43-b5e5-a977f16c1d79", "value": 32728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649789406, "uuid": "f3c1f7dc-992b-45d1-bf0b-ca67095d59db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789406, "uuid": "9d84ef03-0d00-4b2a-b50c-86175076b785", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4adef6e-ba8c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649787376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787376, "uuid": "fc431703-033a-44fe-86de-2d29360b4dbb", "comment": "Malware payload", "value": "d912338e3c59b18464610cc56e1f653f", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787376, "uuid": "df04739c-8cb2-4c2c-b832-2e22be1fe478", "comment": "Malware payload", "value": "0659390fe57012c9d29bacb0e85b61f7de968a6008f91d9c729e18c784b2cca1", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787376, "uuid": "620caee5-213c-42ad-a4d2-ba176d2e61f1", "comment": "Malware payload", "value": "275b62e912a00ba3de3e6b336e0e1b9a893d69f8", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787376, "uuid": "090462dc-75a4-4720-8914-b16b98066636", "comment": "Malware payload", "value": "0cfe4ce3095527bc6853738e975330ab38e56feae36890d12b3a329e356cf31977740ab8825c3401bdf5a05dd5ca77bf", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787376, "uuid": "5a226a16-800a-49cb-9e05-e932d7b12005", "value": "T1E5A52383F2BE8EC7C193B4BE2112C112E9C63C5E0A35A73763468C1EA79592518F977D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787376, "uuid": "e54cb9a1-7dee-46f5-bb0c-8629df7dba1d", "value": "7203ec25856268deba275d3c50808a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787376, "uuid": "2a7cb8d2-db86-44a2-ae13-7702905b25ab", "value": "49152:tbhl087l5fJeS/DrSoUtP9qqyD8e3+DSP9yJoZ:tLTfJtylPyD8e5MJoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649787376, "uuid": "ee01545f-15c2-406f-b980-75e8019ba70d", "value": 2188288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649787376, "uuid": "cafc1dcc-5ff7-4036-b59d-31ed3688ce4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787376, "uuid": "2a216b96-fe59-46ca-979c-4ca7e488a81f", "value": "vil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8587c9f0-ba39-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649751675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751675, "uuid": "6eaed1ee-e868-452e-a967-51ef4b36106a", "comment": "Malware payload (AsyncRAT)", "value": "9b6a3d454a982494b37bc30318ac5914", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751675, "uuid": "c94b1701-097c-40bb-b6e3-65ba3bf93df1", "comment": "Malware payload (AsyncRAT)", "value": "079871499bdc91b180fcd73f10d7db76fcabbbdd29017ad0f8fe82f5c18b39a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751675, "uuid": "21c8d4e8-0d14-41e3-8377-bdc34827786c", "comment": "Malware payload (AsyncRAT)", "value": "68f88064e4d03d94106b230cd86e36d85d249c2a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751675, "uuid": "ac352403-9e41-41e6-ac87-dcce5538263f", "comment": "Malware payload (AsyncRAT)", "value": "7c7cf254cdd79ce21b211c3d8b582b0be860add098774235632fed65878801e598f54d92882184ac9b6b1ccd5ecad2f4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751675, "uuid": "720b7730-58c1-4cb6-a5b3-77454ccb96e8", "value": "T1C8B4E0117AFC8635D5FD07BDA03501804BFA76276927D3BC5E06A0E62E633D09A07BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751675, "uuid": "101f44d8-ea92-493b-b2f3-11b3a50bebaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751675, "uuid": "19855a71-d2cf-40b1-958e-8706370916b7", "value": "12288:HkKUk6FM4q0um/Be3WsOGI/XBsOt1OOMgVgz:HkKX6FXq0HBemsOt/qOt1fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751675, "uuid": "8757288f-af74-4dca-bda3-d84a110d0e7e", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751675, "uuid": "3859f2d2-a4bd-4838-8b94-34e3bcee230c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751675, "uuid": "00d2e4e2-69f0-483f-b3e9-c9f2533789d9", "value": "Invoice.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fdba19-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649766029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766029, "uuid": "04d15989-4d71-4afa-bd5f-62470153fad1", "comment": "Malware payload (AveMariaRAT)", "value": "0668f95ef8ee2cd54c7beb36b23f48a1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766029, "uuid": "125bd165-1ba0-4bfa-8cc8-650878567f19", "comment": "Malware payload (AveMariaRAT)", "value": "08b37d582aeeeb0942550eb641b346bb561ef7d6f4e62044a4a01fee41780b2f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766029, "uuid": "47d83baa-e2b2-40aa-b158-9f21f78a7e66", "comment": "Malware payload (AveMariaRAT)", "value": "b068fb991909b785cdf28987e4e2c77ac88f19eb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766029, "uuid": "50c47c72-f349-49f0-abd6-0446b5b3abfa", "comment": "Malware payload (AveMariaRAT)", "value": "d50ccd29ec553f9559482d26fe21796add043b5f74b6e4efa0468797ababd5662be5b5d948b0767be6683283a7ff6a66", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766029, "uuid": "1fab8ca8-c69e-4a5a-9c4d-dad93533ee04", "value": "T144512938CAB4022BD2F38639E8ED6206D5667C42F95D8E5D405342C454E7107BCE6F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766029, "uuid": "56e86b3b-57f7-49cb-b8b6-4dc2d312d22c", "value": "48:8v5ai2IIa8RHsRaw+Ra8sNwglkl2aAItB:8v5V2IIa8RHsRaw+Ra8sNwgOcaAMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766029, "uuid": "7beb09b4-58d7-4e7f-989f-2f5e29f38821", "value": 2646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766029, "uuid": "7985e824-3ddc-44f1-85f1-77b2cec01baf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766029, "uuid": "a7f75cd6-1de0-4154-b57f-4f0ba82a1524", "value": "grewqy1.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9655a3c2-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649767595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767595, "uuid": "407844d0-5122-4b10-95b4-d56c5ad24884", "comment": "Malware payload (RemcosRAT)", "value": "910667fc7c5f99a740b4b1e5bd4040ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767595, "uuid": "13631d8d-d344-4baf-9c1b-42d6f3fda771", "comment": "Malware payload (RemcosRAT)", "value": "08c0273e2bd04a047d150303d4cd05076c2d2877afa82543ce43fc8296d86a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767595, "uuid": "734b1587-e00d-4ca2-8a55-d39bc5470eaa", "comment": "Malware payload (RemcosRAT)", "value": "ad678f47d13c340ab52bb01a77f76483bbf782dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767595, "uuid": "8c4e993e-fc80-40d8-bc04-c6af2c2b3646", "comment": "Malware payload (RemcosRAT)", "value": "ccecb54e4e56a34e435b14764e20090bfabbfda8366560bdcbfda84d850d97b72cec549f332b11bcdebbcd0a5702e5e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767595, "uuid": "7ed8c257-9daf-425f-8de8-f141cf5be0c6", "value": "T136E49D12B2A14E33D93F1A7D4C17676D68277E131E28A6C33BD42E097F79682392D193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767595, "uuid": "bba44110-02f8-4ff4-a7fb-e637b796bc97", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767595, "uuid": "1933414f-9519-42e1-abd8-a3b48ee0a6d9", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2MZec4qO:wkKHuoE+/vI0icJskMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767595, "uuid": "cc893c65-1a31-48a0-87f0-07dbf308e69e", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767595, "uuid": "282f6278-c4a3-4e53-8b70-5ec9c8aac402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767595, "uuid": "8f256655-d9d8-4097-8717-0069f218718e", "value": "910667fc7c5f99a740b4b1e5bd4040ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefec02c-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731666, "uuid": "caf1ab82-f76d-4865-bad1-029e35adf922", "comment": "Malware payload (Mirai)", "value": "6997765d6c6299c6d9267bee30428e24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731666, "uuid": "41acc7e6-db4e-49cc-88e2-e9945d391bd2", "comment": "Malware payload (Mirai)", "value": "08dd9b8734963e7489305e51a7a09c99a29ee54064bc1560d9299923726a38a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731666, "uuid": "b123cfff-ecce-46e8-82a2-2e6206c239e1", "comment": "Malware payload (Mirai)", "value": "c06a99e6d0e231265ee34a8950a9bf017db06f58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731666, "uuid": "36994686-27fc-4312-876b-06e89e5e9411", "comment": "Malware payload (Mirai)", "value": "5960b2f2293482258c4f4287d910024d58576c7a3fdf57291ed961bc7a28d9d4696dd6620f9ed0ad853e1ca3e5ca9a83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731666, "uuid": "16336ba3-f95e-4df0-bfd6-d9b3d684fb77", "value": "T107D34B46FA408B13C5D61BB6FA9F414A3322DB94D3DB3306991C9FF43F86A5E0E26605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731666, "uuid": "e9701d26-b9cb-45b6-8cfd-7f0ff9929cec", "value": "3072:hlGpxllmptZjbSy5IAQY8VehGla9EyxVEEzv:hlGrGjSy5IAtwe4a9EyxVPzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731666, "uuid": "bc199852-2487-4651-9728-028eb0f9a938", "value": 139640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731666, "uuid": "6132ec4e-5fdb-430d-a89c-688bd3258aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731666, "uuid": "e0950cb2-7861-47eb-a249-c9139e403c24", "value": "arm6-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03017f8-ba42-11ec-8e58-42010a9c0032", "comment": "Malware payload (SiMayRAT)", "timestamp": 1649755612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755612, "uuid": "fa601bb6-dc9d-43b8-85c2-4786833e381f", "comment": "Malware payload (SiMayRAT)", "value": "8205ccb910dc783efcd7d480ef1bd7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiMay RAT", "colour": "#88045E", "exportable": true, "hide_tag": false }, { "name": "SiMayRAT", "colour": "#40D094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755612, "uuid": "55c88797-ce48-4c4d-8d11-a75344741926", "comment": "Malware payload (SiMayRAT)", "value": "09a1d00d4d99f1c30377a5e83f40f78404b9b3f466aef19d6997dbb3ad895b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiMay RAT", "colour": "#88045E", "exportable": true, "hide_tag": false }, { "name": "SiMayRAT", "colour": "#40D094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755612, "uuid": "afe59c6a-7b43-478e-b67f-0459e3dca70a", "comment": "Malware payload (SiMayRAT)", "value": "cfd651063c02bc84f7563866c3f3277102f05500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiMay RAT", "colour": "#88045E", "exportable": true, "hide_tag": false }, { "name": "SiMayRAT", "colour": "#40D094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755612, "uuid": "553cff5d-973f-4e01-bed0-cea965c5d6ef", "comment": "Malware payload (SiMayRAT)", "value": "5400e1b3691359f99deb7ae3968b48fe201b4698b6140b72bb6237bf79ba133e11a58b834fa2c977917260bf27891853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiMay RAT", "colour": "#88045E", "exportable": true, "hide_tag": false }, { "name": "SiMayRAT", "colour": "#40D094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755612, "uuid": "cf9d455a-e6ac-418f-bee7-a0b7089f5451", "value": "T187B55B10E7419019F8F301B35AFC55AD5868BD304BDC10C771C96AEF5A6ABE26E32B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755612, "uuid": "27745c27-d1bf-47fb-9d06-40e15ff1ca2b", "value": "36340fb4c28ed8883da72395e05eadf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755612, "uuid": "febe3f7a-29e3-4c64-8772-e627021274c4", "value": "24576:KNh6+tSDjdE+RfDfEEorQN0gGzCcF81E0rHsey8q7EMcjC3k:G6+tSDjdE+RD0YF1E0Aey8UfwC3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755612, "uuid": "a893c005-3df9-4db1-af4e-1039f75893b7", "value": 2277376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755612, "uuid": "61870a41-a994-47ef-a82c-3e16009ef841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755612, "uuid": "f2963bb1-2309-458e-ab92-4ed847801167", "value": "09a1d00d4d99f1c30377a5e83f40f78404b9b3f466aef19d6997dbb3ad895b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a01647-ba52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649762222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762222, "uuid": "039f25f9-1de0-41f2-bbfa-39f0aec995a7", "comment": "Malware payload (Gozi)", "value": "3276454ebcedec7d26569941909ed591", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762222, "uuid": "0995231d-79ff-4f71-8a8e-36e1c76e86f4", "comment": "Malware payload (Gozi)", "value": "0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762222, "uuid": "bf64a607-72e8-489f-ab31-9851c8705188", "comment": "Malware payload (Gozi)", "value": "fdb8598e443f640127bd841bc22ee2debd5cc9cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762222, "uuid": "b98fe13f-5892-4767-b3cb-695472b7046b", "comment": "Malware payload (Gozi)", "value": "c7c8ea420e867e22e676ca1966fef809bf1d7af0da247dabcf4e577f1a908e641e3d98ff8139f34bf8a99d2aa08da5cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762222, "uuid": "5b76bb4c-8652-40e0-8a97-bfa79f4b084f", "value": "T1A47412DD443F3C92EEB662BFA20576AB4CADB90403F8C047D852E2ED81B587C85A45D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762222, "uuid": "c7d6b749-aa1a-4fb5-91ea-85c7b29ef148", "value": "bc8a4cfa38a985345c4181a337867930", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762222, "uuid": "3faeade8-e34d-4d19-809a-b2915164f8dc", "value": "6144:6SQ8kTHF8UH1LM5nrR0XPfDq2mFVwyFYsQ+3SwlyrVHN+2O:6SQBTHF5B4rR0/fDq2sVwyGZwYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649762222, "uuid": "ef5add6c-6593-4ad4-91e1-2f821664056b", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649762222, "uuid": "f59344fa-1c2b-49f3-8ca3-509ce9c60d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762222, "uuid": "5fb9192d-2de2-42be-b873-c9462e1434d1", "value": "freeofice.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6ee00b-ba28-11ec-8e58-42010a9c0032", "comment": "Malware payload (WannaCry)", "timestamp": 1649744201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744201, "uuid": "be61f680-e9fd-4817-ac4c-bc80e9387cfe", "comment": "Malware payload (WannaCry)", "value": "257f95b9bc8580a4574fd43a70e05db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744201, "uuid": "5285ae30-5d05-470b-b7e0-bd50e467e00b", "comment": "Malware payload (WannaCry)", "value": "0ac016cf9360c69168137c01c3c89256ad8b6d45ed46cbee65414efa83a765fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744201, "uuid": "f5a95f94-d21c-4019-b074-1fb2aae709dd", "comment": "Malware payload (WannaCry)", "value": "8660399289694caca823c454a98405dd136371ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744201, "uuid": "b994817c-3393-4c0c-9ccc-5df3944d7628", "comment": "Malware payload (WannaCry)", "value": "417d705f926913aa2aa0536ac7fb51e4ca550765bd0555888881733634782fc47b1003b49e03dd16f288be96365b9934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744201, "uuid": "20c11b9b-501b-4e5f-a02e-01810866942a", "value": "T130061211D2D42AA4E6F20AF61575CB10973A7E529A6BA72F1261410F0C73F4DDEE2F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744201, "uuid": "ed3452c1-ad6f-4d54-83b7-ef22d6371769", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744201, "uuid": "14ba6e90-9bf6-41f2-9811-8b8b577e04f6", "value": "98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2m:XDqPe1Cxcxk3ZAEUadzR8yc4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744201, "uuid": "4c79b1cc-a402-4701-9128-104cc3758ffb", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744201, "uuid": "a5aa441b-8cf8-4366-9e80-7725f6aa91de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744201, "uuid": "e80ce921-5f19-42cc-8ee9-332f9a0ef760", "value": "Wannacry.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b8a903-baaa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649800264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800264, "uuid": "8cb9dc00-f695-490d-9ebd-ec83bb383712", "comment": "Malware payload", "value": "0dd306691d13b94429fd366085af644a", "object_relation": "md5", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800264, "uuid": "ed133640-0664-43d1-85c0-15a200187811", "comment": "Malware payload", "value": "0b36de4d494a750aa46e2c2ee60b515b30e5a86beb9de8142dad54aa79361eff", "object_relation": "sha256", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800264, "uuid": "1b60b514-38ef-4946-9b8b-a190f9cdbfef", "comment": "Malware payload", "value": "a4df55eb0d8c88141c8888b6f337182d727ec38d", "object_relation": "sha1", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800264, "uuid": "11b93f3d-f8e8-4364-9b82-fd946247cb87", "comment": "Malware payload", "value": "89bce0515416a0a382253376667acf0cbc5b2462030d4650d278e9de930564191df2fafa55ae4ecac59d8eb3bd2ba589", "object_relation": "sha3-384", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800264, "uuid": "7fbc19a7-df9a-411a-8920-b157634c1619", "value": "T183B63336A210B642C2B8EB34EA4F561B5F219D0C035FA70F535C87D98C91A967F2A7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800264, "uuid": "f3f60f28-43b1-4368-a886-dc0c5926ae7d", "value": "196608:PyMPyQji9k6h5zoy7xoZSbL9A4uVCoLxpKAp6CDX3MRTYs9DK+5+9FK:PyAekEz7xqSW4uVCodQMLs9Dr5+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800264, "uuid": "61552a19-c063-4ad7-98a8-5d72f47e9b52", "value": 11134502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800264, "uuid": "800fa86d-7265-4bd5-8d8b-16fd263b31d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800264, "uuid": "0baa5e46-1197-4560-8b6f-3a61b80e164a", "value": "gmtax2020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90dfb8a-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649769398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769398, "uuid": "e41436c3-b784-42b3-939b-795bb1b2be00", "comment": "Malware payload (Mirai)", "value": "9c746e26c80f52847ba1a1eb7e05acbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769398, "uuid": "844c1bff-ac1a-44a7-9927-0568214ce9fd", "comment": "Malware payload (Mirai)", "value": "0bd0e783ede56aa2a1d32c2c3e4d596a8942376a4d23b510548b11c79a8663ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769398, "uuid": "b393c68e-d696-4472-978d-9322c55efcc5", "comment": "Malware payload (Mirai)", "value": "bab588cdf82fa511a09d0b2883e026ba36bad335", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769398, "uuid": "17e20502-ef87-44a2-8f31-4a47c675ee58", "comment": "Malware payload (Mirai)", "value": "db278538e5507c512e4859b4b22cdaac3feaf5287de817059e6cc3fdc68a72eb86d4788fddcc46087ed1467466c5d822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769398, "uuid": "16bd1552-fd45-4745-876b-54f2da5ec830", "value": "T11E333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769398, "uuid": "caa5195e-8ccd-4285-9c14-43fffd6c429e", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Dh:dsfIBZeNlJDFj0imvppqmUJP6Lc88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769398, "uuid": "9550ba63-c072-4bb4-91af-180b0094c2f7", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769398, "uuid": "e0506c98-c263-4155-9d22-d705d0dc8776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769398, "uuid": "8e8e3b93-d5ab-490a-b75b-44b4e1a82f7c", "value": "9c746e26c80f52847ba1a1eb7e05acbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5864f22c-ba8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649786818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786818, "uuid": "99ffcc91-b520-493b-835e-de096bec2e6e", "comment": "Malware payload (Formbook)", "value": "57d14055819d12a751c4a28cd55f65fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786818, "uuid": "0694a701-a912-4040-8d33-419c1e424d51", "comment": "Malware payload (Formbook)", "value": "0cac8ae6143ca74f0cd566c8ded5a586f03d9be060d2bab62513ccb4382196db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786818, "uuid": "5e475bb9-7529-4458-926e-5e62b39b8a8f", "comment": "Malware payload (Formbook)", "value": "70f6ca046ccbf4ce95bb2df8e0776472cc226e75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786818, "uuid": "795a7051-4bd6-4707-bf47-f57b7d5e679f", "comment": "Malware payload (Formbook)", "value": "882eaeef6bfda6a04498529c69e5e1d4290f129fa1553618c98b0ea9142fd601baf2b7cbf1d0804e65c9c4aec72d45bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786818, "uuid": "037e6329-a0f9-4115-9b4e-8a7b00e0e578", "value": "T1D1C4F120F2A96FA5C56A03F90C34A14407B67B5EB53DCA1D6CB771CE59327C32622E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786818, "uuid": "6cbd32af-3b63-4ac5-8ac6-9ee31d572324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786818, "uuid": "e76945c0-eb34-4226-8b7d-03f25cd47068", "value": "12288:UotR4qiieB39iQSbBNLwKlaKWKmfsYS2lTLEF2GA+D:UoAqipZ9iQ2n7WKmVJkF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649786818, "uuid": "df2330a1-d644-4c27-80c5-c8fe153b791c", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649786818, "uuid": "e704f4e7-c3c4-440b-9267-fa1aa825caab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786818, "uuid": "cc38acc0-5789-4d2d-9723-6b099cc33f50", "value": "orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b99df9-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764482, "uuid": "0d6ac104-eebd-4e4f-a59a-60c750939b2c", "comment": "Malware payload", "value": "dcc7e0f5a9f4cc26b189c73c6c498cb5", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764482, "uuid": "d6cfd35d-d50d-4f3c-ae7c-65a2fb0003a0", "comment": "Malware payload", "value": "0d39c74b9b2d8f9f6986b5ca4bba3f47e75e3ec3ee14c6ecf9beb350fb08d56f", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764482, "uuid": "064f207d-ba95-4de2-bf04-41324404603a", "comment": "Malware payload", "value": "db6dead302ec04329312b765be16b6679f1e0277", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764482, "uuid": "aec1b7b1-9620-407e-bea5-f4ccbae4d8d2", "comment": "Malware payload", "value": "1aecbf9cfa118c19a66715773cb1325313d4a89285a0697b6a6e517bb827448a570f51d443989ef2b38dc0c43f7fe00c", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764482, "uuid": "a694f151-cd8e-4697-a28f-1e7c38368bd2", "value": "T17FD46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF360305993951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764482, "uuid": "0138e15c-a6e9-4cad-baf6-0c3f2b53086d", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764482, "uuid": "3d97675e-57ae-491d-86eb-0b2bc5c0e533", "value": "12288:D0Ws7IMtR4yVld8bzbBSredsgFK/UqW1:D0bdkX10cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764482, "uuid": "e78cf028-60a1-4c4b-b349-2e75dbcd7c92", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764482, "uuid": "14271647-7161-40da-8441-132db4073eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764482, "uuid": "2baeb28c-f6a6-412c-bc64-79bf1ffa65ec", "value": "PO1.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0de99d-ba70-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649775173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775173, "uuid": "cf9db96c-77ae-4463-b448-362c19884996", "comment": "Malware payload (Quakbot)", "value": "7f7eb5c76aae5940ce5f597f3aee6c28", "object_relation": "md5", "Tag": [ { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775173, "uuid": "eaead70c-f7e6-40b1-aa25-b7c2d2290440", "comment": "Malware payload (Quakbot)", "value": "0d68b63e9e3d7d86f72f2a1616f56a4d5f07c4d4d19c4f8d1c8aa3838249cfa8", "object_relation": "sha256", "Tag": [ { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775173, "uuid": "92b61c7d-6cf2-473e-b906-a0b5b27f9e72", "comment": "Malware payload (Quakbot)", "value": "807f12ec5ca8617c4958591027f3cabbf371b313", "object_relation": "sha1", "Tag": [ { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775173, "uuid": "4f33e94d-be02-49e7-9460-281a12605c54", "comment": "Malware payload (Quakbot)", "value": "1b2cf6d157c82c3b58f6fcd7e52daa67dc2b0a610bea86e9ad6b4c7cf5954531740f3b27e9f4fdd93d9cab7b3ef19fad", "object_relation": "sha3-384", "Tag": [ { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775173, "uuid": "0099b36f-a1a0-4db2-a129-9ba420b148be", "value": "T1984533C799FAB154302D3F6E053C57184F8DB65F012B92691ECBCC0A465FE376B28A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775173, "uuid": "5195883e-2538-468f-acb8-35e2b3cfc2c6", "value": "24576:nZYhaKX5aY3cAbJSGLWKSCsSMUy0layC2+ml:ZJWEY3rdfWKymTChml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775173, "uuid": "a7f6f882-5b11-49b8-9919-bacc4f0df6df", "value": 1204412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775173, "uuid": "f8ac458d-3b5f-4280-88c2-1fad53a24c71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775173, "uuid": "68b3f53a-939c-4d7b-a9aa-edeec47b216c", "value": "REJ-1322382398-Apr-12.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d05db9b-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (OnlyLogger)", "timestamp": 1649765888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765888, "uuid": "5256daa3-fa49-4c81-8294-110c8e75d88c", "comment": "Malware payload (OnlyLogger)", "value": "cce10abf0f8c5616d78b48d0ed40c77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765888, "uuid": "ff015ea1-6d47-4738-ac6c-9e33986318ec", "comment": "Malware payload (OnlyLogger)", "value": "0d7a5f4194c7348e910e41fdc811c3ad3b375f49a2f7227bfda8fa6727ab2d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765888, "uuid": "5d5570bd-9ca9-4a6e-bf94-2273aff50dbb", "comment": "Malware payload (OnlyLogger)", "value": "635d157033363632181003017466a1b08912302f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765888, "uuid": "e454f224-48ca-49c1-a996-6464309b1125", "comment": "Malware payload (OnlyLogger)", "value": "b72d098f0c5e3fa630b85649797eb383d46e5ec2a903feaa6164b81a56ad7109872c03552051f93dd728d80423728bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765888, "uuid": "9b254caa-ab9e-4dcf-b7e0-9791ffa91165", "value": "T19E84DF3139D8C471C4935D314824CAE49A7BF8222A61E587F7A8276E1EF0F8C9BE525D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765888, "uuid": "14d2ed41-24d7-4967-ba75-b783f2638cfa", "value": "44ee62a4400af83b87d8ba40d9bab42b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765888, "uuid": "6a37b090-062a-452d-a367-fea743814475", "value": "6144:64jD1uKAcrV8neut+LGI+4S8jVCR518uzbgwu:ENfepLw4tjVhunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765888, "uuid": "1e41190a-fe7c-4d86-9e87-f194b8e0ebc3", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765888, "uuid": "62decc0c-59f2-4d4b-98a4-f4dc5b54ac5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765888, "uuid": "d9cc0e1c-be43-4184-bbc8-4f5064dd849d", "value": "cce10abf0f8c5616d78b48d0ed40c77b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4befda55-ba20-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649740841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740841, "uuid": "c675cf9e-bcf3-4afe-9a69-df7186e5f61d", "comment": "Malware payload (RedLineStealer)", "value": "7c07f9f61e28671bf04207e132107403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740841, "uuid": "764d5c48-9cf9-4d4f-a886-b2a002032774", "comment": "Malware payload (RedLineStealer)", "value": "0df3757d9b6ef2146a376e1ce88c674320a3ae9aa44b26f1b0be4a37c226a7a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740841, "uuid": "aa791322-e8d7-4d28-a42c-0ac64aae55dc", "comment": "Malware payload (RedLineStealer)", "value": "67e13de56ae18e73180d331657149705c67ac3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740841, "uuid": "da6c0528-f635-4082-9052-7a19ec00fc58", "comment": "Malware payload (RedLineStealer)", "value": "370b81f27b8de3a0c91974a6d94a1d798aebce6233fe4f826e5bce4ef2e66adbf3f287305243dfaeeedfd93432235992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740841, "uuid": "71766731-19e5-472a-a7d2-d42b62e28d66", "value": "T13BA35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866917EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740841, "uuid": "c639e20a-fb78-40db-9037-5666d3ecac61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740841, "uuid": "455dd2a8-b645-423a-b7bd-9d0ad6529599", "value": "1536:Fqs2haqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2OtmulgS6pQl:D0aKaYP+zi0ZbYe1g0ujyzdCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649740841, "uuid": "034e8cf8-3fb5-44fc-9161-5d09d841e1e6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649740841, "uuid": "eb172756-5e13-446f-9d4d-e0a015f2e23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740841, "uuid": "aa2eb983-f2f3-4de1-815e-4dedd1158494", "value": "7c07f9f61e28671bf04207e132107403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957796de-ba3c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649752991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752991, "uuid": "092febf3-8bc3-4249-be6f-0279d66ace31", "comment": "Malware payload", "value": "87ca1a0fbfafe453f0e23b6d0d05e43d", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752991, "uuid": "f7ebd7fc-74f1-439d-90b3-ecd9a67f28ca", "comment": "Malware payload", "value": "0f251e20ed8ff4510e7d97bc2245f9c51095e5899daf92e8ccf279f0b8c7f3a2", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752991, "uuid": "a14ae12a-8172-4fd3-ba6f-9c4c85b194af", "comment": "Malware payload", "value": "503db86eeede41e49291c70498f36a63cb551dc4", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752991, "uuid": "d20b2c2a-f536-43ca-8ac4-1fe4a77262c7", "comment": "Malware payload", "value": "17b68ef9f041cd7e9b30b72cd41166543801e35647c9a4106be55ce2f9dbae2700022c277012084d3bcba7fcefcbf6b8", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752991, "uuid": "911e3a2f-bbac-472c-b427-9298d7ec6fe8", "value": "T125415205A4C497546BE3BB8C378AD449C9DBE64F843B186A4989C1DC352F0D850EABF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752991, "uuid": "d5ae4876-f7d1-407b-9be0-cd184d34e863", "value": "48:VyV2UL4paV2WaQoTO18p/hMY1RWHxXiV2Rv2mzQkVJHVJ/:oBLQedaQoTOOpJj0Hd2+pQkVJHVJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752991, "uuid": "435cf87e-da54-431e-b39c-8a2011d39dd3", "value": 2346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752991, "uuid": "37cd53d5-1fb8-471b-8eb7-b1025bd4ba18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752991, "uuid": "77ec9e5e-4e6d-483c-b159-1e13e3f2132c", "value": "kdsd3.ahk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3620f3e0-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Renamer)", "timestamp": 1649767433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767433, "uuid": "d8c94624-de48-4355-a4ae-2d4fbf921b7c", "comment": "Malware payload (Renamer)", "value": "600dfc4fcecc6a99698b517b52d2c5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767433, "uuid": "4d72597d-ecf4-4c26-9dde-fc611bdd2741", "comment": "Malware payload (Renamer)", "value": "0f27435dc99ba92e020aad22e345af6c0e838d585ec87064204c34e90d3b000b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767433, "uuid": "74468406-f77c-4985-b484-64f4d5d3e8da", "comment": "Malware payload (Renamer)", "value": "5f55a92a9e3062d094450f24a3fd255abcd675f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767433, "uuid": "206b93a5-8d02-40dd-8daa-da6b4bef5b3b", "comment": "Malware payload (Renamer)", "value": "c8c263aff9101785c9390e6e0779a1d4cecdae350e04b5ef2bf5f59760027bd8954f92067d0dabdda92641edf73aa424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767433, "uuid": "a427df5c-85d0-4d2c-8e3b-fa609e4f146f", "value": "T14FE423B225EED423C41ADB3456771124FF3BE35866824DA7374C2D2B95F0AFA1422E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767433, "uuid": "fc61d9f2-1d8c-4e9a-9434-8a1ada41ef26", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767433, "uuid": "a2fa3420-08c9-4e27-992b-44e148b7fdc9", "value": "12288:TUELPrk5KAqHXMH3b47AjPjBb/0Iw3vNLXO4TvIzQMnZJLI/AmB2DbVKZe8:TUQwz3b4Aj1r0N3lLSfdmB2DBKZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767433, "uuid": "905901e3-c64f-4e9f-8189-469e6f1462be", "value": 689794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767433, "uuid": "4700c4e7-a09d-447b-9675-2d33088f86ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767433, "uuid": "aedc2b9c-54f7-4a8a-9933-a45f92a8436a", "value": "600dfc4fcecc6a99698b517b52d2c5d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7ec6a3-ba4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649759495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759495, "uuid": "26fbf6e6-41ea-471e-90d1-4db7b8357e81", "comment": "Malware payload (Gozi)", "value": "96cebbecd390842784c0e777a69677ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759495, "uuid": "aaeff5c3-e4c3-40bf-8fc7-0e7018bf85de", "comment": "Malware payload (Gozi)", "value": "0f30906e13c08e424cfbeab1b11b5e9e9288798e6de9be535709c56228bbc4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759495, "uuid": "b9b22f80-09f8-4e20-928d-97245476afd3", "comment": "Malware payload (Gozi)", "value": "b7d3a99c33470b0dea074ba1dfb2f2212db8f8a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759495, "uuid": "d054d9ef-de76-4787-a7e0-1aacc63e5e73", "comment": "Malware payload (Gozi)", "value": "9ad223bcea769246b83c0dc71416fae2b39eb7e307b38a2c44cdd386830d6e9e199066161465d51acb203f230bf1f8a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759495, "uuid": "b7132489-d313-48b2-96c8-5b2dcc7f1124", "value": "T133C45C00B692E03DE8B731F94FAE912DA51DBED0172050C753C51BFA9B366E07E3166A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759495, "uuid": "a4b2dfe2-0522-40bd-a82b-b86bbcfee68b", "value": "3743526d94457fb013584724635b7f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759495, "uuid": "6da3f4a4-6b60-4c67-8f5d-30e6776e2ac7", "value": "12288:kt1GYxq+AVzmKoXmysHMZmaOeVIKjoiUBZ8TOXXGN93Wa:ktQkQmKoXmysHMZDVIDWUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759495, "uuid": "b995f0ee-4f54-46a0-950b-570d06b563a4", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759495, "uuid": "0ab0125f-10fa-4973-8b20-039331c333c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759495, "uuid": "9927e1fe-43ef-43b3-a318-15d2d3903dbf", "value": "0f30906e13c08e424cfbeab1b11b5e9e9288798e6de9be535709c56228bbc4a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a91d7fe-ba23-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649742074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742074, "uuid": "827e3ce9-dbc3-4c4d-b6cd-b7cf17e0007d", "comment": "Malware payload (AsyncRAT)", "value": "4c64325f66e78a405fbefaa4a9917877", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742074, "uuid": "fa2cab50-980a-47bc-ac8e-bd5a579f0fb6", "comment": "Malware payload (AsyncRAT)", "value": "0f3cb5c6ae2f9e0f0abdb0e5949e53fde0269da3e0fc088688a45a7e6e1f8977", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742074, "uuid": "8a09865d-d5bc-47b3-a684-b80bdb46f4e2", "comment": "Malware payload (AsyncRAT)", "value": "ad52d0d80bc47daa010cc142807aa4d5ee4fd457", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742074, "uuid": "6196450d-c788-4642-aded-6b22c0c61167", "comment": "Malware payload (AsyncRAT)", "value": "c9739c396bd1c33f6e6877483aa1abf707cdd99b7e07c49dc9281646cbf736c2a315f3ec4211e71548c65367da2f6755", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742074, "uuid": "d38247b8-f955-4a7f-8225-65050c254686", "value": "T14D05F12BC3F5D909856A4DD99524358FFC248D06FA2128A0234B8BF077A67BF316D735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742074, "uuid": "5b51f2b4-ed9f-4288-9c8c-f497007af976", "value": "24576:LEvPafMpNZsgKnDrxwUgN1MLrlVZ56Wc4WWYucCb5:SifKKnDg7MLrlV64BYuBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649742074, "uuid": "1f3cabfc-b3bf-458f-af6a-53325f9a8b22", "value": 810157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649742074, "uuid": "8c3c0498-0b40-44d7-8af5-9f48e46802e5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742074, "uuid": "49f758a8-a4b7-4526-b659-33aacb057036", "value": "Pago.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a16e65-ba81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649782789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782789, "uuid": "e4e0b269-222f-4f2b-84a0-3cbe1d5df89e", "comment": "Malware payload (Formbook)", "value": "2bb1c9b566c1e5e0b26cecffaad6b859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782789, "uuid": "1ddebf36-aa8a-4fb9-ab92-922a597bcd63", "comment": "Malware payload (Formbook)", "value": "0f91e080cdc1fbe9586f0da5ac31afe72b931cf71d3b907495687316dfb82a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782789, "uuid": "432c75ae-ce42-4054-a179-0cfaeb938599", "comment": "Malware payload (Formbook)", "value": "a8ca837b18a458c7b77d5952dfbbd6640d2ea63f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782789, "uuid": "0418f5a9-8065-4f7c-a513-4d3d5aedd8d6", "comment": "Malware payload (Formbook)", "value": "1182b225213d0dbb0441fddb40649808f8aed01f248380a6e3275f77508d34b09a8538830d8a3b74bb89c25f5add4cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782789, "uuid": "3c21b993-94f5-491a-8b47-7a08ed931d53", "value": "T1FBF4CF49FAA6C912E2A91337C0E7080407B4AB82D517D72F3791A6E54D433EB9D137EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782789, "uuid": "8089f7f3-c0e4-4c37-83d1-ac74af32be86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782789, "uuid": "008414ca-bfa6-4868-b8d8-5eca13b579b1", "value": "12288:x7OHjj46Wn684qj9GnmJaQkv8VidWNhdYJJyJrATn5Sg2g6:EHftm6HqonFv/MdYJJmin5dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782789, "uuid": "82e196f6-ca74-49b2-b41c-9f4459e211df", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782789, "uuid": "b6190e6d-0191-4150-a255-f24de681964b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782789, "uuid": "94a1396e-28e6-4ded-8957-43e34b2324af", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf4880d-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "ddfe930e-35bc-4792-a027-6909a15e99b9", "comment": "Malware payload (Mirai)", "value": "1d68430b36688917e6bc5cbc8cfcb581", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "fc48c65f-8d26-4493-aa1f-8b5e959ce825", "comment": "Malware payload (Mirai)", "value": "0fcbd8858da7d921b14011e1162780e6f7efa4db5a8adae381d982c0f5a5bdb4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "204a56a5-891c-42dd-b36c-e5175a12970a", "comment": "Malware payload (Mirai)", "value": "e7092c80d01451e19757df05f3f3ff33a1679e40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "000f7a56-f1b7-48b3-8791-66490a586780", "comment": "Malware payload (Mirai)", "value": "9af558b810f4a0bfba26e336b8794cd740e04e5dac42fb6c7b19b94e90d7b2c5c4bc69201f233a14f0e8e46daa54a1e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753406, "uuid": "e637dc14-3e38-4004-9daf-89e7bbb6dc70", "value": "T159C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753406, "uuid": "f40fd554-e5ec-488e-b469-c153ef5d5900", "value": "3072:4jDy/+mh1vtbPIKaZbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaZbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753406, "uuid": "c9bda3b0-c11d-4a89-ad25-393820e195d0", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753406, "uuid": "89a8127f-62df-47f2-870c-b9b0d98ef065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753406, "uuid": "19172a88-250c-400d-bbb3-5b942f73fa04", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b104c77-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800567, "uuid": "bf082642-e71c-4c92-b4c2-80ccb62ab662", "comment": "Malware payload (Mirai)", "value": "b9a656fa1651d23e676d7518ea077cec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800567, "uuid": "98980565-a636-4192-97ed-7ca79509f7e4", "comment": "Malware payload (Mirai)", "value": "10268427080b7b76a8d27c91edac9f7b3b06b8dc6acd002a680fcac4091a3955", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800567, "uuid": "d02f412d-1476-4615-9a9a-928c395f1db8", "comment": "Malware payload (Mirai)", "value": "78f6d99036e8a822b8dedcfc09cf35c5f9e9f108", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800567, "uuid": "6b0da8b8-a3f2-4b9a-b095-4b286fbd72fd", "comment": "Malware payload (Mirai)", "value": "84b7866aba741dea87ddde7dbfd405f85b537cd0ee1de5888e83ffef5551356c2caed78ff5a5b1c067a2d57f1b8f47a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800567, "uuid": "ca6a39d0-f23e-44b6-9af9-1e66c8077eff", "value": "T1305339C2F48B45F2D8074470609BFA3F9F32D9EA0271966EEF96AE31DA6B103510764D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800567, "uuid": "97461dc9-00fe-49db-9e21-48bc10e52fbe", "value": "1536:XIPEtADgzXBIYaOqsDe9YDI4M3mhsC5w63La:XIPEtADgzXOY5RDgY/M3mhsswk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800567, "uuid": "84de82c4-6dc1-459d-aa38-272d48834cce", "value": 63700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800567, "uuid": "0222068e-929d-4186-b491-42233683bd08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800567, "uuid": "3d465832-ae13-449f-ad11-95c95875231c", "value": "b9a656fa1651d23e676d7518ea077cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189f6b69-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649782846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782846, "uuid": "19e7cb62-dedf-466f-9d8e-ecf7b13c2a27", "comment": "Malware payload (Smoke Loader)", "value": "28c89f207f05b6b870d3bf70b922d45c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782846, "uuid": "890212de-c447-44a5-a204-efd6a20c8565", "comment": "Malware payload (Smoke Loader)", "value": "102c6092244b69cd98621bb38d89556b311b1a04f53b79a757a88d6fc8bc638c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782846, "uuid": "f47bbc00-34de-4b4e-bcd5-8a10d12c57ca", "comment": "Malware payload (Smoke Loader)", "value": "88d06d2b7c16631f1afd2e17fd1b476e859a73e8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782846, "uuid": "f140a9be-8bb2-4558-bf29-ab5d64801ed7", "comment": "Malware payload (Smoke Loader)", "value": "1b18f091e7571e70d3cd02f1a6f6f93a3f739e1dc65c912997939c2298e24577258370ca78da51504b8469f312c092d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782846, "uuid": "5b6d91c3-ff43-4ba0-bf83-9d9b4684ba34", "value": "T11254BD92B6E0C832D5EF593C88B4CA946F3BBD126661814F766413FE6F726C14A2530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782846, "uuid": "0c93c760-dea2-4d24-b346-d88ffb07ef54", "value": "cc4918253c54eab1a1e051581c92623c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782846, "uuid": "99298ceb-2fae-4344-8d34-5c657e936aa1", "value": "3072:eJL4aCnNqWSUEpbvw6AOkZ1MyJiixaghs:eJL4aCnsVUEpsjL3aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782846, "uuid": "c67621e1-e56e-4005-8588-e7cc646997f3", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782846, "uuid": "22312762-4dac-40e2-909a-8c0cbdb26782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782846, "uuid": "642647cf-28f4-4bcf-aa76-a62641bf6fb8", "value": "28c89f207f05b6b870d3bf70b922d45c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f41f518-ba60-11ec-8e58-42010a9c0032", "comment": "Malware payload (Velar)", "timestamp": 1649768469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768469, "uuid": "ba625542-2205-4339-bc76-6375789f36f0", "comment": "Malware payload (Velar)", "value": "4482844622c6cc5027927a856e8bad57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Velar", "colour": "#E6023B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768469, "uuid": "be9c1a84-3d71-4868-a467-d6bb5426466f", "comment": "Malware payload (Velar)", "value": "106017ca2da2422722ecff4ce1fa74454f7964c0e4b5b45eacff97ec0b34903c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Velar", "colour": "#E6023B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768469, "uuid": "b577480f-b1d4-4a43-82e3-1c949f01e6e7", "comment": "Malware payload (Velar)", "value": "4b48e36da2db211a1eecea4fd7cd83ad3a4e58c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Velar", "colour": "#E6023B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768469, "uuid": "5db1f790-0c49-4170-b65a-d493227ca681", "comment": "Malware payload (Velar)", "value": "2f99665b9255552cf9c8d6971fec0a74869ed41d0fbbb4fbf4191a59584d0c1c211dddc6e41c776c377d79a79fe288a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Velar", "colour": "#E6023B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768469, "uuid": "b62ad1b8-1a23-4269-851d-11c03a34a1d8", "value": "T1ECB48C217573E171D422C5B48D3CFA9A751DBC680B39AAFB73E8262C6D712C05B31EA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768469, "uuid": "492de962-df75-40d4-9507-09fc44a53c92", "value": "90cf8aa2cfe36763db62cf676165e193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768469, "uuid": "de172b9e-d411-44d8-a554-372b62334bce", "value": "12288:nQ06YXH+OeO+OeNhBBhhBBRsQVoqvc2jzbAVTTAPlbPxIMxjHNivhFm2o:nQ06mstfzQAPlbqMxjSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768469, "uuid": "ae2cfcbd-2f6c-4087-a94c-f3353f7c58d7", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768469, "uuid": "dab08a50-1cfe-4c28-a0fd-7a49182a0793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768469, "uuid": "d74870c0-37e1-49b5-a681-a7fef076a901", "value": "106017ca2da2422722ecff4ce1fa74454f7964c0e4b5b45eacff97ec0b34903c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8011d3-ba4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649761133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761133, "uuid": "ba3ef6b8-bcef-4b64-9e5c-692854e4f51c", "comment": "Malware payload (Heodo)", "value": "99681915c83f7ef0ef4ce53d3e632909", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761133, "uuid": "963cd164-0453-4d4e-93ff-af799480c200", "comment": "Malware payload (Heodo)", "value": "1066fad0a3d3aaf8990c75959d3b0afe0e997c4056d9beefc647cd2c733a7c84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761133, "uuid": "c37c1590-558f-4637-a78c-66ddbc429bc4", "comment": "Malware payload (Heodo)", "value": "e75e5f8493d88e4fd12011994b7368df399014d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761133, "uuid": "80f6e007-ce98-455e-ac76-6ac9d23c5a25", "comment": "Malware payload (Heodo)", "value": "39fbf450b458e05e62bf2eeb2612aba94c7e44d36b2679a732ff33f17553d5a7375f33ba3f0f5229beb5727314175ca3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761133, "uuid": "af9e6b82-72ca-45a0-a8a5-f650305862f9", "value": "T1FEE4C24D7F918F79FC5D017098CC8F7AA995E87B4A904F022ED6EA3ED5BB1424D18C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761133, "uuid": "43b4e207-a5c4-4dd2-8338-bfc322e888a2", "value": "e140b4188c69c3bb4852b94813f9ec7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761133, "uuid": "7f3ee633-bdb2-4feb-b48f-f98f430df986", "value": "12288:aA9e3OrvpgqjtQFecW6dddifiHxoB3rNdV:blrvpgqj2FezQc3rLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761133, "uuid": "b5f8d133-3cdf-480d-99b2-11f4b6908f05", "value": 687636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761133, "uuid": "75b0e456-b3c6-4ec7-a2b9-6e9b15a8eadf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761133, "uuid": "5aa2b7a1-596f-4c02-a931-645324b40bc3", "value": "emotet_exe_e5_1066fad0a3d3aaf8990c75959d3b0afe0e997c4056d9beefc647cd2c733a7c84_2022-04-12__105848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9107074-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767250, "uuid": "b5a64441-cc0b-4847-abcf-5a09a8dbc6f4", "comment": "Malware payload (Formbook)", "value": "d4a0d50369af094f3b633627e4750161", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767250, "uuid": "ae5a93f9-8edb-46af-988d-25462d2aaf4f", "comment": "Malware payload (Formbook)", "value": "10e2bba18b754ed1872b952e1e1f43b2184ac3f6696eb711b1d59cc1fe9ab18b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767250, "uuid": "45196ea6-a1f0-4111-881c-e94ccd514a94", "comment": "Malware payload (Formbook)", "value": "0df8fd2f7518ebdd6ff7c5b1ff72f3608cc84158", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767250, "uuid": "3cf9ca6e-bc31-40a0-b6e8-2af2bb75962a", "comment": "Malware payload (Formbook)", "value": "dd5cceb67fef41818250a2225dd317f3df3f5c7b65a19820efc1fcde739d4fb88b9ce8a528af9042cbb3d1f2ed8f8f06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767250, "uuid": "7ab48125-4a0c-41ad-8c12-755425fc6ba5", "value": "T16134139E30D088F7EDD48A701A71A7E6DAB7A766121301F7FF741E6D36088996C4F006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767250, "uuid": "7c3f0a17-eb70-45fe-a41d-f7a022473fa8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767250, "uuid": "93adfc11-be6f-4569-aee0-0afb6a269542", "value": "6144:8Qq+DOAzZclkp1JHjH9vdrfQ9oc2+qiHTira8lIr:TDOq+l81JL5drfSB96C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767250, "uuid": "8d116cc4-35d3-4be6-807f-bf13c1331bc1", "value": 242123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767250, "uuid": "6dcf6214-ed0d-451f-b730-a39f856201a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767250, "uuid": "1bb5356a-c938-4e12-8070-250ea3d5fed0", "value": "d4a0d50369af094f3b633627e4750161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7955782-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649769369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769369, "uuid": "23edf89c-2279-4597-aa6b-f8ef917b8daa", "comment": "Malware payload (Formbook)", "value": "83d920b7ab3b968a5ce1f2eec5090eec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769369, "uuid": "a9e780c4-3638-40db-91e7-6f8fa464c099", "comment": "Malware payload (Formbook)", "value": "10fc8f0ad0451656949f8b77a87815c2efd7524374685f4b261732183858aa18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769369, "uuid": "84df569f-e66b-42ab-94a9-55c0a2af11a2", "comment": "Malware payload (Formbook)", "value": "78bc56b3cb96d8eb21875a36ab16ce60bb41efb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769369, "uuid": "32b3ba8a-beb7-4b60-96f6-203a5202d8c1", "comment": "Malware payload (Formbook)", "value": "4ab755473543f4f8bf9160e3205a1d89bfadc606c5ca86218db4015c601fe4079e4536b26b105107ccd467a7bfa244f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769369, "uuid": "f9f471fe-4fa9-4f73-95c7-d8e7ece667d6", "value": "T1FE34129872F1A077D61607B02B73DB36CB7AC2551E20A66793221FB52D31C87AB5930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769369, "uuid": "6962fecd-2dfa-49b8-831a-d8caedbf8bc5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769369, "uuid": "59b471a6-e265-4b36-a328-cef99ae5b40a", "value": "6144:8Qq+6aH8AQS6n7xk4LxR+I+RniH19ViyA9X:T6aH89S6vKrniHTVAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769369, "uuid": "9bc1af48-c8c4-46e7-8373-8f621127063d", "value": 242491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769369, "uuid": "e3fe7e58-4bc7-429d-a333-295c8e2c7b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769369, "uuid": "bba863b3-1b1e-4f2e-8d7d-98fb3ffed907", "value": "83d920b7ab3b968a5ce1f2eec5090eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb43f1f-ba28-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649744389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744389, "uuid": "ef40503d-73fb-41f4-9f07-245171fb2e88", "comment": "Malware payload", "value": "32e86a039c8e550d767060ad557272c1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744389, "uuid": "168c0ffe-0c68-40eb-9453-e5f541d3d0d0", "comment": "Malware payload", "value": "11240ec78f11a9f17cf5ccaf50cf7c484ccc7f6b3d0284c040b681029e255234", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744389, "uuid": "804de24e-f12e-470e-a984-1df23ae29739", "comment": "Malware payload", "value": "01f44f2816b259409a093e959531484f30722d83", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744389, "uuid": "7a385b98-9044-46df-aba3-8ab363ec9749", "comment": "Malware payload", "value": "f44ec07f9c511665c3e0a08bf145d450e758958da84737159f82d6801460699b17a8dc75e30baaedcdacfb74c23fcf80", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744389, "uuid": "9333ba3f-57a8-4e43-b95c-d208db16fd6a", "value": "T14404E8F22A7D4B80F67B9A72769FBA541132B56BDBC11E8003FCD5600BE97437D48988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744389, "uuid": "9fe8f358-f012-4c97-bc2b-57fe1992c37a", "value": "3072:aC5wpOrbbIb1nAHRsqNK+uGdGaqu2scDpMzAJP:b/rbbc12TmGdGaqu2scDpMzAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744389, "uuid": "b5f900e7-d782-441f-a482-f1a3558563c7", "value": 186438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744389, "uuid": "da0d091b-62e5-453d-84c9-7c73adfba321", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744389, "uuid": "bad4e421-b4a7-4623-8a98-bef5e1346dd8", "value": "11240ec78f11a9f17cf5ccaf50cf7c484ccc7f6b3d0284c040b681029e255234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c67e940-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (OnlyLogger)", "timestamp": 1649782852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782852, "uuid": "10e1bc45-ffd3-45de-8f1b-36321cf0e24d", "comment": "Malware payload (OnlyLogger)", "value": "94e67dcbea339db505156da3e3ff2a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782852, "uuid": "1da21a57-a9e7-497f-a27b-b5b3816392ab", "comment": "Malware payload (OnlyLogger)", "value": "115f8752ebac3ee88b35cb3770c791a4cbdd1e00534941dc231f5e3002166fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782852, "uuid": "e963e65c-5251-46c0-9706-f3c087dc7171", "comment": "Malware payload (OnlyLogger)", "value": "dce48b13f72d02910d5c0fd08dd90c9348954606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782852, "uuid": "cb1fdce2-c269-41e5-92c5-03a612f8ebc8", "comment": "Malware payload (OnlyLogger)", "value": "aeaf0f99bb1d0b5f02fd68dbb3844d7599ac0df78bb9e5a12e9a4a5c2df36107612bd8bd191df73c7b38a313dfca2d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782852, "uuid": "23b76ef1-e2c1-4e33-8cdd-f77f0b86e487", "value": "T1C074BE10BBA0D035E2B726F8497593A8B53E3DB19B2051CB63D426EE97346E1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782852, "uuid": "dac2590c-aaa2-4191-99c7-149ec01b778e", "value": "11caefc927578dff0bd17e4ef4b3bd12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782852, "uuid": "d3ea4064-4c2d-4b49-b132-25d977469a88", "value": "6144:wVvADf0ABpK4o1MvhoFafddPCV0L9pzd8fjXTNbgQQAvSStoFv:wVz+pKN1MTf22Xd8fXNbgQQfSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782852, "uuid": "00c05db9-f0ca-4a8e-960d-97f9f03f541f", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782852, "uuid": "4eef0312-9544-4588-92c5-058ea10c2adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782852, "uuid": "fdc2f32e-501f-46b6-9b03-5a6476f4f10a", "value": "94e67dcbea339db505156da3e3ff2a33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b92cdf-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1649775625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775625, "uuid": "926302e2-47d7-4fdc-a2f8-81f0e14af6d2", "comment": "Malware payload (BitRAT)", "value": "d1b84f222e7448a1ca4a366055df5997", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775625, "uuid": "dccee309-6e1e-4760-be9c-aef2cf422520", "comment": "Malware payload (BitRAT)", "value": "11963bdef0f063af12b02d084f9e2f162058e5f33ac604290b51704c980aa5eb", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775625, "uuid": "e2110587-b41b-40fd-a12a-259c38258863", "comment": "Malware payload (BitRAT)", "value": "136274c9f3ad2d8879aaee58321cf475d21f2578", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775625, "uuid": "252bddc5-656f-40cc-b41c-4e862c734063", "comment": "Malware payload (BitRAT)", "value": "5be3a2613dd6fe503a9d6b670d2dca8bcf26a30854f4e216bcd14af94c58c5fc91a8ccffbf778cb17c44fced06339db8", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775625, "uuid": "acc4553c-c2ae-4d67-b921-ba7bf697cd4c", "value": "T1C3227C20453C8C55CE8B8997EB71FD659AD7B0438BC7068B741DE8502BEDF09ABE216C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775625, "uuid": "24db31a6-02cb-46b2-861c-c4a27e79bb74", "value": "192:/dYDDynE2bE6vJeS0FeF3k028ZhZlV2FbWEkamsQu/L3TEbEPef08orihoV:/+DGEN6vJqYxw8ZhZIpQsQE3cBf08orx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775625, "uuid": "216e5fd0-d5be-4fb9-b66f-f05ba472ab47", "value": 10078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775625, "uuid": "7e055bf7-63cc-41fe-9895-32900fdfb498", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775625, "uuid": "392f32a4-1b2b-47b1-b617-556514ec46a1", "value": "Inquiry 12 APRIL 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd20165d-ba25-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649743205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743205, "uuid": "a68190eb-6d39-45d7-af0a-8e71c314929c", "comment": "Malware payload (Mirai)", "value": "26331a694d48d441c2b368458a7c1040", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743205, "uuid": "c8bc1907-807e-4055-b01f-7ecf50a996dd", "comment": "Malware payload (Mirai)", "value": "1227f0cf3c5ec1c08d98bde4fe9b80e3c1cbf4cd8e84ee0b96f337390b8827ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743205, "uuid": "77737057-28a0-4cc5-a7ae-c8d952c9787d", "comment": "Malware payload (Mirai)", "value": "e95e78859695762091964b982dbdfe7fc1536a46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743205, "uuid": "0e749eb8-d5b6-4988-b12e-20f815b5cc3b", "comment": "Malware payload (Mirai)", "value": "335fa11344f6b0c72b7dcc007c5906c88b8578a0c88d56ceab572d555e7b5b8691fb551dfa42eb085ee0db80f86ca66b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743205, "uuid": "9549f022-b0c8-4f28-bf5a-ac2508faed6d", "value": "T1A5D2D0B2E54D85E7E58D45B81D3F3E1E5030331A865161B2FDD4333A4CA5B1B2B38A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743205, "uuid": "6c63df25-e794-42bd-905a-f5ba9dd83ec6", "value": "768:lhf15dU1nvrQQ9R6bWj4mpdbP9boDM2TBR71YYqQ9nbcuyD7Uryqh:jXKNj4ybpdbP9bgF71fqQ9nouy8mqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649743205, "uuid": "c21ba923-1a51-4c2b-9935-8f27e02bd4fa", "value": 29060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649743205, "uuid": "73060ec3-c9fb-4232-9222-2d47f92a5bd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743205, "uuid": "dd999c29-81c4-4b0b-8c8d-a77201b7a170", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6574385-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764213, "uuid": "9933af44-ee40-408e-910a-de996eb82958", "comment": "Malware payload (Loki)", "value": "b7058c408fb42ab00c2f3ba55c84beb4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764213, "uuid": "f78d7cb9-f22d-44a4-9da9-5cb94adcf490", "comment": "Malware payload (Loki)", "value": "12529c7d367852ae7f0617a54c4b1b6952c1ecb05b1e156a63568f0f43746464", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764213, "uuid": "4408f235-eb1f-4aec-838f-19c3eb51e05b", "comment": "Malware payload (Loki)", "value": "9aadb17719b12f2ec348b1ae73159a77f03c6b38", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764213, "uuid": "5cc53882-e8e5-49c1-816d-88c5ebef71b7", "comment": "Malware payload (Loki)", "value": "98e696b816223f1b92050cf40b7d7b72ffadcd12fc9a04ed8c7aca7da35e5cc09490d3a0de1be29abcf1fd525780710f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764213, "uuid": "44e97967-3850-4caf-bd5b-340470d564a7", "value": "T1C474126832659727DCA76F740916836D7E52FC4E73000D2BAEA933DC7AB0D051BE670A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764213, "uuid": "8f42716e-4104-4594-8b1b-005cfa12c433", "value": "6144:+thtcE5zS6s4aefSnDIkyvdkTFu9ZjGuQJvuKNGzV1aGqLRUKUp2qfKhGHp3:+dc4s49fGDTy+TujGl5XkwLRCppDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764213, "uuid": "35968047-32aa-4a30-acab-6d12824b811b", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764213, "uuid": "52a2477a-eac7-4f9c-9bab-e486599ee00a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764213, "uuid": "bbad4259-cade-4228-8fbd-3b55411afd13", "value": "CERERE DE OFERTA 12-04-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546c9eb5-ba77-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649778222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778222, "uuid": "091445a1-1357-468a-bae3-11b73f53fcb8", "comment": "Malware payload (Formbook)", "value": "f9dddf0d01bb57344d1941f01914f509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778222, "uuid": "5978d272-7a8a-4f37-b4c6-efbcfe910897", "comment": "Malware payload (Formbook)", "value": "1341429ff094dd1085e9ca34321ea2a897c3d60faab00e0d4ec0e155aa12a0a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778222, "uuid": "e2fed7d1-561f-4290-89a8-cc2a055bbe49", "comment": "Malware payload (Formbook)", "value": "cc152a7a73ce65c3a99319833df29fb608a5012c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778222, "uuid": "cd11e0b9-8187-4d5c-97ab-ca576af90e55", "comment": "Malware payload (Formbook)", "value": "5c3b369102cb9dbf15053734ec7918386853c58fd4311fda1486166e25ab226cd51b9181d9216ee2c21ea1ae3508b451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778222, "uuid": "b06c43f9-3c36-450b-9a81-8a3c1cf8881b", "value": "T1F6350233BB55DD67CEECD23C0861BEC2A3F182225257D74EACCC91A9B7826D85B051C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778222, "uuid": "03feb7ad-5da1-4221-99bd-84bed41ce1b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778222, "uuid": "4c02cbe6-9e98-4cc7-9320-a0fc39d90d99", "value": "24576:ZFdBqCebfeuXVgOnZTgahcossNxi0i9q2FEhcC:ZFdBqCafeEVVZTga2kXFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778222, "uuid": "94197c90-c2aa-4985-b864-740f25bd1d15", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778222, "uuid": "6676343c-ddd2-4dbb-a5db-bbd459e73fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778222, "uuid": "e103256b-306f-42cf-9675-6d711510133d", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DWR.genEldorado.18853.11537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32100107-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649766568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766568, "uuid": "ee9ea5c2-1308-4a31-b35b-9c908e28d054", "comment": "Malware payload (Loki)", "value": "119efc0e9af6366dc0e5d6fd90e2c085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766568, "uuid": "622977cf-12a9-40c2-9804-27c8659d008e", "comment": "Malware payload (Loki)", "value": "1395c780635dc02af8f82f9dcc7b558adb0cc21a1ac08237784aee2dd554d55c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766568, "uuid": "9720cf50-1bba-4868-982b-ee5c58e47fe3", "comment": "Malware payload (Loki)", "value": "76762760976da88cd456facaa59dd9176f510c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766568, "uuid": "d2e934c1-095d-470c-bc6c-e0ef1bba3ec0", "comment": "Malware payload (Loki)", "value": "02b58f5043ca728939f3aaedf3cee8dd0ad30b3b14b9f70e3c3914625cf8ad6583fedb668ff09bbb9dc9244a3143aeba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766568, "uuid": "3b30316c-62fe-426f-adcf-97b7106bf21e", "value": "T10D449E00B6A0D035F1F352F88A7A93ACB93E7EA15B2450CB62D52AED57346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766568, "uuid": "8f046a13-d544-4211-8790-585aba8ca9a2", "value": "b2491f91b932b5e67844520efb025825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766568, "uuid": "c7e5e233-072e-46df-9c8b-f4900eea7a34", "value": "6144:OgKBFYPt/LOADFGWEfNlwKegoKHo171Hr+ytT:xKA1/LOADhyNl3JO1Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766568, "uuid": "d07d4d7b-bf81-42a1-a18d-d14c58be189c", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766568, "uuid": "f4351613-3d68-4a75-a412-f7cbb4213684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766568, "uuid": "f7d26ac5-3fff-4916-bda8-db6d53597225", "value": "119efc0e9af6366dc0e5d6fd90e2c085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3f1381-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649775923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775923, "uuid": "54876a70-3622-4bec-bbca-31a41714b161", "comment": "Malware payload (RedLineStealer)", "value": "d23377638cab0ee29ab55a5312279c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775923, "uuid": "ab96951e-595f-4157-b0ac-9d910ddd2ea2", "comment": "Malware payload (RedLineStealer)", "value": "148607dfd0bbe0d5b58268c6bd252a2cdbd2271e4f1b43138eb7de47eb51bf65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775923, "uuid": "cb2284f8-0e80-46b5-b0b3-bbf533baba5b", "comment": "Malware payload (RedLineStealer)", "value": "c97a094fb56509a79cdec0a56a5099d77aadd7a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775923, "uuid": "3adfd724-cf7b-4aa9-be28-6157bac6d8f9", "comment": "Malware payload (RedLineStealer)", "value": "6fddb885ca9f9de8c376ae11a58bec991cf6b2148ca52488762c3488a81ec61fa2db184720e48f9c0c72adab9774e059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775923, "uuid": "dcbed729-3594-4904-b6ea-6ce6cea5a672", "value": "T1A1958DE39741120FE356A03AD01E5E6D306217316F8FB8B3B78C5AE9E36B2D05529B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775923, "uuid": "2f21a8b6-fe23-416d-8bd1-db343deaa37f", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775923, "uuid": "16a7f0ed-6f08-4dfd-bdb2-308a0a800d93", "value": "49152:OyLn8FJA84OUFGC96MwhHFz5yYXNoqj1nPR:F8epFGC96MwhHFz5DNoqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775923, "uuid": "bf913915-4b2e-4786-901d-39b47676ebbd", "value": 1945864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775923, "uuid": "15132c53-7763-4314-9d7b-492adac31d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775923, "uuid": "acd64359-5e0e-4043-a231-0d53fbf48be4", "value": "d23377638cab0ee29ab55a5312279c32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dbe02e-ba33-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649749043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749043, "uuid": "578bc10a-9f92-411d-b2ec-f4fe34399319", "comment": "Malware payload (RedLineStealer)", "value": "a9d9617466a30b874b80d4fd6465f46b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749043, "uuid": "07bb876b-4ff7-48b6-bc97-4ae37951487e", "comment": "Malware payload (RedLineStealer)", "value": "15791f0ceae7a162d3280af791cd8837705a7ccb6248bbfc3184cc3306ec4a57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749043, "uuid": "1196551f-c7c9-4468-8a76-5d36b64c90c4", "comment": "Malware payload (RedLineStealer)", "value": "b6e42e3a1fbc20c78e003b065440733fb1cafe84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749043, "uuid": "22c7284c-95c0-4923-a2ab-c6cafa5ef1c5", "comment": "Malware payload (RedLineStealer)", "value": "14e8c90cc5d0ebaf2fba4c21d3b99e6d0e984c00c8fae38c5fbac75accde53efbb77d62d1adb12eac600acd425fd285d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749043, "uuid": "d45fc3f4-8002-420b-a2cb-80e2307bf799", "value": "T1BA34AE4D71F3C8B3E7A3E431F776D2983D2DE460BB95895327080A3E5AD44B18529EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749043, "uuid": "a0bd8ce3-4972-44aa-bb9d-166a44787b1c", "value": "97c74a5abad8ccf1223b83d8f06c72b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749043, "uuid": "a5a8f52d-ac8b-4d33-b61b-f7fb535234c5", "value": "3072:Wn9NrR50/7ZnwpmyedsJufkq6c6+2fQxRPgBmhL+d8bdaPBUfeVHD6tpwWH47Yyw:W7150JwuA4xRoBmhKdyLf/kWfymv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749043, "uuid": "fe8ddf2d-e696-4aae-98a9-5d4a9e22ae45", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749043, "uuid": "f89fecc6-f780-4770-ab97-18d50be2175a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749043, "uuid": "19cac611-fed1-4d86-8ae6-97f1c9e5e57a", "value": "a9d9617466a30b874b80d4fd6465f46b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc23085-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764492, "uuid": "19e3b84a-caa3-4a47-8a54-8f135a74795e", "comment": "Malware payload", "value": "76bb30fdd32fad56972a23d700246b26", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764492, "uuid": "7fb9fbbb-2bc7-4421-b6de-27f3b9a06ab9", "comment": "Malware payload", "value": "15baac009c6ced2f309ec1db3a9c3f3ca31e8aa5a0d393e8396a89c52b4895f2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764492, "uuid": "94cda3a7-a050-4bf3-a769-2c3c170b31d7", "comment": "Malware payload", "value": "aa1a8796e8c335d638a744875cf3f7806e593c04", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764492, "uuid": "2f951d0d-b9da-4093-825e-8f2ac5723074", "comment": "Malware payload", "value": "eef3a08325aaa9cf62a71aa7b035750752721d658a77ea5e4a7903b5314cfa5b964759db05543e80cc7ac1f8a0ec13f0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764492, "uuid": "f20dbd33-b333-4b21-942e-c028238ba7e9", "value": "T188166C23B284613AC06B1A3A4C37E668993B7AB16D26CC5B57F04D8C8F365417A3F747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764492, "uuid": "ec12b728-78de-44c5-911b-eab87583c57c", "value": "49152:uYr0QuBw2yEZYVhc0zh1IS6lBIuuB70/ztJ32HH7TZgsi05KPoZme3RTFB0vrNG+:Z0qvuue/T32n7TZhKPoQemvJROYQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764492, "uuid": "4026a42d-7410-4794-a593-c08046ff97c3", "value": 4062720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764492, "uuid": "aa082c65-38e8-4256-97d1-19e78a4b43ad", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764492, "uuid": "42ef1a70-7a24-4586-976e-cd5b008f7f72", "value": "Fact.Endesa.Archiv1104.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8eaefac-ba4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649760432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760432, "uuid": "98734692-4b6f-419d-9fe2-f00fff89227b", "comment": "Malware payload (AgentTesla)", "value": "7381d3199e7f9db8758cd24d7f6a00f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760432, "uuid": "2860ef9d-4581-47cc-a7c7-99c02c6058ad", "comment": "Malware payload (AgentTesla)", "value": "168a58e58419e3ad97602981533bdbe6cf82c5820828fe849c77fa1c46e516aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760432, "uuid": "69c8c8a8-e8cc-490c-abbf-d493fcef42b4", "comment": "Malware payload (AgentTesla)", "value": "28fbb2298d1eb012b2bef173d86c885aeede12eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760432, "uuid": "6cf1d986-c558-48bb-9a3c-193a165b06ac", "comment": "Malware payload (AgentTesla)", "value": "41d43cc9150df50fb97303f2f40653321be1ca3a90942b8838ceacdfcd4c1ceee31df539e524b272421b952594ea4280", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760432, "uuid": "2dfbdbec-c3d1-4a76-b965-572c36c4feea", "value": "T15473CF807B64D473D16802B6D252DBF04333AF1DE026DB5F48C97C2B3EA17429ED2621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760432, "uuid": "48cd3190-3b94-4ed4-a192-61194be74bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760432, "uuid": "80581de7-0b89-4c77-920e-273bcbccd731", "value": "1536:6M1rXlvAPBGLX6cMxkWFUzaR5IyS2eNXezam:71rXy5GLX6cELQaIVv0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760432, "uuid": "e1433ad5-233a-436c-842d-8039c837a669", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760432, "uuid": "959aed9a-ef4b-47dc-b6eb-46cef70cda0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760432, "uuid": "8843f135-e434-4701-9241-094c219422b9", "value": "SecuriteInfo.com.Variant.Strictor.270970.1301.4632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4e34f8-ba25-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649743204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743204, "uuid": "de274e84-e1fa-4c7e-ad1d-4d782ba84845", "comment": "Malware payload", "value": "d58beda46a69d9fb0f64ab500ba81f7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743204, "uuid": "ebc73c83-780d-4951-99a7-5f1996e76e6b", "comment": "Malware payload", "value": "16f4a0a48272a5eb169cc89116d41a92b7e7ff007ace67767a00d52851f98735", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743204, "uuid": "0f8f4884-3908-4489-8b49-219727d7ee80", "comment": "Malware payload", "value": "dc201e2448190dbd7f444ae24115a381bc1df12b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743204, "uuid": "334cad77-b1de-442c-bb54-58f4750c3999", "comment": "Malware payload", "value": "3099362a0b99d9c4bfe318923450a8727731d4d220677105aa80e942407c2c6aef2b4945b5fb417a0b6ef9b19fd74318", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743204, "uuid": "482ae862-b0f9-4954-a4fd-a6a9ac627914", "value": "T1D353023D96042C51D0F32CB2BEF5024B1595BF98E1B6792623342B85EAD0F1F1B5E987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743204, "uuid": "932e7920-768b-4fb9-9685-86cba1e5831c", "value": "1536:TvHQdjJj/MpJOlrILQufiR+DT+eGtTIInt0:jwdj5EJOaLS+DTqUInt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649743204, "uuid": "327373ad-c962-4abd-8754-394ea9dd47eb", "value": 62356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649743204, "uuid": "04b3409d-4153-4755-8238-c96f828eeee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743204, "uuid": "f6cb4d23-78e7-41a2-89b2-43f81d0989e8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5b0b25-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649775765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775765, "uuid": "3c2b1017-8316-459c-8a30-cda5e3a20711", "comment": "Malware payload", "value": "a4c4db76e4c9b5ccd4def36ced4c6dab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775765, "uuid": "810e0868-db11-4038-a741-a6a9bf85a132", "comment": "Malware payload", "value": "170b4d6a62012f9a5acb0815725612f3f14b333e56b1ed7fb99e5b8ae1cf0d98", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775765, "uuid": "ca14575c-704a-415b-8fe8-029fc4ba5134", "comment": "Malware payload", "value": "318c065b28532350db88484623aad2c4550141fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775765, "uuid": "03300f2f-47b7-4028-a51f-604e56901330", "comment": "Malware payload", "value": "4cb6b688372d1b3e32e22cd021626beaddbd80cf1464f6d871bc943c3fac316bc6ea661910bc88f5946b7966a23f76ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775765, "uuid": "284d9c44-8b5c-409a-9155-d59bacd81a26", "value": "T173A28B59AAFF14A0E16770390F2F61096A36444B1C0ADD5C7D7CA2C09F686394ABEFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775765, "uuid": "bc8bb316-f1e9-47eb-af98-6ed42799a67d", "value": "384:fT9XDGBD3jEQib68RzRirAzlQjHYzdEK5wtASlU0luQRI/Kafcf6XV9:RXDGBD3jZiW0zRir+luHYzqK5wtAH0JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775765, "uuid": "753e925d-ad2b-4e07-9f1f-2785313e409b", "value": 21815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775765, "uuid": "49b57e6e-b6a5-4d1f-8fba-f87e4d3ea4ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775765, "uuid": "736c8ce3-09d8-42da-9a6f-d5997ee2af14", "value": "tetris.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6a5433-ba3e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649753831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753831, "uuid": "6e0a4398-1b83-4698-9f27-6c3afa134e52", "comment": "Malware payload", "value": "1938380a81a23b8b1100de8403b583a7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "TailJump", "colour": "#CA2A0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753831, "uuid": "84036be2-698b-4110-8a80-2bd041846ca7", "comment": "Malware payload", "value": "1724a0a3c9c73f4d8891f988b5035effce8d897ed42336a92e2c9bc7d9ee7f5a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "TailJump", "colour": "#CA2A0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753831, "uuid": "b4048d85-159f-42d2-b9f8-ac5cf9446380", "comment": "Malware payload", "value": "9ce1491ce69809f92ae1fe8d4c0783bd1d11fbe7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "TailJump", "colour": "#CA2A0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753831, "uuid": "e0d970f1-77ee-4c47-a15e-13fafc0bffc1", "comment": "Malware payload", "value": "a64963dcdf98eebed040e74ac2fd21d0efdbfe14d731cf716778d2a4894908fa13db4f03cad63b027220e223d95d856a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "TailJump", "colour": "#CA2A0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753831, "uuid": "845880ff-0b66-4db3-bc7a-fd3b021c8b15", "value": "T17771C8B34FF1130965F9F87171A347EBE9F7439D08033626E6753A1B0229BAC5997019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753831, "uuid": "610b04d4-2c92-4728-a855-c44906526cad", "value": "96:6vWh+Y890aCVtXugDPkriXR4RmGM+nqi3nr/:6T0VduD4tG9r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753831, "uuid": "8d05afed-a0d0-440f-b903-8486ef85a422", "value": 3734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753831, "uuid": "2ff034a8-5900-477a-8067-6593d25cfcaf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753831, "uuid": "3d19cc2f-cde6-4d38-8f6f-810153ec8720", "value": "1724a0a3c9c73f4d8891f988b5035effce8d897ed42336a92e2c9bc7d9ee7f5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a17cee8-ba24-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649742529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742529, "uuid": "abd30837-3ddb-4b25-a8af-da6fef1f631f", "comment": "Malware payload (AgentTesla)", "value": "106f9836af90dd77b0ac01dff5118bcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742529, "uuid": "5e7ecb8b-7000-4610-ac08-2ef2ef15fff1", "comment": "Malware payload (AgentTesla)", "value": "1725ac26ffa4541dd7e2b558861ffa3cb5e02f521bbbbe57f7a148bba376406f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742529, "uuid": "44c4b087-15fc-493a-8a6e-bd63a133dc7e", "comment": "Malware payload (AgentTesla)", "value": "ec7e9f03133866a5713792f656c35294d43e243d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742529, "uuid": "b8cc9f69-2e98-4345-9935-ac1322870415", "comment": "Malware payload (AgentTesla)", "value": "69415fc22194cd1b26a6fbbd186e2a859ac01960d8620357d21612292417ac66083364f09ceb30511b9c93b4efe0afa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742529, "uuid": "13584105-4c3d-48d9-bb51-c78b0b8873de", "value": "T1652533F2FA3AA16283EE7053E3BC941C0409698F9DB01D07C439E81BA997518D79779F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742529, "uuid": "dc162626-f79e-46e9-958b-64541ddfb7af", "value": "24576:U4gtnOMcbxhoGQEVPLeQCtcCGta6ofbTYbjk/Uq7cbG2:UBt0YhE9U+5v2Uq7oG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649742529, "uuid": "a21e233d-c5d2-47d0-8405-29552d0e74ea", "value": 1048275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649742529, "uuid": "07e1a7a1-87d6-476d-835f-687f23e029cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742529, "uuid": "ecb50841-e43e-4a2f-b00f-15d32ac3ba9a", "value": "Overdue_Payments.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e1b572-ba49-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649758707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758707, "uuid": "0010f2ae-a507-4bb6-a308-f66bbd4f5fe7", "comment": "Malware payload (AgentTesla)", "value": "249084fe63a644f40dca23893bcb31cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758707, "uuid": "b5fc768c-aeda-499d-9d6d-84a57fcc973c", "comment": "Malware payload (AgentTesla)", "value": "1748a54beb6ea638c93c64e7029869c7183a186712ac7f23a5be144739244452", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758707, "uuid": "31f2b402-79c2-47ad-8a22-8126a353d5fe", "comment": "Malware payload (AgentTesla)", "value": "fcda312a6ab26f4a0ffb6b90bc37e7b2746bb2c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758707, "uuid": "7fd293e8-830c-46aa-ba06-3ff9b6b9e69f", "comment": "Malware payload (AgentTesla)", "value": "6c4a5396e8255e38ff2b3ec04faba2657b7725e60819ac82a27091d99a90b3bbda56163e7f46d7c06bb347073e56cc81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758707, "uuid": "42703d97-04b2-45a9-9878-c02971c12bc0", "value": "T103E4E01576FC8625D9FD07FDE07400C087F5B62B581BD3B96A05A4EA2E633D08607BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758707, "uuid": "9c78dad0-c67c-435a-891c-6ab0cf6284df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758707, "uuid": "2d2ed653-f9c5-49ea-b77e-d6a598a554bd", "value": "12288:MkKUk6AWJNh4qTlF0PsXV82Y9l6fGIv9jtOzEy61eFCbRlJVAApgVgz:MkKX6A8N+q70P8C2E0595OYeFilJym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758707, "uuid": "114de841-1c38-4e1a-b1dc-a8a288c21f23", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758707, "uuid": "a4b1689d-14e3-4e3b-862e-a090122ef756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758707, "uuid": "afda4a9d-f0a8-4a3a-aae3-18a91d12477a", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883e4e25-ba13-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649735359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735359, "uuid": "954330e4-3aec-463d-baac-884836bb568d", "comment": "Malware payload (Mirai)", "value": "03adb7b02767ab65969f7af61b6fc141", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735359, "uuid": "973394fb-247a-4ac9-abdd-0b801f7f0cbe", "comment": "Malware payload (Mirai)", "value": "1777191ec0e649e4e03876a4f44501e9bc6ac9892f0ff911ce42ac788abe056f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735359, "uuid": "17497755-81cc-411e-9804-a5bf89504e83", "comment": "Malware payload (Mirai)", "value": "b0bc7c33a29494cdd68d4f2100a99e3d73f02154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735359, "uuid": "722f2276-8454-4561-9c19-f6d8a48fa3f6", "comment": "Malware payload (Mirai)", "value": "3083b278eca799249ebb5f0a5e5ec432d1a60224b141a500ee15ef4dca00f4bf46c823d1d549d35e3d9d5b6b4fca1c08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735359, "uuid": "5c80ca9d-73cc-4a87-89c4-218001968cf3", "value": "T1AE434B65F9824A3AC1E0137ABA6E569C373163E8C3CB3217DD641760BACA41F1D77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735359, "uuid": "e637598a-973e-472e-830e-7b9740c76d74", "value": "1536:rpUJkRKoczXJSL7IoM2hPqRoWy5j48Nxya10:rp5OXmc2hyR7y5/N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649735359, "uuid": "0f0fd03a-640f-47f1-976b-131eb224f461", "value": 60044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649735359, "uuid": "4c0d7414-c4ba-4172-ba5e-f3cd08c9c93b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735359, "uuid": "4dbb4fb5-c174-4dc2-ac09-55f169948512", "value": "03adb7b02767ab65969f7af61b6fc141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46951fc0-ba7e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649781205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781205, "uuid": "2b9bf050-74ce-4380-8bc7-19b1bb07a4c2", "comment": "Malware payload (AgentTesla)", "value": "726065272b19c85b06079a997c1057b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781205, "uuid": "05d0c0d6-989f-4aad-8802-6c859d740694", "comment": "Malware payload (AgentTesla)", "value": "17c958f1deb41f85c37e6623ddfcb401e3c261a822fa821b5ffbb854fbdd8137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781205, "uuid": "1ee636d6-4d79-4c1d-be55-3f237d18502c", "comment": "Malware payload (AgentTesla)", "value": "c9dec521a295df26342f4503a031693938903b09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781205, "uuid": "3af77a03-b6ec-442f-8ee2-f3e8aac21fbd", "comment": "Malware payload (AgentTesla)", "value": "d8062aeb3aa2d2484e86127a9667b64dd3bbdbbafbad6eec9e86b1bc909bbf595d3e4f780ded2f48e1e55e4fd2a8cb9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781205, "uuid": "d62e6cc1-f466-4556-8e66-d6be961f8eae", "value": "T1DCA4CFA1CA5179C2C0555BB1C8A2DCB036E5B39A821CF75DBCB5BA052EF21C5E011FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781205, "uuid": "cc2e49e1-3a57-402f-850e-c5be01f6509b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781205, "uuid": "49a59949-0040-4ead-9232-635895e7fec3", "value": "6144:MdxjKwGXiXZrPZ0cbdIlwDKicadIbgTpTjxgey50oHSamiOxS+ghXCvI+evFiVhG:MdfJrxbAwDqaddTp/xg0oHpOgsw8VhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649781205, "uuid": "9c935834-5510-4ecf-b998-3ad2a8b0a728", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649781205, "uuid": "6580dbe9-b4ff-43b3-a0e0-9424de9628cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781205, "uuid": "65ba7d7e-781f-4546-953e-b173fb80ff2b", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79912cb0-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649767547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767547, "uuid": "c49bd7c6-0ab2-4448-910e-a404fabf0b47", "comment": "Malware payload (RedLineStealer)", "value": "e7f3383e3290e1d6c9ee402439d5f5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767547, "uuid": "843df7df-0034-4ab7-8481-1a716cfdc53d", "comment": "Malware payload (RedLineStealer)", "value": "180dfbda7c9865f540b48cc53bceb1877650a402cc9bb540e55be3dad3ddf2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767547, "uuid": "67e60ace-a8d3-4dd9-8aed-88e72b42425c", "comment": "Malware payload (RedLineStealer)", "value": "65c1020f040f641c0215193642135ee85bbe6abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767547, "uuid": "580d34a3-e3ce-47dd-9c9e-272d5c945ae6", "comment": "Malware payload (RedLineStealer)", "value": "6efc4203a4deb5e907eaabcaaabe8211f1a8254368efc3e82153dfa29f7c2fc7feeb4561b53efd6d6f0db8dd0abb24e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767547, "uuid": "399d34ae-9979-4bf7-b59b-ddd703f3c3d2", "value": "T1B415332D622D426FCEED327058C2F9A415E1DB7AD6DBC36B70D031BE18B2329314B596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767547, "uuid": "62c4cf51-5b65-4314-beb5-dd8ba06414ec", "value": "57e740cde8bb25148800b09be3bc64aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767547, "uuid": "94b5a0f2-5dce-4ca0-9189-fe4559ec3498", "value": "24576:B0EruiT2M+zaoHC3cTUP6E6uGDpIApl6rDd:tT2MGNHC3cTY6uGX/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767547, "uuid": "5ce22252-c67c-41fc-b91b-d766f0611a15", "value": 919232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767547, "uuid": "8d7f9e87-4873-49fd-8df3-ce1d99ee7690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767547, "uuid": "3cd20f26-5b4f-4679-be63-ad67f9a3b38f", "value": "e7f3383e3290e1d6c9ee402439d5f5ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bcdaff-baa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649796605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796605, "uuid": "cc47b59e-0540-4048-b799-9c4ff831c0da", "comment": "Malware payload (Mirai)", "value": "1958e85669a0997ecd66eb1a3acbe65b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796605, "uuid": "1803abc6-c01d-4d55-92e6-8e9479f30947", "comment": "Malware payload (Mirai)", "value": "183b5ab20f6bc66f8da24087d15bff528dbf7c7439ebfc8c223b7ec8a68172d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796605, "uuid": "38fb39e5-80b4-4165-83f1-7fb22eada007", "comment": "Malware payload (Mirai)", "value": "17e282a9624785b9c23d4666181ae26a564598f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796605, "uuid": "7653d9b7-9696-4fef-ab25-e39db0553087", "comment": "Malware payload (Mirai)", "value": "321c8d7edd3590171026fd7d181195b2977c0a71b314daaed09315e07a0d498ad168b4ca29e0ca3242d02d89f3b7be5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796605, "uuid": "efda6dd9-de6e-43c4-a651-2d191c596027", "value": "T1D3D2E154A7A0EC70DEB4533EEE3C8142225713FBF4D8B5EB12988959B68D107E33A685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796605, "uuid": "b6e8bb3d-c489-413d-bebc-e572d5d87af3", "value": "768:6FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZPhs3Uoz7:6F2+IoXVeNIlzpzAJMz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649796605, "uuid": "ac529b95-34d5-4b4a-8573-828ab307ff5e", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649796605, "uuid": "6e49fbe0-8e9c-4c86-96ed-aebc294d6334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796605, "uuid": "893834f0-9ae7-43bc-933f-01447762f172", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83f954f-ba48-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649758176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758176, "uuid": "c653bfeb-7e8e-4f56-8149-7508f0a174d2", "comment": "Malware payload", "value": "5afd315a4cc6039b4dfd18cfa046304c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758176, "uuid": "623e53b0-fc43-4aad-9d9e-92e42542861b", "comment": "Malware payload", "value": "18a68d3df6eac4c38fde81511e33c4db379592423838cff6c3a96e304dafb098", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758176, "uuid": "0f4264ae-148b-40f8-88e1-be12c3254834", "comment": "Malware payload", "value": "75d476d4d0333fb814da86e4f76bcb6329964b84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758176, "uuid": "dfefa162-679e-48a3-ab50-2914376388dd", "comment": "Malware payload", "value": "c95ef3a1aa5dfeb2abb976e8e29d9d17cd416bdc23cbb988886d3ea527cb190d388b4fe890545c86d069dbb36a02beb1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758176, "uuid": "d4fb7123-a867-4880-b57b-2879a34abe6c", "value": "T15571C8272B003297412122FED0BD7E44B645F02B6423C4E5F4F5994BC558745F1A7695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758176, "uuid": "ee33a12e-a954-4961-b40a-18eb39764a21", "value": "96:fpJua4Lptz8HWkuUem4uB6P4uYMW/+/lq:fniLpAFemVgPVYMk+9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758176, "uuid": "fc9e2674-6f26-476a-8f07-5e01876f1399", "value": 3633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758176, "uuid": "f68374bb-db8e-45eb-b1d1-929694a52ee0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758176, "uuid": "1c97e736-19b8-48ac-ac9f-84ba881e14fc", "value": "1.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e92e76-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1649782811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782811, "uuid": "d5dea0a8-fe04-4480-9fe2-635e4f5865ff", "comment": "Malware payload (ArkeiStealer)", "value": "bb2c59508ec1d835e1cf8d7d683b73ec", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782811, "uuid": "daa13263-7587-44c6-82bd-d305f4b667ca", "comment": "Malware payload (ArkeiStealer)", "value": "1975849320d09cfe07d7e3374368e43e11c88b1b0c4b5063e59c655c19b7d1a1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782811, "uuid": "f18fbaf7-d573-4a30-8377-e7abe0260e2b", "comment": "Malware payload (ArkeiStealer)", "value": "20b9382bce5b0955f33c03b7d128dddb4ceb7c87", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782811, "uuid": "5fcd1984-9bc4-43ab-b770-86dd3d129fa3", "comment": "Malware payload (ArkeiStealer)", "value": "1298f0d88a6cf8c01d58563092f6c68f5286dcd6284df49a862f745fe19357b336d42447826ab9715cc69c200ae2a35e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782811, "uuid": "b17876a9-068f-427f-b604-89ac0e4b0aac", "value": "T16FA5B033A6A24837C1332B789C6B97549D39BE017A34584A2FF41E4C5F3E6813F29697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782811, "uuid": "277c8cbb-5291-4287-8e39-0864c605275d", "value": "eb14e5a4e20301499a952f74f2a2bd5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782811, "uuid": "fa8d291f-858a-4a05-a29b-16cf80a820f5", "value": "24576:GhW3Qmuw+PdQ+qUZVWeS0hKi9G4H4DNO55fyag6k7Lg145KzBrCBsgrARWZ9cVuk:GrfdR1SmKiU1E1DiXL++4UaqlqNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782811, "uuid": "90c8fa30-d380-44bb-aad3-e8e26bac5dc1", "value": 2150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782811, "uuid": "151e37bb-ede9-49fd-9877-961482b749b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782811, "uuid": "208f6f74-6e99-4fc6-8018-09410e872576", "value": "bb2c59508ec1d835e1cf8d7d683b73ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf949f8-ba25-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649743207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743207, "uuid": "4d597f54-601d-4f23-a6c1-5b17e42a5540", "comment": "Malware payload", "value": "bb973bda2117ef27504458081c5c781e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743207, "uuid": "c3969420-b0f2-452d-a0af-061f287ce037", "comment": "Malware payload", "value": "19954050e64797c1d725d13b2a69f5b977cc7a5cb6ae70262db7e69494758159", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743207, "uuid": "e3bcbac5-cd14-464b-97c9-ebcdbb0b2a16", "comment": "Malware payload", "value": "baec512dca863257f8dd00b39ba0c82e74597649", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743207, "uuid": "7692cb38-b121-40e2-8e3e-0eaeb7c923b7", "comment": "Malware payload", "value": "4ab2ab6b5747b9e34b3d1e80166c1026bd9b0b3a605cc5c6245ad595aaa4105f0c496147f239745ae32e4199bb380639", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743207, "uuid": "8f19994d-eaed-4b80-a5c0-fb89fd15c2fb", "value": "T197F2F1301BCAE972E7DA1C7686FD4D44163B6728A0DDB3F11FA4E9556ED4042C83D84B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743207, "uuid": "197ec57e-8e4f-410f-ba70-9dd318887d60", "value": "768:EOIEqbb8797Ocs5fFo0IFd7rs3EaRk4y+zueczDEJljN/3UJ:jI+7ccs59NOrTgkf+jczAJl5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649743207, "uuid": "43d16308-39e0-40f5-9aef-914ad9e34181", "value": 36368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649743207, "uuid": "ec2037a8-ffb0-4a4a-b468-24e65c290788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743207, "uuid": "85db2ce4-57ec-4aae-8a03-0eb23e2aa2ef", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220dd72e-ba2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649745495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745495, "uuid": "868ab351-ad05-4531-b357-f834edb117da", "comment": "Malware payload (AgentTesla)", "value": "ebd3c0525aa118efe9662976c2223cd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745495, "uuid": "4b76b42b-f0ab-4352-ad74-e5bfd65b0972", "comment": "Malware payload (AgentTesla)", "value": "19ab5dfc6f98eab8a02efedb330b1034077c4b5e2a75e82c30dc1d927d3a1007", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745495, "uuid": "54a2ded4-70e4-47fa-b708-9b27b9c2529a", "comment": "Malware payload (AgentTesla)", "value": "04f6e4ec581bf14791ddc4cc7f455da3ed291900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745495, "uuid": "9571a2df-7696-4d61-9f9d-6e97844e39f1", "comment": "Malware payload (AgentTesla)", "value": "b3683412d20e20c4908b690686fff050d017bf9bf4765bde9902cda249fe92ee24a0dd68eb61be398004309a9319007c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745495, "uuid": "4542795c-bbfe-4304-bce0-c814397d1279", "value": "T1AC3533C81E79EE7068EF5E81788F1D36A4D27C572F2458A196F5800E92F7824C926F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745495, "uuid": "19ac13f7-785f-4ce1-b592-60e5ce859aa0", "value": "24576:rGMrGSSY5dCNXahfeL83ZgyWxchKeBhsMiMma5SVm2+o:rjFS6d8XahfeL8JtThHBhVmeSQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745495, "uuid": "205221c3-9f64-440a-ab6e-cd29ab5c77e0", "value": 1068895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745495, "uuid": "8c204f17-5b93-4323-95bd-e2714460f232", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745495, "uuid": "89fc72e2-a33e-4cf8-a77d-d240ecf255ca", "value": "PO 240046647.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8251ad88-ba09-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649731054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731054, "uuid": "e34dcff9-9987-4431-aa55-6c7560300347", "comment": "Malware payload (NanoCore)", "value": "4e67246e99a219e17c41c56af1c38a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731054, "uuid": "7c95acc3-a0ba-4df8-a129-f0fb677807cb", "comment": "Malware payload (NanoCore)", "value": "1a2d3e30a57bfd9611ca7f718fdbdd81c139883b2abf580348638b01b543a500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731054, "uuid": "36f7e6cd-01c6-4632-bcc4-64a1b35b40ec", "comment": "Malware payload (NanoCore)", "value": "40249d048eafe5a723edbbb32955da203e45aafd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731054, "uuid": "25a0ab2f-9c75-4ca7-98f5-01cff9f8ac13", "comment": "Malware payload (NanoCore)", "value": "290048027c6ba1a609fc0a83de147ecbf93e63905cfd9432b7c6fcd742860bb339dbb7762275d194044af46e18a781ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731054, "uuid": "2b7bf9cc-e795-46df-9951-2a9327db1b89", "value": "T13454236B36F051FFD16719722E3B6B9A9AF6E7000370648B974C0FDE2C15883E8B6546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731054, "uuid": "07817d02-fc0e-47d7-aeca-53f25336301b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731054, "uuid": "af4b9a2d-965e-428c-88ac-dcda944b42ea", "value": "6144:8Qq+NXGtlA00BlLp75djFPWP5UC7tpEF4mhHUCwelyp:TNXSP07F7jFOP+CW4mlHVyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731054, "uuid": "f126c239-f0c5-4067-913d-35342a620d3a", "value": 289313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731054, "uuid": "aa3f5221-78e1-4e5d-a226-9b2c63c73790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731054, "uuid": "41bba7a0-6be9-470d-a8b4-7224fd8ea38e", "value": "new item in 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1755af-ba27-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649744086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744086, "uuid": "fc6f3631-da9e-4e3e-a003-2b688700cf9e", "comment": "Malware payload (NanoCore)", "value": "0f10f9e8314552a5716987b75bc8efb2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744086, "uuid": "a946fd9f-96c6-4853-8c46-5ce7a2969363", "comment": "Malware payload (NanoCore)", "value": "1a82ab590511f4bbe3fe090de2dd064035017bcc7cec9c0f12a8a02e9e891a12", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744086, "uuid": "23a90d78-7cb9-41d7-96a9-040df05d4482", "comment": "Malware payload (NanoCore)", "value": "19ffc92381a7c4d518c6bbb46d8628ce3d10500d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744086, "uuid": "04725abf-9a56-4c04-8b73-75116a108701", "comment": "Malware payload (NanoCore)", "value": "5727277e79fbb67909d5a983723b7c74b1c65e8e482b71ed8424b6cc67a7e2b273e2fcc932da5f85e4fdb40769682390", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744086, "uuid": "33aeb4d5-7631-4f1e-93e0-99710c945319", "value": "T19D25F111F7726A05C4780EF398B6429B4BB18516D021C2CA3BFD358ADB23F97397865B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744086, "uuid": "32ed1e25-bc55-472e-ab2d-a50a763ff9ec", "value": "24576:QzzWIpVlQVbqH3/ywtYfnXacjBkQHo4Ah:QL6hqH3/ywsXanQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744086, "uuid": "b94af22e-4543-433c-b944-9723f917234c", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744086, "uuid": "d0c520a8-14c9-4644-9dbd-0c6e2b65e392", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744086, "uuid": "eb0cacb1-b791-4fd6-ada0-e329101fde8e", "value": "URGENT REQUEST FOR QUOTSCAN COPY_PDF__________________________________.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ad2f7d-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649775620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775620, "uuid": "21033b3b-bf39-4e89-a2ac-65835c0e5673", "comment": "Malware payload (AgentTesla)", "value": "611ce1f0797cb7c8412496e48530267c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775620, "uuid": "7cd11c7f-2ce3-46d2-b407-85f44a9de418", "comment": "Malware payload (AgentTesla)", "value": "1b66f74ba84e6ee99d79af70c77c37ebe21282b33800fb5a869c021e9c15aeb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775620, "uuid": "f52121f3-4027-4bcf-8862-177c5533015a", "comment": "Malware payload (AgentTesla)", "value": "a7b67b695649232196d3aa7281d2be76a2aea540", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775620, "uuid": "931a023c-5322-43b3-9f99-306ab435fecc", "comment": "Malware payload (AgentTesla)", "value": "b9541d01d7e5b923f29ac665b8d8f0a4c941cc140457f12b7390ea98335f0ecbfdfa353852a536bd5bd5df2aec84dd17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775620, "uuid": "f9322432-7c5f-4749-ba90-cc8edb54ebb5", "value": "T12F74236E6625EB7FC1771E3A4C69B72485FAFF018B15B7182782F76922313008851EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775620, "uuid": "491e5158-0537-49b7-810b-0fe60053e5a4", "value": "6144:MQK+JPdfKsIayi/L7VWJrqSV5EyJTYkq613lll81ZnptrxR8UqW:MQJfia1X8J+SfEyJTxq61VsR7rLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775620, "uuid": "b224394e-e2d3-4cfe-9ca8-6dbe9d3c7781", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775620, "uuid": "d0a2290c-72bd-4739-b886-59eb94e3b8b6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775620, "uuid": "a32816da-19b9-4a50-845b-2d841da78c4b", "value": "SWIFT USD 480,000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4776012-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649777980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777980, "uuid": "ad927782-a3cd-4a07-b4aa-5e29aab39de8", "comment": "Malware payload (Mirai)", "value": "8f21b1d38cbf94220d8542fa84a477f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777980, "uuid": "189949af-3bf6-49a9-a9be-68a51853f703", "comment": "Malware payload (Mirai)", "value": "1bbd0062b73b5c79976bc3b2196655722381bac6cccc223e8de30242605d66f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777980, "uuid": "6c9b90d0-27fb-4eee-937b-40923fc74d8f", "comment": "Malware payload (Mirai)", "value": "ade674748805815335db6271d1838277304a03d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777980, "uuid": "92583580-b53b-4213-9c74-f1e3b3581fa3", "comment": "Malware payload (Mirai)", "value": "1abe29284117fcefaac887cb52ac726f19030e7ab25bcd8931ddfae14d7623c1814f1982cc145d64598f33d02fcdc921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777980, "uuid": "dbcf2d25-80d5-47c3-a7e7-dfc11d43d491", "value": "T106435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777980, "uuid": "9980dc40-bce2-4299-a59a-dd38f28e2a3f", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEpGVuz2GipH6TnSgGABJf:ybUg1Jgzz4Cqu1Hisi6nSgG8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777980, "uuid": "7c51ec2a-a050-4c48-914b-986a0d977920", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777980, "uuid": "c616cd83-7ac1-4db1-b06b-8e83a480e3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777980, "uuid": "088a0fa1-f0c3-4d84-b08e-53b0c6df7fb7", "value": "8f21b1d38cbf94220d8542fa84a477f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15f53be-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649746568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746568, "uuid": "fef6e320-a6c6-45f9-93ed-1760a7958269", "comment": "Malware payload (DCRat)", "value": "0063e958744d8f50158fd8d212f5dd9f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746568, "uuid": "d4802538-f386-469b-9281-4e5117632316", "comment": "Malware payload (DCRat)", "value": "1bd8db988097189cd8deae59d4d954ab78e974342cc5fe1419dc223789b22959", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746568, "uuid": "6fb86bb4-10f6-4144-bc1d-d1814948ad60", "comment": "Malware payload (DCRat)", "value": "f75dfbe3ce9f054387c25e463897b642d21b697d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746568, "uuid": "d09146d5-4aa3-4ba7-a88b-c74cd8042e6f", "comment": "Malware payload (DCRat)", "value": "48443b50fe58ce3a78759e520516adc34bda4c1bd4ee1fe15b6415c8e91490a3bcf3d1b8954cd54f3ce18b58e3d5f9c8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746568, "uuid": "1f427956-b945-4131-b25c-014775624733", "value": "T1BF84C07DEBED6A43D69A137988C602B187F19510B093DBF7B0AB1AB52D83350DC1A14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746568, "uuid": "70ee8ae8-2267-41fc-b408-63be3feb9d08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746568, "uuid": "4fe9a699-0bd6-4500-bd5f-32f3a0ef943a", "value": "6144:PqvhJhz0IUSR3T08h0ZrMQHyBrACty1gMEN7jy4uKAsrKcqt3C:yHhYCQ8h0ZrdyrACtcl2ZzrKcqt3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746568, "uuid": "67f04f44-0c35-49f2-90d5-d53b35ec0abd", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746568, "uuid": "15ca77f1-ef5e-40e7-9e9b-efb9ae024db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746568, "uuid": "60543805-51f2-47b0-a1e3-90dd8a998caf", "value": "0063e958744d8f50158fd8d212f5dd9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f74d9c5-ba54-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649763074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763074, "uuid": "7a2fb430-07e0-47cf-af7c-14f8ea92140b", "comment": "Malware payload (Formbook)", "value": "603114139010abe0ef065c9ce47fefc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763074, "uuid": "211fa478-a6df-407b-b70e-015eb095f05d", "comment": "Malware payload (Formbook)", "value": "1c93fc36a46e4b263a960a4be63186effbb2d0a3f8db711213572ad49e1bb437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763074, "uuid": "1a6ee48a-2aa3-48f2-9f12-b1f9852848aa", "comment": "Malware payload (Formbook)", "value": "689be33bb05ff7d2ca784af45822cab5213a1d53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763074, "uuid": "d6518026-837a-4e35-a78c-9f9460778f57", "comment": "Malware payload (Formbook)", "value": "0374ac0739aab81cdd70a9c8248b7f9b30373b83127cc4b8b43350bdaea23c51ad879e54a52c329ffc418e04934f44cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763074, "uuid": "ece99147-97f0-4fa9-845d-1e4bc73796e1", "value": "T17A15F101F6719A46C47C0EF398A6476F4B71C916D021C2CB3BF9388A9932F97787865B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763074, "uuid": "928c4dc0-4feb-4d0d-9d05-c5c4c82fa670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763074, "uuid": "6d19cc07-33bd-40a6-bf1a-061ef1dcaf1f", "value": "24576:e9cDzWIpYuy/sPwUZnUEHIzsFx2yAO/IfU3oRVxKc:Wcn/PwUZUGI+wzOAfU8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763074, "uuid": "1c684386-463f-4b58-b231-98426366e4ab", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763074, "uuid": "fe01ca74-de19-4a8e-b3ec-e2a1adb77e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763074, "uuid": "c156ec62-4e1e-484a-b21e-8ecbd9e771d8", "value": "URGENTN\u00cd OBJEDN\u00c1VKA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fc2ce3-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649741900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741900, "uuid": "82e6480c-11c2-4f00-8ea1-0bea920c6b07", "comment": "Malware payload (Formbook)", "value": "82751dc08452d831141da4579ced657a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741900, "uuid": "758bf799-270f-47c4-bf38-a6b18bb6eb04", "comment": "Malware payload (Formbook)", "value": "1cc89b733c5311db5158123d3100ea711658103bbb5b9fe992ea6d76a5ef4732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741900, "uuid": "6ad2cccb-c9c3-4d55-864c-a6b014ee60a1", "comment": "Malware payload (Formbook)", "value": "c9b3ce3673dc4ffde4061af8644549a1a73dded2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741900, "uuid": "ddbbbc0c-e065-4ef1-bff4-f41a0c7e1274", "comment": "Malware payload (Formbook)", "value": "90605419210a198908bb986f6b55e7a7af4e71373b944877906bcfad011013b7a7ee17df5e3c5fd56c9fa67d844201bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741900, "uuid": "8938a61f-2909-40a2-976b-9926b0c73b3c", "value": "T15E34120B30DA98B7DA221E7316F16E60E3FBA614020D948F975C5F2D7B7358B97201DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741900, "uuid": "3c53ef81-b3a0-43c3-89a0-70eb6c63ed8d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741900, "uuid": "8c39a822-a191-4325-8ed0-5f445bee0eda", "value": "6144:8Qq+KfblVlq4o43SLmU9iGw2FyFaiPgJ09vgnJpnMO1xe9D8tswLAm:TsVI439qi5FaiPgJ09onJpgtVwLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741900, "uuid": "f61e3f52-fbb6-4e01-b89a-365b91ecabad", "value": 243947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741900, "uuid": "b49f577a-a21e-497c-800e-29589d4c11c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741900, "uuid": "7a317443-bfce-4d5e-aa0b-4e5ba8c30465", "value": "New order_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04520414-ba3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649751888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751888, "uuid": "599a70c5-764c-4ade-8c2e-e744aca2d086", "comment": "Malware payload (Loki)", "value": "983b37301693eda11fad9563f5396cab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751888, "uuid": "bf36e873-1942-4926-894d-ef85ec206039", "comment": "Malware payload (Loki)", "value": "1cd2f4771cad28f904ea8f09217fac6cb4f8df51617133f77cc32699ac37ec64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751888, "uuid": "f8df9529-50a7-4dfe-8da3-c8d368bcf9ab", "comment": "Malware payload (Loki)", "value": "ae595ae60d2a9f08a9fc0333e895001f43570a38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751888, "uuid": "fadc87f2-0bb3-4483-8818-6f34372cff80", "comment": "Malware payload (Loki)", "value": "c6f30c8de824af243b81479122f742cf85ab0528b9fbff509e8b8318b8f4a4d2d93f025fdd849d7c536ff7bbb801548a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751888, "uuid": "0daf01c3-03dd-4229-856e-3520729fdec1", "value": "T1A5341212A7E9063BCB42817188B7763ED3FA610E1F10165BA3525E2F3F191D7D9682E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751888, "uuid": "b1db3ed9-820e-4779-a5a4-3f6ab77b3390", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751888, "uuid": "4c9f8c64-b7e4-40c1-80fb-f42560e7a3d8", "value": "6144:8Qq+H4qYjLVCIQX9fFeq8NND9popdlKfgT:THECHX9fVWxTopdlKfgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751888, "uuid": "64064ef7-13d9-49dd-a324-a3397c492058", "value": 233683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751888, "uuid": "1c2dd774-b374-4226-89cf-62c13c7e451d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751888, "uuid": "f679f6a1-ca51-412a-80ac-a714fc019f2e", "value": "983b37301693eda11fad9563f5396cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e875e9-ba0b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731808, "uuid": "61c4151c-786a-4f38-b88c-536a89d4b267", "comment": "Malware payload (Mirai)", "value": "8963b69f46eaf712f554f190f0f4fb8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731808, "uuid": "f4365e7d-8791-4f42-9c92-70ee6a192720", "comment": "Malware payload (Mirai)", "value": "1d2dbbd608a77bbb251871717011f622e20ef6f2113cabe2d9c9b4fe960527e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731808, "uuid": "4c82141a-6ee5-4ba0-b566-4a1579ac9d70", "comment": "Malware payload (Mirai)", "value": "613a9fa314509419e51791ff1bd9e614f6c0ef46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731808, "uuid": "cf22b4cb-03f8-43aa-9fcf-cf2db7115923", "comment": "Malware payload (Mirai)", "value": "232097cf972c99159c19de2fca7c845e803afd15182b5b83112423b7e902b343d8ad1d017ccb1610dfbce5d5c194926e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731808, "uuid": "a2cc7f80-d4dd-4d25-87dc-92205c2f260b", "value": "T1F93302CD9A21E4B0FB3664BBCEA444C97D4A737844EA38C61A7E05E853D7605523CBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731808, "uuid": "045184e3-208e-4f5e-8d33-62db8c78b237", "value": "1536:zB5u2b05sNVSCEaIiV8DPL8DcvLyTMrdE9kkM:l5Q5YVSjaLQPL6MLFrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731808, "uuid": "a0f4e190-a1f0-4d9a-bb74-37600a794df8", "value": 54244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731808, "uuid": "abac5f0a-54bc-415d-907b-1834d08320f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731808, "uuid": "92cba6f8-c12e-437a-b958-cdec696938cc", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67851f51-ba4a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649758926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758926, "uuid": "c62758f7-cd92-415c-9650-8a231e7e5d68", "comment": "Malware payload (Heodo)", "value": "e5bd784fcc0c2fa9f04137d03e75e8b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758926, "uuid": "2d868691-486b-4a92-b34a-d4775d6d86e2", "comment": "Malware payload (Heodo)", "value": "1d42238f7b4bc21f450998fe55f4416022d4c0402a8458157ac3f42f866de890", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758926, "uuid": "03c6aeda-0aa4-4d39-b6ee-3ed45a13cd03", "comment": "Malware payload (Heodo)", "value": "df2a60cf17d6aa16e40af6f1e02a0f2733545449", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758926, "uuid": "aa4daf8d-4b0f-430d-be03-dcfd7e8d7302", "comment": "Malware payload (Heodo)", "value": "1e91ee4485bc015bab6836b787394a7f0c6bb22e897b03f5d8198910c92c737bd8e25cd4c33a7cbaa04327662fac6434", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758926, "uuid": "fdb927e7-e333-4b65-a085-15e4e5a5a184", "value": "T113748E916BC690B6C3533072425B633AA6ED96705B3967CB9BD01D325F380D3EA3871E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758926, "uuid": "a34ad3b1-6c2a-4755-975d-0fe21088f438", "value": "6144:JzyKSPnEifm5GB/bl6xlWhWYxPS3aRXysKu0kBwFIybjx6wN3UKGv0XJ:JzpSPnEifD6xu1XRiTFIy30ZKm0XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758926, "uuid": "4f8238a7-f9e9-458e-8a6d-7f0d980679df", "value": 343606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758926, "uuid": "8fc656de-968e-475c-a198-ce04d59aaf53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758926, "uuid": "827e537a-4136-40c2-9f28-7d8ce6bf924e", "value": "emotet_exe_e5_1d42238f7b4bc21f450998fe55f4416022d4c0402a8458157ac3f42f866de890_2022-04-12__102201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb9e3a3-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649747043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747043, "uuid": "48542f2b-47d3-4090-8f0b-a3717c4dab17", "comment": "Malware payload (AgentTesla)", "value": "9553127caf2e1777ec9b17982889b6c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747043, "uuid": "564205a9-b1a1-42c1-a0fb-b60739262f4b", "comment": "Malware payload (AgentTesla)", "value": "1d9e7b247bd5e3a9285ee0fa04b75a506ef804a42a6abc03cac95b023d8d3d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747043, "uuid": "d365c4a4-f8fd-4bce-b344-e0b05462c106", "comment": "Malware payload (AgentTesla)", "value": "9e34b397104fdcf141454b76b6a00fa7573922e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747043, "uuid": "3f3b298a-3608-40d2-9329-50dd4200b240", "comment": "Malware payload (AgentTesla)", "value": "0660bd2e94ac3f9043994774481348f3add99dec5f2bd3e1467e918896603700e7663825fdf42998ebe121557fc3d158", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747043, "uuid": "2b2b9acf-ae2b-4151-a92d-b8961f98cc48", "value": "T150E4BF03D6115308E5EA2E781E218B69475AAD06FCACF1AFCE99FC467B77DD7100C688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747043, "uuid": "ca414ab7-59c6-4844-8f8a-7bda1bdf165a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747043, "uuid": "c3a75ac6-fff2-438a-8790-bd3feaff0e0a", "value": "12288:9k+gKtOhx4DOPIGBYN6RigU4sE2j99Mn5v/:9k8tOn4ytG8O4sEaXm9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747043, "uuid": "9b69a80d-4fa2-4826-b927-3d4c54e99489", "value": 658192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747043, "uuid": "cf3babfd-c3bd-471a-a799-7f1a4fcd6397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747043, "uuid": "af1920d9-ed65-4eec-8111-b56016d7e206", "value": "2n3LR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215726a0-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649782860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782860, "uuid": "f7a77f1e-9dba-4270-9ad9-5d2fb3292e22", "comment": "Malware payload (SnakeKeylogger)", "value": "584302ff41ed8f08051afc4ddc596acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782860, "uuid": "e08d3664-b22f-4f2d-b631-a75eabb654d6", "comment": "Malware payload (SnakeKeylogger)", "value": "1e1cc465b8389873eff1514c3c718d32f17671666eac801401287879ba4ac02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782860, "uuid": "fc33ad72-ac5d-461d-983e-396ada2a293d", "comment": "Malware payload (SnakeKeylogger)", "value": "4d81ef062af2856dffc39ea6de1f72e79f043a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782860, "uuid": "11887cff-e953-4527-b7e6-27f59399f9b5", "comment": "Malware payload (SnakeKeylogger)", "value": "f0adff0178c221783b2475af02a4ae997f1c954b5e8b550b3c881b532168903028a33688cbed2f902b8c8e13298ed6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782860, "uuid": "04840b51-36ea-4969-b21c-26d45ebde4a7", "value": "T1FCB4E120F1AD3BA5D06603F41C34E64407B6B75AB57DCA1D6DBA71CE98327C32622E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782860, "uuid": "f59e04eb-df0e-4070-9240-5b5cff7eb9f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782860, "uuid": "496c4e9f-a6f8-4859-9451-18f504121778", "value": "12288:qITR4qi9P1sNlNLPu/mCcpO25qwQeqUAsibvfjB7bFQN4:qIaqi1wLbu/r2bqwQeYsiZ7bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782860, "uuid": "a7913bef-e31a-4ada-96a8-70745b4c6ed1", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782860, "uuid": "7a45321e-763c-4c22-8e25-d1e566128900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782860, "uuid": "946df876-dbde-45ad-a6b4-167ea4b206e5", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e269e159-ba4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649759992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759992, "uuid": "db3766c7-8473-4de2-9bb0-ccfbb01c3311", "comment": "Malware payload (Heodo)", "value": "528042a22930d67e54005fb833f8ff98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759992, "uuid": "2a7723e7-e1e4-4db4-b4aa-a8f1fccd98a7", "comment": "Malware payload (Heodo)", "value": "1fdbab45b571b471d61c7b686bbfaffb56f59e7e7d2fc817608a1e043f0bad4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759992, "uuid": "43ba50d2-a05d-458d-9025-2fea9bf51641", "comment": "Malware payload (Heodo)", "value": "19ac087e1469d801ae58bdf03c988fa47691c3ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759992, "uuid": "9255439b-704b-4e9b-bf87-998e8f9ed78b", "comment": "Malware payload (Heodo)", "value": "bd252de81df861a8f9ddb97ceb3b63237244a7c183a344101c8577e5bbb032677a6c6e5a5b0d819a5e288d70759fb615", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759992, "uuid": "ce179526-7926-4e06-ac2b-d8912ee5bc02", "value": "T14BC4AE507B81C0BAC35E31B14556D27962E9A6709F3897C7BBC44A3F7FB81C1993832A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759992, "uuid": "a682e872-123f-42fd-a1ab-5d8529dbf205", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759992, "uuid": "c4f94fba-38ae-4865-877c-efaa48b558e7", "value": "6144:y+LHJs45xTU1I/m6WgLGMAPIY0hOGuy1TPQV+bVy8CuwxpOwwuDKYnKDteymj9LU:y6f5tUaLG1iZuyzbVysg1wuKYKDYjX3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759992, "uuid": "3bb9948a-53b8-49e1-ba54-05afbf251494", "value": 551257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759992, "uuid": "09ac9cdf-ff26-4eb2-9462-77271e3721c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759992, "uuid": "e9e491fa-9cb6-4607-9875-3371632b5a05", "value": "emotet_exe_e4_1fdbab45b571b471d61c7b686bbfaffb56f59e7e7d2fc817608a1e043f0bad4a_2022-04-12__103946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d153263-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649746883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746883, "uuid": "118ec8a8-5985-4f83-be1a-0cf0aadac614", "comment": "Malware payload (Formbook)", "value": "5d0ed0ed4b296ca4e9b36cad5fc2254d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746883, "uuid": "b49f4495-d9ec-4a02-8598-1426bb343173", "comment": "Malware payload (Formbook)", "value": "200e079718fe6e371b74e8a9c300a584d3bfb5793326fdeabdf067b24a5aa870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746883, "uuid": "66205189-ec07-4c63-8154-eb7b36662958", "comment": "Malware payload (Formbook)", "value": "e1e750084db382af18e1da4d302a8d8133858ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746883, "uuid": "92feb5b6-5af7-4540-9f8c-63e56ef3913f", "comment": "Malware payload (Formbook)", "value": "7c9d5d1729d5104cb4930ba6b8460f0f03284ca5cacda61a8fefb1fcf3667451d6f8485785b6a972f6aa7ab9c5c629c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746883, "uuid": "5fd58f62-bcef-4ebc-b97d-faba1c02ac90", "value": "T1AA923C014BA85B13DEBBCBF026E48A258F75738535D0D6EB5DE9D0C85FC2B500681A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746883, "uuid": "99742291-8c91-4c75-a11d-3747c8ce3b1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746883, "uuid": "cbbbf830-5efd-4949-9415-1d7c2d23cb3e", "value": "384:mXvyKKp2QkbUnY17CQL8DNLC4I/AfLRKtU9j9hOy5:mZUY1TL8Z+al9hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746883, "uuid": "2af7f847-1182-4d41-8553-da346b1a8686", "value": 20528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746883, "uuid": "64eccfc5-f912-43e4-a24d-91d12f14bb6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746883, "uuid": "8b588bb1-bdb0-47aa-a1d3-9c6de268b614", "value": "INV-F220100011pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f51c19-ba70-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649775349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775349, "uuid": "ede7777c-c891-4f54-bf35-71951fabda44", "comment": "Malware payload (DCRat)", "value": "1ce3493f3e641410e9115c535a099968", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775349, "uuid": "cc970801-b49f-440a-8539-e0be50890aac", "comment": "Malware payload (DCRat)", "value": "202879748a5faa4b266e6b2321f475e645c7bfe96dba2a3b2a986c53d5a7e946", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775349, "uuid": "c9a97918-d896-40b9-895a-b1163bf3ad81", "comment": "Malware payload (DCRat)", "value": "9af6fb44250a6eff3ecc37fbde0242fd3b486f90", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775349, "uuid": "90c98579-21af-41b7-9e96-1f25da85c574", "comment": "Malware payload (DCRat)", "value": "af8556d98c39da4f819086eb7fd5b234215218f3c44b9bb00024722fef7a502d780579e83a2d3d92503b38fe65b42cee", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775349, "uuid": "51b55eeb-2838-4365-8224-564e1b80db5e", "value": "T14F84C07DEBED6A43D69A137988C602B187F19510B093DBF7B0AB1AB52D83350DC1A14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775349, "uuid": "5423136c-8048-43ed-9478-43daa11239c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775349, "uuid": "e34921a1-ff4c-4685-8b93-3251ad05143e", "value": "6144:HqvhJhz0IUSR3T08h0ZrMQHyBrACty1gMEN7jy4uKAsrKcqt3G:KHhYCQ8h0ZrdyrACtcl2ZzrKcqt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775349, "uuid": "d7ab58ff-e262-4005-9578-38b8803c5053", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775349, "uuid": "60548512-0ef4-4ac0-86a1-cef60be0b42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775349, "uuid": "bcaa9e9a-5a68-4ad2-8f63-65213427a409", "value": "1ce3493f3e641410e9115c535a099968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bce1408-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749995, "uuid": "dd9b7d66-e0f7-4d6c-98b9-e129a8ab5dff", "comment": "Malware payload (Mirai)", "value": "8d908912482253705b9a00a079eac78b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749995, "uuid": "f16aca88-1490-436c-8d07-69124c661dde", "comment": "Malware payload (Mirai)", "value": "20670e15cd173a464988b34630339ab35bcf2e8352fd89017f3597e77eeebb7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749995, "uuid": "c20629d2-52cd-4184-8feb-643f28a22186", "comment": "Malware payload (Mirai)", "value": "79cf1f27270423e7a06f5294fe6b94211c27d8a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749995, "uuid": "9291f7e3-35e0-42a9-a061-2e9947a15d65", "comment": "Malware payload (Mirai)", "value": "d043a08d2e264f0c377befdaf22ff71dd49c65e16a11707f3107e3a6a10025c09910b1b7b8846a83a0d9bc3096ff8ebd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749995, "uuid": "04e2e7a7-5d18-425b-b327-48a337f03655", "value": "T1BFA2C0A4C13B4D51EAE6AF702DD2C5CE3BF11D4F71E38DD61151EB42261B8524A98CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749995, "uuid": "d7eb2387-bb00-4ce2-b761-f37b9b7d6bec", "value": "384:ljqkELJFswRcYiHRBoG7yLOLUm6yE6+8cIalZtM4uVcqgw05LxJ9d:AlJFswRhi3ZXLURBlZi4uVcqgw0zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749995, "uuid": "9edde665-3c4a-4673-ac92-586bea04243a", "value": 22280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749995, "uuid": "4f2200f9-8f51-4d14-ba66-61d64b1de3d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749995, "uuid": "71213f1e-540f-4945-a340-a424a024af23", "value": "8d908912482253705b9a00a079eac78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ea4634-ba34-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649749663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749663, "uuid": "3320d858-b950-4e01-bca3-2fe9fbc1b99a", "comment": "Malware payload (AgentTesla)", "value": "5b98e6542c1899504ab099e7eefc43da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749663, "uuid": "e3a7d522-d135-4e70-97e7-2bd88bfe7191", "comment": "Malware payload (AgentTesla)", "value": "208452c859f7b89777e22fdbbf1307f16138d13bdb766b6b7951c5362e71fead", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749663, "uuid": "244dade1-0a5b-4871-bfc9-e79eb7e78dd6", "comment": "Malware payload (AgentTesla)", "value": "dc347995de628659541a890dd304e46309163312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749663, "uuid": "2ce0287a-3ecc-441f-8501-90498cb55679", "comment": "Malware payload (AgentTesla)", "value": "9cd726eed005861905dda718aa6d6458e0016627a301f1510cdbe50a79a0d8d51ca772d51766af2e93a7a0840b7178a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749663, "uuid": "58385ba2-e966-4629-9673-066891399f7b", "value": "T1C1250273BB56DD57CEEC96780861BED6A3F343229247D74EACCC92A9B7426D847010C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749663, "uuid": "825460f3-97c8-48c0-9726-76b5e748f436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749663, "uuid": "351f26b8-3f2f-407c-8a06-d228e5b0f66e", "value": "24576:1dBqCebfeuXVgOdKFgkK+9BHkwBZTg2X:1dBqCafeEVXKzl9zZTg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749663, "uuid": "d8b15589-3a62-4ebf-877c-3227f227c872", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749663, "uuid": "ee3b7673-23d4-4d7d-a9e5-b68be7ebb8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749663, "uuid": "5ba32c57-e32f-4ede-84cf-92745ff3c456", "value": "LC 2022SMC003SUPPLY CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bac591-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766010, "uuid": "2d150c03-dc14-4491-9f7d-4cc33af8b13c", "comment": "Malware payload (Formbook)", "value": "9f9a40eeff4b222ca24e6ebe6de0a7c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766010, "uuid": "caa3e3ca-2657-463d-bef8-156aefe7870c", "comment": "Malware payload (Formbook)", "value": "20ceb4d62738b1472fd88b7ea5ca3d9b1774cf1fbef328f4b349e749c68fe0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766010, "uuid": "84e4244d-395a-44e0-8f03-e070ce415bb1", "comment": "Malware payload (Formbook)", "value": "5e16a1d2e4ae150e35623e34aabeaef2edadc063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766010, "uuid": "37489cad-e66b-4d84-81c3-873ba15f9716", "comment": "Malware payload (Formbook)", "value": "419916c4bda42e83644c4f455896dcaa8fecb40d3dcfbb0d9047f84990cc444dd573c559a2b54843abce45c9c59101d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766010, "uuid": "29697ef7-d741-41d0-99fb-b7efa0e1f3d6", "value": "T10DD4E1117AF88629E9FD0BBDE06401904BF5B22B6827D3BC1A0564D97D733D0C647BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766010, "uuid": "3acf0f36-4314-4b4c-bc3d-c63c087879a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766010, "uuid": "80455e76-1d15-496f-9638-6975ba704ade", "value": "12288:ckKUk6sIPU4qwrHxDdo++3+GUY0B6FrVW0rNte0gvxyDLO1X6m0LgVgz:ckKX67PvqwrHx50OGH6gpWeOP3x0km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766010, "uuid": "55c89312-4bc5-472a-92be-42f1704750f6", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766010, "uuid": "a36ee9cc-3df9-4f4c-9b6b-6599c58366b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766010, "uuid": "3d3c7e5a-0f77-4079-b7c7-ecee2f409419", "value": "Acil Sat\u0131n Alma Sipari\u015fi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1143aa01-ba3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649751910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751910, "uuid": "7be9846a-343e-48e4-9b20-797ad300c80c", "comment": "Malware payload (RedLineStealer)", "value": "209609199e47fecdd76a96dabf1f9cf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751910, "uuid": "72e5efc6-6482-4335-8081-a4b1967d62ff", "comment": "Malware payload (RedLineStealer)", "value": "217265e900ce6d8b7750e25c9d4560715f2e58be5a2aa9210ba4f9974ae760c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751910, "uuid": "c45cca76-81d7-4773-8b32-81fed639973f", "comment": "Malware payload (RedLineStealer)", "value": "4ad578096b72f376bd012d3f3ba6a6cd7f162432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751910, "uuid": "59c81d2f-33af-4287-872e-a324c6d5c5d3", "comment": "Malware payload (RedLineStealer)", "value": "7b943f6e4c6d07733b0aa4ca39bd84b2d60b6b887168a863f2fc4445aacff042b3174e0daf2fa5cbdd4cb977f7911bc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751910, "uuid": "70d8739d-fd08-46a7-a37a-269e27909166", "value": "T19A84D0A1B51A9BD8DE5A8BF009264320127F7D0D59ADD10D38DB3EAF76B33032151E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751910, "uuid": "4938644d-c9c1-4739-8c0d-729212703454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751910, "uuid": "536da175-df02-497c-977f-8a0bfc4a6575", "value": "6144:8aM4riOlP2GhNTi2BsCx1wsWO34xrxafUA5VyNmMpHXrvObETLLEAmg+:Z2iNTbnWvrxasAWEsybkEAmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751910, "uuid": "94018ab9-2099-4f06-a717-5ecb8e6cc59c", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751910, "uuid": "e19c70d4-52b1-45fa-8bcb-afd8abeba178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751910, "uuid": "16292d44-3d66-4ba2-97f6-5067e98dbe66", "value": "209609199e47fecdd76a96dabf1f9cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bca8d22-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764141, "uuid": "36e5991d-1486-4062-bacf-3f1828904a14", "comment": "Malware payload", "value": "3200ce697a537c4e866a29102f4ce606", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764141, "uuid": "664e0c21-211c-44c2-909d-cf9a793ef4d7", "comment": "Malware payload", "value": "218be6350f6113463a0d1206589de050eac190a6ae5493e649413dff62ad19db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764141, "uuid": "63b8239c-cd21-4b58-892b-36862b607382", "comment": "Malware payload", "value": "32daaab0fdc7f57cc4683cc7953ce34ce8773fb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764141, "uuid": "4482f91a-85dd-4b62-b9f4-c83e937ecdcf", "comment": "Malware payload", "value": "64c250f24da4665531f200842bc0ae2cf6ca4625b5f7897c07b6a7312f139f074be41bb092bc8394b843e8cbcff0dc7d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764141, "uuid": "c051d528-7c31-4b6a-a848-a22f5b503904", "value": "T124A567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764141, "uuid": "d51f4c80-4f9a-46c7-b81d-d9f9778f3f8f", "value": "12288:WFhGGEuAYSb3jPsVsRQPVIQ7mlZueEjfmeIcVW8j4oMeiZBncu3wGo66p:KgGEuebjkuWPxYwehenVW8j4odZuxN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764141, "uuid": "e08a4f66-280a-4366-8d2f-ac86551c4e61", "value": 2156554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764141, "uuid": "caf4a552-bf16-4775-b548-082b9950ebf8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764141, "uuid": "f68f4154-1ee7-4ed7-8d26-f2eb2d89b66a", "value": "OPOLTRANS 112022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcaea87-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "0406c64f-0d42-44bc-81a1-9cb7408c19eb", "comment": "Malware payload (Mirai)", "value": "a35fea70e2441c5495ce162cae120e47", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "5e7f9827-04f4-45d3-ba2c-a46ccf2396a9", "comment": "Malware payload (Mirai)", "value": "221343f12f169f7e0abd2d172220bc90fbd5ae16682f04d5f84597afa4c9d594", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "bc345032-ea13-4b00-a8f4-d02dce31c6aa", "comment": "Malware payload (Mirai)", "value": "08836f1b90968b010b669698348f2914d4ad7e22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "fdc294ee-5528-4284-8381-3a545effa20a", "comment": "Malware payload (Mirai)", "value": "f51c493ad79d93dcc76cbeeca8aafb4a0a2b7ff1839d1842da89d5561813d18c09782534cbbb62991eb37582c40af8db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "ecee5625-6f2d-4372-9df4-af5fbb0ed64a", "value": "T15DE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "c2f1c7c9-3764-4c8d-8b9c-2a3cb0f828b2", "value": "3072:dgZc9h1jlnLA2PiXYeyCc9VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ9VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753404, "uuid": "083dd4a0-c3d7-4410-812d-582e52749998", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753404, "uuid": "e066a110-e7f2-4f93-9bbb-0bc1fbf59bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "0935a085-78b2-47f6-9a90-345a137bceb3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dfb191-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763908, "uuid": "8674c988-3bd6-4ac8-94d3-b2b22a7924d5", "comment": "Malware payload (Mirai)", "value": "bc76d424dc38b932f90be82c9c7402f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763908, "uuid": "58e81fbf-16af-49c3-9839-0fc6dcc5daad", "comment": "Malware payload (Mirai)", "value": "2236ed0f8552c1193779ea65a7918ee6ce7afa676a8932187d49ca2859e89e78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763908, "uuid": "322aff5f-8dd3-49c9-81c6-7a01549820a1", "comment": "Malware payload (Mirai)", "value": "b9e1ee0b4e08775ed521e79383ad06bf4edc87e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763908, "uuid": "21153c1f-a43b-41c7-bf46-a3f1490f7e1a", "comment": "Malware payload (Mirai)", "value": "2da1b6317030f6d225b759da35fb0adcefd9c58dbc46a8521fd6facc3b3aad4e18e11a95759b30511e5d91211542a8de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763908, "uuid": "4c3d7658-845c-4ef1-9291-28ac499c11db", "value": "T13B13F256D6D9CDE2CFCB5AFAAED08FC43F930B49AF866F903150AE40561B2215215CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763908, "uuid": "69ebd303-700e-4049-83b7-b469ea9cb5ec", "value": "768:TLyh2QFbpvRTIqcwnLin7W3motDKS2Wr6rO5RlV/gmwclcCRmsNm/04uVcqgw09y:T23pvdJcw2n7WNGrOzlV/xwcDms4u+qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763908, "uuid": "446eff1d-9cc8-48fd-aeb6-fb00fe420360", "value": 43124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763908, "uuid": "b33b427b-65b3-4d95-b922-3070235bf838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763908, "uuid": "1a3a95f0-253d-43d9-80d4-7642cef694af", "value": "bc76d424dc38b932f90be82c9c7402f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f179a8b2-ba41-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649755292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755292, "uuid": "1a6a5da7-f369-4d19-9213-65495c419eed", "comment": "Malware payload (AgentTesla)", "value": "bf8047014922c472d7b58be5407ce968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755292, "uuid": "450daf06-21d8-4009-894b-95e96b89f5ef", "comment": "Malware payload (AgentTesla)", "value": "223d229605824345b0a52e8cda6b4b5cec4e538b4d8c0865aa639df10e1c8a31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755292, "uuid": "4632b4e1-d5b9-41f5-9679-58d9dada7202", "comment": "Malware payload (AgentTesla)", "value": "4efa7472257250f8e9d47e61ac92deb7579deccb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755292, "uuid": "1da55e7f-939b-40cf-8b58-a4e41d6a57c4", "comment": "Malware payload (AgentTesla)", "value": "dee53289e990fe2dffc5cb7d837b78b35baa156ef5d315d41789cd10559efccb3a38d98eb9a97e87353f5c9ae931c4b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755292, "uuid": "7960cf4a-e864-4b27-9396-8adce3014fdf", "value": "T1B8350277BB56DDA3CEEC967808317EC292F183229247D74EACCC91B9B7426D85B011C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755292, "uuid": "8cca1654-ce37-4878-a249-ec54167a43f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755292, "uuid": "1d89b9e4-448a-491b-9e75-2139973ce45d", "value": "24576:bdBqCebfeuXVgOnZjbSe05iIEr2xNZAUbgMa9Fgk:bdBqCafeEVVZjbSe05jEr2FbgHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755292, "uuid": "8c3c46e5-0a06-44f3-ab5a-83f89413e091", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755292, "uuid": "51b46800-a88f-42e1-84e3-6f6a11f09216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755292, "uuid": "ba50698c-45b6-47bf-84a2-54b13cca6c0a", "value": "porforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5ec138-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766046, "uuid": "b5988fb1-a803-4aff-b113-c3e53bfa2bb8", "comment": "Malware payload (Formbook)", "value": "fa1641b9d0b34483ebf416c926ebe2d4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766046, "uuid": "2ad82cc3-acda-49b5-894e-d184e0d34f26", "comment": "Malware payload (Formbook)", "value": "226626815bd89794755b446ad9ab17aed9287f970e5aed3d184dc34e1ec34e8a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766046, "uuid": "de82cd45-420b-49c8-bd91-b7544fea1016", "comment": "Malware payload (Formbook)", "value": "2cdde1c0ad9a33deaa1992984398682d362da854", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766046, "uuid": "2b7367d6-380b-4cca-b3cb-ef4070865853", "comment": "Malware payload (Formbook)", "value": "1c86aa5b0fdd88dd74d6c8bf4b9aba2a2c3a0bceca54b9403baae1d1d5c6629c6faffa0fb0169cb8f4475c6fb6a040e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766046, "uuid": "5bfeddd5-be7c-4378-8199-aa3a2a40e039", "value": "T11AC48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766046, "uuid": "e662d2b6-1a53-4d4f-b384-35949f7bc1f3", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766046, "uuid": "96064502-0b3e-4e5a-8032-57b8eb10693f", "value": "12288:Vn/zDvGHAykHSzLW/4+8bzbBSreMdzLKgFK/UqW:ZzbGHAzHAjX1wccL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766046, "uuid": "755f0d11-a83f-451b-b7a8-dcd8f4dddb05", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766046, "uuid": "cc753de4-1edb-4fa4-988f-b2563fd502f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766046, "uuid": "df655e11-4c66-428f-8337-e240ef2a9f27", "value": "PO1.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10da8f6e-ba37-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1649750621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750621, "uuid": "b5ff5dc9-e536-4e50-b7e1-bc626665dbf3", "comment": "Malware payload (NetWire)", "value": "622b8e559902bbecca5faa11337ab73c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750621, "uuid": "e7da7bd2-231e-4616-9bc9-6af4a538f3a6", "comment": "Malware payload (NetWire)", "value": "2343324dd51ca8eb8bfd3ffcfe3163723f3264818960cd22eafdfe2f31cf0990", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750621, "uuid": "aa00817d-3925-47e8-8b6a-573421115f32", "comment": "Malware payload (NetWire)", "value": "2a7b4bf496006a157d0b5f2e4c48e5f4bab44d29", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750621, "uuid": "522fa480-ce67-4c26-bed5-9f4bf2622c4e", "comment": "Malware payload (NetWire)", "value": "ff41a09c221a26776681ae8e0a9c7a870501017ffce5598dbbf1ebb4037298dad9d88ba8531e5ecfd70a0b8c9a6c74a6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750621, "uuid": "ac0e16a1-8f4c-44d1-98ab-cef06f6cd1e1", "value": "T19BB4235014E8B9373C5AEF7972CA2AD79A9111773B2C1927679FB8581C6ACF0C243389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750621, "uuid": "10c6bbb5-ead7-4883-b6de-62dca4028a88", "value": "12288:ga0KrhfLFlKBRW6Cp7pJweTw3QWVw2uwugmWM:ga0OVrKBYN7pueTwT0wugzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649750621, "uuid": "661ee22d-a244-44f4-a11b-90c5b146da9b", "value": 505994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649750621, "uuid": "de704b68-ec33-4cae-ab2c-e0df99dcba3d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750621, "uuid": "ab1beb28-58bd-45a7-9f05-ee4bd83fed2e", "value": "PO-068697975-9798-Order pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff828932-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649766053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766053, "uuid": "076203ba-8e5d-4eac-b94d-c8b0e40f2660", "comment": "Malware payload", "value": "d48347ce276015a62afa673404df2993", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766053, "uuid": "01b822a7-cb99-46fc-9803-48de2708c40d", "comment": "Malware payload", "value": "23a84d144b93db33a70254e37760db48a1b7713a1e23783c05e4e43930f5df81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766053, "uuid": "387127bf-d20d-4511-bd73-00413229ab30", "comment": "Malware payload", "value": "daa91c2bf56dc584aa2087b6173a317f689c1125", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766053, "uuid": "c684a047-2546-4fce-90a3-cb2e42feb3ac", "comment": "Malware payload", "value": "10725bea0dd043a6ff506df8ae07f93c56b943d30657c1b29f1ad35ef502511e09f62c06328ffca0803f21a3d60209e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766053, "uuid": "56742cf2-d5ef-4861-a93f-341eed49701c", "value": "T1D2146AAF5AB01BE7BB654804D0AE073A47B2270952F5F8CBD2612FBEDE725081E1553C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766053, "uuid": "2770cae0-715d-4015-939a-884b6e4c851e", "value": "3072:JJM8tPQ5bb/2vlZjc4JGWeANkoaGuaSlcP3US7hObFdjX3:JRtots/jrJGWe7Xgp9Or3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766053, "uuid": "22e4fe29-d2f8-46d5-bb49-68c1304eb99a", "value": 203231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766053, "uuid": "1a793aa6-0f3f-458b-9b27-9b6a4b6d4bf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766053, "uuid": "3e64cea7-73f8-4b91-9d5c-ab3dc3571a41", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4722d21f-ba6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (CryptBot)", "timestamp": 1649773045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773045, "uuid": "27d25311-8115-40dc-acc2-34b4855ca7ae", "comment": "Malware payload (CryptBot)", "value": "ce49df0ba4bddeb9ad1380a5b7e9331b", "object_relation": "md5", "Tag": [ { "name": "bridmz52-top", "colour": "#85A21B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773045, "uuid": "3ad71469-c26f-46a7-a325-d8be87e1e204", "comment": "Malware payload (CryptBot)", "value": "24336a3c69f863981df13cc9c2cc8fe002d642962fc1d12c87062a8e5d273889", "object_relation": "sha256", "Tag": [ { "name": "bridmz52-top", "colour": "#85A21B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773045, "uuid": "03741819-3e13-43ba-a8b2-cfb9f8f571dc", "comment": "Malware payload (CryptBot)", "value": "36ccbc79c8bae4db35e280761a1d70aa56098295", "object_relation": "sha1", "Tag": [ { "name": "bridmz52-top", "colour": "#85A21B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773045, "uuid": "574d138e-735e-49c3-8543-b1b22c5c98c1", "comment": "Malware payload (CryptBot)", "value": "3a2a974ec14605d560badb1f90abb9036560020130b1f2ab60eea47424d8c18f2f910e94eddbd42fc1fe18a04dfc4775", "object_relation": "sha3-384", "Tag": [ { "name": "bridmz52-top", "colour": "#85A21B", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773045, "uuid": "2a3290cc-ac3a-4c7e-b171-832b6b85c83a", "value": "T177444C017990C131E77196322A799F7185FE7D389E7062CFA7800F39DA316D2A925F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773045, "uuid": "5d003714-0d88-402c-b8d2-4b5e1babde71", "value": "c558b851580d3599e6409335ff1479b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773045, "uuid": "c12ee2d9-5874-4010-9821-5afad90bee88", "value": "6144:gWMjIwAafnNLPJWvVsybC2DTTvmp7gC4skNlu4MsKIwax:gWMjIwRfnNTJWvVs/2D/vmpwskNlu4Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649773045, "uuid": "83abb6f5-bedc-464e-9421-18b452286e15", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649773045, "uuid": "38956a67-37e5-4a6a-a42c-fdecc026cb55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773045, "uuid": "54e80212-43e7-4c4d-9ed3-e2312d3d0167", "value": "24336a3c69f863981df13cc9c2cc8fe002d642962fc1d12c87062a8e5d273889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3d8dab-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749804, "uuid": "cff75425-78ef-4f09-bf38-288348967b24", "comment": "Malware payload (Mirai)", "value": "7af7faf632be6dc9c3457a0e1db32ed2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749804, "uuid": "2b23139c-9d93-456f-961a-4a3e7fcebc05", "comment": "Malware payload (Mirai)", "value": "2443dda4d90739a910821b310ea41e410bbb1185d83a8793ed58e679cce1d58e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749804, "uuid": "d550e48a-9a51-48ff-8ad2-d726d4a25ee6", "comment": "Malware payload (Mirai)", "value": "1b346b9c678259ffab6d54bff4042a7c156c442a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749804, "uuid": "cd767860-dffe-4630-a143-d21fbc87c812", "comment": "Malware payload (Mirai)", "value": "a1bd10d5776882e4bd36c20404003f267421f724a67e112f2868b137bf50f1a595260222c63e55499f1a5d419aca667e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749804, "uuid": "0d8cebb5-314f-4ba9-b634-494e2fb0f098", "value": "T1E1A2E0A0AE82AE6EFCF5D1369BA5ED06D540BC93374D431AD029917530EB202F5619EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749804, "uuid": "d289d84f-bc78-49dd-8eec-3721a9abc59b", "value": "384:MOX206yHsN1DG/JKQtDhdKoahlAZB5TsR/VB5ixCNyrQ:f2/uBKmEcBBKEdrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749804, "uuid": "87c4e32b-7a4f-4661-8a3e-a08109ecde9e", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749804, "uuid": "c11e55ca-f36d-47dd-bf5a-93595e247abc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749804, "uuid": "8e08d63c-0925-41ee-805a-95c9b48ccf5b", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7deebc9a-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746938, "uuid": "ea467128-58d6-47fa-8be3-465a47a17912", "comment": "Malware payload (AgentTesla)", "value": "ac12c64ed9930b559a1affec14ec36fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746938, "uuid": "8ff9d618-52ad-42e0-8461-acfa01fcd1bf", "comment": "Malware payload (AgentTesla)", "value": "24726ed81db62d790db5be500438ff2f2cb333ef1d381d080903f0ee29110637", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746938, "uuid": "a377ce38-2ddc-48bc-a746-62f346b4e4ca", "comment": "Malware payload (AgentTesla)", "value": "7b3df9c13b29d7620f339bfc4d5b2ed2cfdf8e56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746938, "uuid": "844fb62a-71b4-4c1c-b982-480033229188", "comment": "Malware payload (AgentTesla)", "value": "95f69d0d5aad7749fb6b05182d865b7525d5a2754caf9c2ab894b86cd9dbafdd79a6f00c9160ee95135ce86f69280000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746938, "uuid": "0bd7d592-b362-4885-8b5e-b53d04d07b40", "value": "T141353303935D1C54B1B1784FD1B8CA1F44B7F67A844183E47AE026A3BFBD925B8AC786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746938, "uuid": "d144c799-cfdc-4094-9bae-281f181a87fe", "value": "24576:EU+yR8Mduz7cFm++hs/aMIFUs8uFyTQUNczLlsB/0Gelbn:fD8Mo8FmTmqUluO06B/0Plr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746938, "uuid": "c902aee4-f4b5-4ab5-917e-bf744cf5e7ff", "value": 1069268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746938, "uuid": "272ec9b7-6afd-455b-9cf9-316825ffa2c0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746938, "uuid": "153ba79f-21c1-46a3-9091-5a142096b1dd", "value": "Swift Copy.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf0eecf-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800758, "uuid": "cf03d20f-0fe7-4d8e-8d58-a9819866e853", "comment": "Malware payload (Mirai)", "value": "04f83ec2f4027f8058e479e57987b1a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800758, "uuid": "6d929941-ef00-4b33-a19c-75703739c5df", "comment": "Malware payload (Mirai)", "value": "24b659881b129f644ae7632023e82570e14d6c7d85097a0dee8803e0ebe8275e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800758, "uuid": "8a5ea6cd-24d1-43c6-9a7c-56b7f50ebcbc", "comment": "Malware payload (Mirai)", "value": "b2a4bd777a7cca51529460c16eb138a60e17111a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800758, "uuid": "5372136f-fc62-4471-9356-75a9ada9ba55", "comment": "Malware payload (Mirai)", "value": "38de4e565caab2c6915d35d4a8b9b98e0bb440e92e89a789ea0a6bffab3ef80d961b961faeb873975ce7042b2f9f538a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800758, "uuid": "3bb18c63-ba6f-44d8-8527-bc31cb7658a8", "value": "T12623F1BB6165A178C0D3C07004750385B83AB52D1D427EFF8EA575DF8E69D8EAB38642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800758, "uuid": "41e09258-4601-4137-a4a5-5ade8f06e5ce", "value": "1536:clZMg27yitmGCboO6coEvMCPmV4C1UfUNRh:U6g27yKrCbYcoEvgQU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800758, "uuid": "17f5aaf3-6478-4cbc-95f7-021b196ec309", "value": 49812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800758, "uuid": "da4ca388-a25a-401f-a67c-20ba5a303275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800758, "uuid": "6897b43d-5261-4710-a888-a71320d1dfe3", "value": "BDK.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9cdcbc-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764330, "uuid": "41e3e41b-29e3-4624-94c0-9dfefa20ccb2", "comment": "Malware payload (Loki)", "value": "b9be604a1f222d8b4fdf4e11a4bacb5e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764330, "uuid": "746cdd2f-9132-4f42-93db-5cef1d580f5d", "comment": "Malware payload (Loki)", "value": "2509396fd264d5cb19e55d0e0e74f8f32b4ba9ec82a35c0b697566f78df6122e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764330, "uuid": "5335ed8d-15bd-4a25-be8c-cf21b982b139", "comment": "Malware payload (Loki)", "value": "f1a6fd4102caad1ade4842ef778bff5a1454147d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764330, "uuid": "1cb2277c-20c8-4adb-b90e-cae0a1d6d2ec", "comment": "Malware payload (Loki)", "value": "84439e9ee66acf762840f22740faec8fc835e390ecff8ad3860003255763838407e526ef1b23d69a8b59654083a9df6a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764330, "uuid": "acefe3a9-c16c-4852-8d79-821c96f43b11", "value": "T1647422D17B50E37AECF333BF5EA528655204DE05466898A8CF4A32688EFCD04F767062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764330, "uuid": "0679f4aa-864f-4de3-aac7-d97628bd0857", "value": "6144:WqZ69yCO7uwc0bIcqUV5+ZqEJBAOUbMsvKrRlEz9iVQQ7vdjsBxv4:u9yCQuw5pV5+4ZZwAzrQ7vdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764330, "uuid": "636cfd07-c072-4b06-a6f4-24eec937af08", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764330, "uuid": "aacea727-bba7-4e3a-aabd-b3206093a312", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764330, "uuid": "d2ba80a2-4956-4684-bbc7-0a84b6d62c61", "value": "2022_04_01_12_07_38.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde6298c-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800759, "uuid": "80068b57-7384-4f5b-87ed-98c85174bb04", "comment": "Malware payload (Mirai)", "value": "f9da08794e9cf4cf89f60500722f0328", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800759, "uuid": "142f3f1c-c2e7-45d8-b068-7d65bbd9690b", "comment": "Malware payload (Mirai)", "value": "2529e2754e6fede3afbb0705bb8e71831259850fac6ac1cde90b49e92623d29f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800759, "uuid": "ee246fd5-4850-4316-9950-b2bfb5bab996", "comment": "Malware payload (Mirai)", "value": "1a9f709e103b10fa8450d104ee63ac0985f0bdda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800759, "uuid": "dae47c35-ce1c-4e7b-b805-b02f778a16a8", "comment": "Malware payload (Mirai)", "value": "4f38d25f020241d325fe24c06242a287474762fc5b4cbf38cf512ed11083fd4a44ac88cd58fdb5bdc984e8666462ebae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800759, "uuid": "5f83c24f-ba94-4f8f-84a9-97efa70808d2", "value": "T1A933F15EDD507F8ED9BE1D7466CE27BC1C643280B24CEB2513231C0CAB669BF76A44A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800759, "uuid": "db48df9e-6825-4b12-b85c-b2f3808ff2f9", "value": "1536:JDoOPieACLVSLs10V1wo71Hz+rucPSxfBWmq:CwiedN8qoV+VPSv1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800759, "uuid": "7de1cd04-9897-4efe-80f3-e170c9c36434", "value": 50340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800759, "uuid": "14424883-c484-4946-971f-7e328a90bc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800759, "uuid": "3fdd8ea0-a0e0-473d-a422-e62078068e5c", "value": "BDK.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8068ef-ba61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649768926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768926, "uuid": "5e194cfd-93f2-43a8-bdd7-7d82f2438358", "comment": "Malware payload (Heodo)", "value": "87fccf0bc7c9682954c0227f6c8e46e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768926, "uuid": "824c961f-b3fc-4e04-88db-efb66a687d98", "comment": "Malware payload (Heodo)", "value": "253f28736ed6b4e1f16ebffacad122b1deff6516e4b9b36e8c7e26cc92ba95e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768926, "uuid": "a9a3850d-21c2-40de-9c4a-9a9cd9e3c5dc", "comment": "Malware payload (Heodo)", "value": "864226383364064ac2e95602b76aae744fb3ffb1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768926, "uuid": "3ca48ca3-0acf-4bca-979b-2fd6ed384f3b", "comment": "Malware payload (Heodo)", "value": "74e8734ceb84427a1502f75ffaf10c60191d91a4b0b2b8acc1bb2407ba8143292ffd710a54ada27f773f39f0753943c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768926, "uuid": "7d3e1b05-1d9f-479c-b704-4c23dc78bf59", "value": "T1E774B2A35BC3C077E50B06BAC6595118B157C632375AAADF37C1A71ECA3C3A2B738161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768926, "uuid": "25550288-fc8c-4a2e-97bc-b232ff1e1cec", "value": "6144:wGOAWAyzLzHKwJrCf9dJJjI1rQlzLOu7H7pLYsDgiZ+/TccZr40HOnUqSEnyk3uU:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768926, "uuid": "0172dd5e-8532-43ff-932e-1eb0c6e9829f", "value": 343136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768926, "uuid": "35be2d85-1075-4faf-94f9-84aa1fe9ca67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768926, "uuid": "84662b15-9dfc-46b0-99d2-e57840cb4d8a", "value": "emotet_exe_e4_253f28736ed6b4e1f16ebffacad122b1deff6516e4b9b36e8c7e26cc92ba95e0_2022-04-12__130840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1758da73-ba2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649745048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745048, "uuid": "49fefe21-44f0-4797-bf6c-95645dac0b4c", "comment": "Malware payload (RedLineStealer)", "value": "6162b31ec8c322b47f24b6c4bb143bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745048, "uuid": "b0de56d4-b03e-4d62-b294-f1faef2f1440", "comment": "Malware payload (RedLineStealer)", "value": "264d14b2eec90def3b9570909d900cfdd74a3f491fc6669b2998972caacb4cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745048, "uuid": "0ac35251-7473-4b0d-b679-ff0f2d65188f", "comment": "Malware payload (RedLineStealer)", "value": "7ff32fdab037d75b83d97ef744a016bf92141f6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745048, "uuid": "3ffbffac-aa0e-4bc1-83de-3086b5c59864", "comment": "Malware payload (RedLineStealer)", "value": "5b242f6ad937493a517eaf69740fd7ba297bed1465d899b5d15b489ff63d2d56e5bd6be644605e688cdc667aaaf528e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745048, "uuid": "0a1c1f7c-6eca-42f8-8fa2-88e3984bfa99", "value": "T15C84CF10B790D035F1F716F45ABA83ACBA3E7EA15B2450CB62D526EE56356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745048, "uuid": "41af04fd-2a85-4e5a-a94c-2adb2d44afdd", "value": "c05c69e25e4cfe454ad2fbd0d1a9d1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745048, "uuid": "1ff90181-0328-4587-9ddd-feea756e4b4e", "value": "6144:d9tUA4gKzeMzdp71w3u3KEKLizVS73ZSHA85rinJ7Gi6P1ip4KH7oCD:ztUA4yMzdp7arLiJWUb1iJCtY4KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745048, "uuid": "bde88b8f-c4b7-4b2f-9ed8-692224f96aae", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745048, "uuid": "b8d512b3-3add-4b21-a4a5-e2592e2b6537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745048, "uuid": "78e22c67-ea34-4dda-adbc-aa9739b39b17", "value": "6162b31ec8c322b47f24b6c4bb143bf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131d800b-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746329, "uuid": "0c7759dd-73bf-4350-9fdc-b5776b9c28cd", "comment": "Malware payload (Mirai)", "value": "d579c30d6d0a1fe071157cb98060ae9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746329, "uuid": "b40cdbd6-cf37-41a2-a031-aca7a52c7f47", "comment": "Malware payload (Mirai)", "value": "27fe253321b18d787af992947b305b8a10ecfa935e523797c6837a748e7e7b87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746329, "uuid": "6fc66814-f86b-4aea-8e93-35ef42443fbb", "comment": "Malware payload (Mirai)", "value": "6a1b3c4dd5b6bb5b03a4ef37ec298c143e14c85e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746329, "uuid": "d069686e-fdfb-4b7e-ba47-a974d789856e", "comment": "Malware payload (Mirai)", "value": "1a231ef20efa25283b08cb5b412e8754d1ea3da7c8efb6b6bd6b0cbf11a61989524985c9f63e7af6156d0ddd61281877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746329, "uuid": "9c131fc8-094c-44ca-bf4d-f0425a13ac37", "value": "T100F2F131CAED4D21DBBA16F65511C2D383F48EA732E5E970ABE42F016DB1B125680BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746329, "uuid": "6749181d-774c-416c-bc8e-de819f107920", "value": "768:chOlcNi6mnqYMjG4ntd287DIgPi8nvRbXo9+04uVcqgw02NWX9:chOlcY6agt3Igrn5Z04u+qgw06WX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746329, "uuid": "d72a4d42-5a07-4fa5-a838-b4ad4145a42f", "value": 35984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746329, "uuid": "2bb78f61-dab1-4398-a287-a277d6ab2627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746329, "uuid": "2fa82fec-6dc0-45d3-801f-6469a4343fad", "value": "d579c30d6d0a1fe071157cb98060ae9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed07dbc3-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731663, "uuid": "16e25a6e-6bce-4bdc-8352-17d463eba449", "comment": "Malware payload (Mirai)", "value": "442c8634f750275da8ea8d43074fe8a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731663, "uuid": "a36a189d-bc5d-417a-9584-65f505cb43e9", "comment": "Malware payload (Mirai)", "value": "280cf7969e0d91679e3fa060a5c19f9f58f48e1257f9232d0857c2a00f7f1cde", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731663, "uuid": "54f5b63a-6e1f-4ef8-8409-fb691d480a29", "comment": "Malware payload (Mirai)", "value": "72353dc5aaf9ee17c62d855c4da0b9a8ccc85080", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731663, "uuid": "a3201e4c-37ec-41be-9e3f-d95434be84c2", "comment": "Malware payload (Mirai)", "value": "c7cc4ecd42e78d242ee66d0d285bebc2870b925922a9bf344353c91c2d95f0095f774a7aedf4ebf04ab99eae928d6723", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731663, "uuid": "62c0c425-87f8-46fa-8ce0-622449519bac", "value": "T168534AC1B88749F6C9034934609BF63FCB32D57B407196AEEF8A6E36D923701531629E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731663, "uuid": "cda8d786-4af8-4ac5-97eb-04fc480a82b4", "value": "1536:ZSYNpbi2RVapPijLdNFiJTdLxqSsLRV1W9EGSz:UYZRVapPiPdQUSsFV1E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731663, "uuid": "2c0b3fe0-d6d3-41d7-a440-db640373aa8c", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731663, "uuid": "cc79ccdf-1c31-4b80-bc2d-43489ef1c1a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731663, "uuid": "ebe7ba84-faa6-41b4-b462-f84a4ac33e4d", "value": "i686-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb4c20f-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649744765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744765, "uuid": "115458cf-3ab8-4677-a70e-ce265d200843", "comment": "Malware payload (RedLineStealer)", "value": "34201d73445da7ca13793069e7684737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744765, "uuid": "b73dc608-481a-4ba1-8fa1-2b64d7a2a714", "comment": "Malware payload (RedLineStealer)", "value": "284c3a7c666370376bce07b6c38ca16d4cff1f7008f5ac025e71b962d26482e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744765, "uuid": "8cb52d5c-e460-4bd7-ac1e-f24d5819efb2", "comment": "Malware payload (RedLineStealer)", "value": "a74c42f7932fedab6e01b8d6c8d2724d174472e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744765, "uuid": "025ccbe6-dfc7-4148-ac38-3ef3e3d2f6f7", "comment": "Malware payload (RedLineStealer)", "value": "83d58dbc719aad4c753c49ce344b002bd38459b3161f4404bf9b7cacb7232c9c7f9d3e8809d2e9d86854c99d73e4624c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744765, "uuid": "94d81810-b240-4570-b039-e20620406cd0", "value": "T1F784CF00BB90D035F1F726F855BA82AC7A3A7EA0973451CB62D576EE56356E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744765, "uuid": "85c681bf-82ff-4033-ba68-0dc819bb9597", "value": "c05c69e25e4cfe454ad2fbd0d1a9d1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744765, "uuid": "afd1599f-022f-4a1a-aeba-94126a2bb12d", "value": "6144:Vo84YrLbMpc/Y50C1qEMxaWIBHwqpmW09eGJssEf3kFjwsWU1r4KY:G84YLcc/Y50H5xaHBQqYz8WmkFE/U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744765, "uuid": "0a50255b-d8f3-4016-8e75-016f35d3c18e", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744765, "uuid": "565316ad-41e3-4185-8c00-568494dde782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744765, "uuid": "7e67b140-2a6d-4046-bfc7-e6fe2eafb3ee", "value": "34201d73445da7ca13793069e7684737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92153df-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649793396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793396, "uuid": "7e60d479-2df5-4ef1-b444-616e4b265c4b", "comment": "Malware payload (DCRat)", "value": "de01ea104912ed7856faaba5fa18c44a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793396, "uuid": "8a53fd6d-779e-483d-b87e-7f9159bdcc87", "comment": "Malware payload (DCRat)", "value": "2980eee281b7af23fcc2bf8d67773331990243a6ebb0b6343db5f125ad422a37", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793396, "uuid": "997f9946-563a-4024-805b-dc635474fdae", "comment": "Malware payload (DCRat)", "value": "07c35744ec2ea5e3d35b2f0e65d0d38a7d261a53", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793396, "uuid": "20e3c355-395f-40ca-976f-6e9d599765c3", "comment": "Malware payload (DCRat)", "value": "7011d060203a1939e42018a7f7beb5dde60cb3af50600e065c531928a46fe37038d19da3e7645f69bbc20847e5df2fea", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793396, "uuid": "39504faa-2e33-4620-b35d-64081f2ebf3c", "value": "T178B4FA282AE94929F1BBAF7D95F13496DA3EB6633717D74D04A102860723B41DDC0B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793396, "uuid": "85de2b5b-3970-4071-a0e1-525effb2bce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793396, "uuid": "16eb8a2c-0fa5-474e-9c7a-1aadbd33544c", "value": "12288:RQjQEMCYFzhC79lb3TS+E+gPa/10k1iV7:RpHCcNk3ptKs10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793396, "uuid": "f62458d0-b584-426c-b4ad-663e4d23e8f9", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793396, "uuid": "50e54ca9-bd87-45ea-8674-090dbed3832f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793396, "uuid": "d041a572-c058-4610-b9ae-1c3b88c94900", "value": "UBsIAV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767ef3ba-ba43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649755945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755945, "uuid": "366b872f-ae5b-4db6-9125-5a5b4bef723c", "comment": "Malware payload", "value": "2d717beae803c792f5a3cf1df1adc949", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755945, "uuid": "b16d3580-fcdd-498d-bd6f-a536c4f6652f", "comment": "Malware payload", "value": "29adaa609b7df67209a04d3a6a881a7f937ab382394fad1a3478b3f1f31f0145", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755945, "uuid": "ae38c00a-1169-4afb-b0b3-8d543de98187", "comment": "Malware payload", "value": "86e2f0c0451cd158ef2d20f6b7b631737764f50c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755945, "uuid": "92afb03f-cc59-4b03-8b2d-105fa8f6c7cc", "comment": "Malware payload", "value": "706e668abadc9df7d2582099dd9230b9c4f197b6beb1cec896c105679b5b12ad78eacf62e5e3574544191d4a9082849c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755945, "uuid": "3eca9f2e-3877-42fe-a122-6e4b072065f2", "value": "T1C151270266F9A1E8B3B3BE057D3476D64F3BFB3569699E8C249029085991C448C62FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755945, "uuid": "3431b31c-c45b-445a-bf05-9c686d21afd2", "value": "24:QKdU6qf72BheYfYloXvtUjY7wIQ/JVSw45F0hodKeNsrYYfYlR9GPQ0RLol2xtaf:v+6VfIOlJwZMw4r0hKKNfIC7GlpMvquC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755945, "uuid": "ffa74676-d570-44a9-810b-ad6ba61ce1c2", "value": 2750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755945, "uuid": "4a827780-efc5-4a66-baa8-ee1794288676", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755945, "uuid": "cf8613c3-ec93-470e-b2be-b6103ade264f", "value": "miUqzsHT.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad2cd33-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649777964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777964, "uuid": "80b27290-c7bd-47e3-88ac-a1505d9582c7", "comment": "Malware payload (Mirai)", "value": "6b39930ac43e077950c6126b9d3a9cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777964, "uuid": "9535f4a7-b920-4e38-b6ce-99a74b1a343d", "comment": "Malware payload (Mirai)", "value": "2a9e42ea6d8c166a73f3559b788464e5aea8b8902859d0deb957bc3311f6f53a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777964, "uuid": "d65408fd-eaa4-4130-a3f0-683c1e96fbb9", "comment": "Malware payload (Mirai)", "value": "bf58259b4af135dad008b2029d5a0748df72de2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777964, "uuid": "96ea1987-c644-425a-8727-151bd10b8101", "comment": "Malware payload (Mirai)", "value": "a303023d250861081ba24e647e72a87ede2988d514f16a5942a477ed9419cac8fe5efb49837a7025368ac42bcdb64124", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777964, "uuid": "2011033f-32d2-4f86-a270-ff2bc78f2ca2", "value": "T14773A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777964, "uuid": "49739d48-b0e0-49ca-bfe4-cf7baed66939", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP5j:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777964, "uuid": "ba665ecf-acd4-457e-88d7-9dd66a8a1d2d", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777964, "uuid": "579e9c21-f68d-438c-abc1-d259c84d8789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777964, "uuid": "b6f625c3-1601-4260-a36f-07fba7bc8a9d", "value": "6b39930ac43e077950c6126b9d3a9cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a4d93d-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764299, "uuid": "7ee6f09e-816e-4855-9c9d-3489a8b2617f", "comment": "Malware payload (Formbook)", "value": "8b0277f64f40969586ba8b94be3c2537", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764299, "uuid": "bb002daf-46d7-4300-a796-fd3e486a09f5", "comment": "Malware payload (Formbook)", "value": "2b405676529fbf8326b4199cc5979f505bb951f7220bd054f0f54ec1dbaba247", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764299, "uuid": "58017d76-2727-44b1-a3d0-b207b02ccfa1", "comment": "Malware payload (Formbook)", "value": "40421785b10f0092931e994dc726e60108d0ffae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764299, "uuid": "5c235cd1-ac19-45a0-a19c-d02af8ce74dd", "comment": "Malware payload (Formbook)", "value": "2a8190cf5a7cb999ac03a8e3c98aa8e775a21ed19b6350a6f38a5a4f2ddc8f486654c996f997f29eb558495d0134e439", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764299, "uuid": "2101c391-3f3c-4a71-b4a7-c0640004d54b", "value": "T130741269F9F5F223F4A34937A6A270849E79ED604B5121725CC072CD5A3890FEE0B5F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764299, "uuid": "59bb8ae2-9383-4955-b018-6dfbd69fe82a", "value": "6144:LMPZFP9jVHtQUggGQ5iSXI20DO+bRiPJKAqPG8fZS7v2yhGAo4rV8k53D:QPZNfghciSXf5+MKFZo9V8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764299, "uuid": "68d1804d-f227-4107-a929-8ef4b5555656", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764299, "uuid": "7e87e77c-5512-4c42-bdbc-665b0180fe5f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764299, "uuid": "7f2419f9-1df9-48b9-9901-0756f49bc0d4", "value": "PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f6777e-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649744779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744779, "uuid": "e689cb0f-01fc-40a1-baa4-fba6d57acf56", "comment": "Malware payload (NanoCore)", "value": "7801d914aefb6ff3800ab1297e2568c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744779, "uuid": "902246ec-1b1c-4335-97f6-21cefa8d1e7f", "comment": "Malware payload (NanoCore)", "value": "2bb8f2d0149cb5db019e16b7f11566b4b3f616f9655f1d0ae9503a1e1fc63ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744779, "uuid": "eec8a29f-c00e-43e1-a80f-02be4d593847", "comment": "Malware payload (NanoCore)", "value": "c44429101af8785671445d4842e7c8c995651183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744779, "uuid": "7ef16e79-e652-465d-8715-cb1368eb1a80", "comment": "Malware payload (NanoCore)", "value": "85d013a8d4796e66e85f5c34df5343e547cae747fd709ba69f62fe2406e467879255c10ba73aa1decd4dbadcc1f66d32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744779, "uuid": "eb85dec3-ad80-45df-80f8-1a9331d07334", "value": "T128542310AB95C43FD6169D302C281777A65B5E361864831F33919F3E7CB638AED0B789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744779, "uuid": "a6127730-6e31-43e1-a13e-c15196d553c2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744779, "uuid": "3c0a4b99-d60e-4e41-a128-488562a38735", "value": "6144:HNeZmoYsB5JAXEYowSPzz/1QF1CozQyFve3wRUiGzxBYH/Xc:HNlj8WtSvaF1CiQCve3wRXyxWfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744779, "uuid": "5a1f6cb6-494a-46a9-af3b-c1e12576cb3c", "value": 294713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744779, "uuid": "c0dec44f-4bf3-4c2d-9c77-032328f85d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744779, "uuid": "a8403a53-0976-4fe8-a98f-4c44e60aca58", "value": "INFORME DE ANALISIS INTERIOR-EXTERIOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7dfd5c-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649767124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767124, "uuid": "86a603d2-ebdc-4473-a079-643debcd66c4", "comment": "Malware payload (AgentTesla)", "value": "5b121198739c009ee0c2c436825520bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767124, "uuid": "640f8593-4b6a-427c-9a80-a61f4ab697eb", "comment": "Malware payload (AgentTesla)", "value": "2ca7a35579bc73bc645f69cc98dad04e9d85cc3e62467221c42a266cc0e80452", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767124, "uuid": "50934295-a0b8-4909-b96c-b011ef0f07f2", "comment": "Malware payload (AgentTesla)", "value": "f14108e3f0f5dc2bf19309028795be04cad60e28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767124, "uuid": "1d1ab404-c85f-4a50-bf8c-535a9e0fd5d7", "comment": "Malware payload (AgentTesla)", "value": "a7d104e91e25fe3e510956a60ba823ba77a5db5d7324b99957c964f80b2849b7e00cee6d86ac24b3c4aaf87fdb59abf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767124, "uuid": "ddc36a5e-7e34-4533-a2da-4e95cadd697b", "value": "T19915F111F671AA02C57C0EF399B6069B4F70D502D011C7C63BF5358A8A32F9B7A7929B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767124, "uuid": "cb28c78c-5f86-4d3d-90f5-c6cb4685aaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767124, "uuid": "77e036df-c969-4321-8d50-b56c2dd37135", "value": "24576:W5kzWIpPJ6SC5sigYuKDaQv8dSZY/yyzs/V3i1qvVI:OIJ0OilxvX2MS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767124, "uuid": "e0d37649-dd5d-46e4-9d16-e08675debb06", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767124, "uuid": "356810ab-9f91-4b28-9447-ed12c98d782b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767124, "uuid": "82ece3a9-1d0d-4567-b7e4-1444949dad54", "value": "5b121198739c009ee0c2c436825520bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39388b92-ba60-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649768298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768298, "uuid": "c057f90d-38cb-4344-86d6-2d19e64443c4", "comment": "Malware payload (AgentTesla)", "value": "1e62a1d9d70fc72ec38bd39179d18616", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768298, "uuid": "df421294-629f-4ad2-b82c-a3fd07859919", "comment": "Malware payload (AgentTesla)", "value": "2cea276640b182e848732f06b74908344706d230b268ce1e491abfdd9decfcbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768298, "uuid": "ba86880c-3aff-4aab-9050-7f9bd85ce63d", "comment": "Malware payload (AgentTesla)", "value": "26d757d55248389d892fc3f1c5f03d97ac1c9013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768298, "uuid": "678a70f2-6441-40c9-aad0-1b358b31260d", "comment": "Malware payload (AgentTesla)", "value": "f1e39b9b103c12e4ce4eafa7c6381f5c241261cf30d4b3c3bff88183f6fab70feb35daf735f4b98c4857672134fc6b97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768298, "uuid": "78c546cb-4196-4221-bccb-2537b05456b0", "value": "T19E035C05B25AD673D65C473BD8E7868403B0D1E39223D71FB4EB3B5E9A433128D92B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768298, "uuid": "17bdb76a-00c2-45cb-b3da-d72425b4a532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768298, "uuid": "bef8b546-3a34-4615-aeb5-2da6da34e463", "value": "768:8/cCpkSs5JlX2vyUqV+uUVak9SUaq1LyJQz6:kylGvpB9Atau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768298, "uuid": "960d5542-1716-41b4-8303-3dcc703fe772", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768298, "uuid": "1a25228a-57df-491c-82f5-6c55d697c46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768298, "uuid": "318a3ec8-1b99-4993-bfea-53ca55f5f8a7", "value": "Payment Swift_santander MT101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcce7ff1-ba68-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649772008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772008, "uuid": "cee5b724-46c4-45ad-a9dc-31e23d5bf581", "comment": "Malware payload (AgentTesla)", "value": "13a1e4b065f0c9e704c958874a95deed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772008, "uuid": "143c1584-3300-4e0b-a3fe-f6fca40a22df", "comment": "Malware payload (AgentTesla)", "value": "2d19ba450b27864035e6d2ac174a7c5b8a6e0721f9a5b53197ca89cdfb9f701c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772008, "uuid": "5f4df0cb-539b-4a7e-b794-045bfdf4c22e", "comment": "Malware payload (AgentTesla)", "value": "7b2ba5eb8082eb7e31be7d7204221200b613789b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772008, "uuid": "bfbb308c-262e-4eef-b242-1429a8d92a1f", "comment": "Malware payload (AgentTesla)", "value": "ab3efa9f62c3ba0335857c19c90f3ff801b9c143483541c4157a9d6783b2e449218de7a4b5b5acda5717ff84cf7beff1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772008, "uuid": "6a66ae21-38f9-477c-9ebb-d3037da75cf5", "value": "T1FFB470FC7AC15AB2FD1E81724D010E08BB670F536280ABCE27DB15FAC75F6616D25988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772008, "uuid": "20fe00db-9dcb-42a8-aa98-89f431c4a52f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772008, "uuid": "269979fd-b095-4748-8f0f-6b882c35a407", "value": "6144:PCr/5AKDS3jSEQXjVOgmAh3Qz39Bdc3oBYTtW7EnUUcqihapYcC:PCz59WjqOgd83jyZYAea5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649772008, "uuid": "e6a2384e-86b8-4ee5-b719-fd939bd6153c", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649772008, "uuid": "2002cff1-8522-4f44-908c-8bccd78f5b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772008, "uuid": "f3456ce2-b268-4dc4-a52c-1a52043f5c3c", "value": "SecuriteInfo.com.Variant.Cerbu.138179.20536.17991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9024614f-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649767584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767584, "uuid": "6e513055-af9e-41d4-9f5e-578edd421419", "comment": "Malware payload (Smoke Loader)", "value": "16a0be72f9cf31140b6f7f68bd0c9c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767584, "uuid": "41749e66-d2ba-4786-bcf2-ecdc21b8e3a4", "comment": "Malware payload (Smoke Loader)", "value": "2d889e41d813ca505f12e877df5c33a734a86102b0bd198ffe932bb71744ee20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767584, "uuid": "170efbd9-be1a-4113-8310-9b232ff82338", "comment": "Malware payload (Smoke Loader)", "value": "2b3d056465befeabee0989e6baaee9bcaec4f6b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767584, "uuid": "0a74e180-a5f3-4af3-a918-56ba5974704e", "comment": "Malware payload (Smoke Loader)", "value": "924ef7623555f5565de540b814e3f800f11bb313f479ba70228525cde936b1e6831ac658bb01da0de0a7b76753e005b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767584, "uuid": "3b6a1875-68a4-4681-9aa1-4febaf9c747e", "value": "T15AD5E013F5835348E03701355CA416114A89FB6E3D664AAFB90EDE64F3573E0AB26BBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767584, "uuid": "078bdb13-41f0-49f7-85a6-616b0b2b34c4", "value": "ebb1bd61c73381e2ebb1fc6b725aa726", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767584, "uuid": "75533667-9cac-486c-a3ac-6ecf0ee6965a", "value": "49152:zq3aLAyJ6UWvrNpTGxR+jo/zk+AZ+qeG1ajiUPhw6+M9HyV40DwAx47+CObrcR:OKLAyJ6UwJdGxRGcA8qeYajRy6+M5yVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767584, "uuid": "6684b0f0-a343-4bef-bc0e-33f22ca6386f", "value": 2788864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767584, "uuid": "fca30d42-fcd3-4d16-96e9-c6fdc415aeae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767584, "uuid": "8f85f62c-bcbf-4543-b18c-7b38c726c85f", "value": "16a0be72f9cf31140b6f7f68bd0c9c27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67187c2-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649777957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777957, "uuid": "1d2c0f21-a875-413c-a82d-5200f45a1b0a", "comment": "Malware payload (Formbook)", "value": "96c7077889ab23b8df01bca77a45a4df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777957, "uuid": "a1df5f43-4345-418f-b254-bc02f0df34c1", "comment": "Malware payload (Formbook)", "value": "2dac503b9c06d06387e62a41fe9f9e179df1aba575a3b2aece6d508b7c2e0d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777957, "uuid": "836cdb4e-7d67-49a1-8302-21997ad59d8c", "comment": "Malware payload (Formbook)", "value": "b58466cfcd6769fdf2ac783b0cbe149d09fb6cb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777957, "uuid": "c9a5fb0b-20ea-4f40-872e-4be435320de3", "comment": "Malware payload (Formbook)", "value": "24db900e88444318fed2e9fce4f91a794192c66c300067fe04c8bd68926b3c9b86cff6408066ae80b0fb8a26c75e6767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777957, "uuid": "1188b5b1-b96e-40fe-a6d5-94f4202dbfa8", "value": "T10DF4CF05F6BACD12E2A91777C0E7090417F06A46D616D72F3AD1A2E91E433EB5D033AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777957, "uuid": "bdefe0e4-01e3-4ec7-9746-7611df3fee59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777957, "uuid": "35fa7e97-45ec-40a6-bc71-672bc69d6808", "value": "12288:kECjKy4pX4qOgpCGabsNnBHiYSJlTpY3daNifrKLyg6:a5qJNlBCPll9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777957, "uuid": "d8039cdd-dce7-4e34-9e48-86ee45e3a647", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777957, "uuid": "3ad2e7ad-6178-433a-b0c2-62d51dca7634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777957, "uuid": "e44b8fdf-75ca-41f5-a850-2fd7930aeaf5", "value": "96c7077889ab23b8df01bca77a45a4df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c58cea-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649777974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777974, "uuid": "a2d87e37-c74c-44a5-a492-b7bff10971c9", "comment": "Malware payload (Mirai)", "value": "38eeb76982b104d309b5851debfbd2ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777974, "uuid": "2ae1b200-266c-482e-874e-abc67bebdc71", "comment": "Malware payload (Mirai)", "value": "2dbc1b7673d18b2382d85029eab3413f49869f5a165a207effa29172b1073354", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777974, "uuid": "b79430c4-b286-4b21-880a-fc0371d8bdda", "comment": "Malware payload (Mirai)", "value": "277f67a26bb2941ba9f85c3e67b9e545c5450766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777974, "uuid": "b3bbebf5-c125-409d-b359-74f3d3cea3e0", "comment": "Malware payload (Mirai)", "value": "2e06bf5b0e721f4f7d5882e91a65b7dad3bff817bc00857dd3d7dac0789a971f690b085010fc8a9d13848cf98f883998", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777974, "uuid": "6ffd3c46-f895-482a-a49e-8138f4d59568", "value": "T1B973B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777974, "uuid": "87daf16b-034f-4cbc-9cf3-9c9ecd1ee24a", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGB:aHJtIM0T+UEQPi8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777974, "uuid": "05d1ab46-d069-413a-9168-add24fc23f00", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777974, "uuid": "f0f79fee-79ff-4419-9f54-d1792a43e077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777974, "uuid": "aa082703-fbe5-4ed9-85f2-4f2b3950373e", "value": "38eeb76982b104d309b5851debfbd2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bbf3e7-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746901, "uuid": "028821e5-6390-4175-9eb4-32793b0e4dc5", "comment": "Malware payload (AgentTesla)", "value": "5ec6c29fed49eaa6c3f7e23b44d76496", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746901, "uuid": "9f611d4a-6aba-4229-be8b-a18476057b1d", "comment": "Malware payload (AgentTesla)", "value": "2dde80382532de39cf4f73659afb8402787448d7d0277037a5013cba24f13fc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746901, "uuid": "2f15bd31-ba03-4cf3-abd7-909cdf457680", "comment": "Malware payload (AgentTesla)", "value": "0e95ab79396dc7d7201287c3bcd44d7074e9c753", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746901, "uuid": "f8effb1b-b5b3-4bd5-94e4-d3ddb8ad4a2e", "comment": "Malware payload (AgentTesla)", "value": "c7a7f957df89ea252cbd1f644eb491922e976ac6237dcb7a976c38e7c0a8d0a1d5a11d40df2ba2bdcdc7a200fee230f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746901, "uuid": "ec98dc30-2c0f-44f3-be75-67b47bc8b51f", "value": "T143353303935D1C54B1B1784FD1B8CA1F44B7F67A844183E47AE026A3BFBD925B8AC786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746901, "uuid": "ef69b6c8-631e-40f9-a8a0-92fd2fa7ed9b", "value": "24576:/U+yR8Mduz7cFm++hs/aMIFUs8uFyTQUNczLlsB/0Gelbn:sD8Mo8FmTmqUluO06B/0Plr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746901, "uuid": "f75c78f8-9840-44c3-988f-ec231a0b6b02", "value": 1069270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746901, "uuid": "65bd229d-cf12-462b-a556-620bffb57be5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746901, "uuid": "dc396aaf-701e-4332-b570-31a865416b97", "value": "Overdue_Payments.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd818c3-ba92-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649789777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789777, "uuid": "f55ead68-211d-4226-8fde-f29fb5177c48", "comment": "Malware payload (RedLineStealer)", "value": "86ba481bf9a90d4d2bfa52a3136e08b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789777, "uuid": "ffb4cea4-cd75-4b33-b272-5e141d55d434", "comment": "Malware payload (RedLineStealer)", "value": "2fb2913adb95d8bac8dd7af97b5bc4e740d7ae866b0b1ee024705cbc49c6e588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789777, "uuid": "f67f0cb8-904f-4c63-ab59-887e14050550", "comment": "Malware payload (RedLineStealer)", "value": "1f42f592e271a378ae74950dd9404e237b1c4de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789777, "uuid": "b61db58f-7c61-4fc0-be08-315c511d3cf0", "comment": "Malware payload (RedLineStealer)", "value": "d51da22347eff3ece7464433d60102d3a5c599d9605d84e88b96730e0f89bfd65ca671d2654c2d5c8fc179ba03fb6e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789777, "uuid": "cf63591d-fd9d-4a38-830f-26a5ec48e401", "value": "T1FC34B7423185DDCAE4532AF218AFD53012B87DAE8065C60D3F83BB6B65E7342245B79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789777, "uuid": "d5f26cbb-153d-4e23-a5b1-7a055725b136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789777, "uuid": "79ce4cfa-d8c5-44b7-8fe5-91005a20e96b", "value": "3072:hoiTDAdCtnnVZJi6NnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/oPYo:hoiTPstvLGtELbMUTKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649789777, "uuid": "ed28c65a-511d-4b82-b467-a20120f375af", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649789777, "uuid": "7d288944-03fd-4cc9-9286-ec888041de3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789777, "uuid": "abc73145-159f-479c-a069-dfa33477df86", "value": "PMG QUOTE556565664339PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd9a51b-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800763, "uuid": "4e7df279-b7ab-46ac-835e-9601e0e44c89", "comment": "Malware payload (Mirai)", "value": "da4e8724543d40bc0621e8180735d56b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800763, "uuid": "6d12d271-8104-4756-83a8-f278f2125b7c", "comment": "Malware payload (Mirai)", "value": "2fea50ffa5a6089a73d63bf6e8a1993d456b5727e7a425502a7f14fa7d4b451e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800763, "uuid": "0baf8cff-ba33-417f-a846-771858cc8140", "comment": "Malware payload (Mirai)", "value": "477bfca225356bb079e8701fff9e325eb40b3980", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800763, "uuid": "6f5378ec-8d5b-43d3-ac89-708ee037819f", "comment": "Malware payload (Mirai)", "value": "f60d15f6136b9951845c51d7337722844370338e5774b75b54c28bb548075222478ca6151cad607e7c64b71d5912d689", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800763, "uuid": "8fbd0ff2-ee14-49c6-9b98-cfac4e9e5688", "value": "T12223F2F246023834CAD6C0F4BE49450628966BFDE4D57061400F122EAECE776BEFE687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800763, "uuid": "49961a19-1aa8-432a-b245-ec7bcb8741f7", "value": "768:O5jLEBItki8QgDZgQTrLvQVV1M3KXgfz3FEwHj0wNNd/is3UozZpkx8vIAmZsVK4:8mmkJQGgQTXcnM3Qgj+M1NNxz7I8XmZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800763, "uuid": "856a00aa-7e23-4cea-a8bc-3c4a0fe9de77", "value": 47280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800763, "uuid": "13d86cd2-f436-40ff-a34a-cf94ccbf81bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800763, "uuid": "745d1508-08bc-436b-8f52-86093b4b2421", "value": "BDK.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd854742-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649783176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783176, "uuid": "c8fc857d-cb2c-4729-9eb8-021efc874314", "comment": "Malware payload (RedLineStealer)", "value": "12641c927d9ac97f1d6bcc3e9ba44f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783176, "uuid": "0af27fa0-31f2-4b07-ab2e-55c5224a4077", "comment": "Malware payload (RedLineStealer)", "value": "2ff897898ea61c755da22b2bffd9342c57f43db7e47aae4ec93d61f4fb09d21f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783176, "uuid": "b9518c68-7951-4f26-8f5d-6bc1ed842f25", "comment": "Malware payload (RedLineStealer)", "value": "0911ab6e5b2717db5a5491524e70ddd98872a16c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783176, "uuid": "f62bb12f-3cb2-46a0-b1aa-c5924371537e", "comment": "Malware payload (RedLineStealer)", "value": "45ebd7a177df09f36356179e0573a83ae70760f70737f4391b0a7b33ca5e662bc0b36a5ad9a1289752c2847174c83b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783176, "uuid": "90070ff7-b7d7-447e-950a-066d524ed361", "value": "T15B84CF00B6A0D039F1F756F846B693A8B93E7EA05B3451CF62E526EE16356E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783176, "uuid": "48fb1cfa-15a9-48ab-a359-81ead79b8796", "value": "bc127f63c742090bfc36b22a0cca5923", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783176, "uuid": "886808cc-efd9-44bc-be7f-ce1a9dd8c780", "value": "6144:KoaaEjy2HGej+9yxCm2uvU6ZD+vIBEamrxwjscJGgR4iCSBZi:da2DejxxCm93ZDGWOlos+nPNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649783176, "uuid": "f74a7e86-baf8-47ec-bc97-dd5476461c69", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649783176, "uuid": "3d95ccf8-6e01-4bc2-92f4-f49a88eea810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783176, "uuid": "d7220485-2473-459b-9021-bff2f00c17d9", "value": "12641c927d9ac97f1d6bcc3e9ba44f5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762201fd-bab8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649806196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806196, "uuid": "20ea7301-874d-46f6-bae4-eeb4ee8fe78c", "comment": "Malware payload (Heodo)", "value": "40d2cb19d2df3170d12ca78aa53eb6be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806196, "uuid": "ea3226f9-c08b-481b-8e07-90fe583c11af", "comment": "Malware payload (Heodo)", "value": "300f1fe5fe09af2c8e37b319bf2d0c81401682d36357b4a4bada1384c477a1f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806196, "uuid": "2eac4439-f1a1-4e63-9e42-d4dbd8d2da35", "comment": "Malware payload (Heodo)", "value": "f52f43f4fffb578d87078ca8401b08f335ba09f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806196, "uuid": "76830a33-a5e5-4b8d-87dd-cc4396f81df7", "comment": "Malware payload (Heodo)", "value": "9b4b80eab028f5888df6d479eadbf27c7544df123550c8e202007d9603b0f1bb3e7152aabcc4dfbc9833f873f9ead1e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806196, "uuid": "67561d47-3fc1-4fe8-8d8f-e43b28be723a", "value": "T11CE45B21B49340B7C3DE913026D9E2600699AFFACB7F88F73B84547DB6A09538B7C615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806196, "uuid": "32b08829-96dc-476f-87bf-26c34b8f89d6", "value": "830353e93f5c80d691f8ce13b3aa74da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806196, "uuid": "f2f2fe4d-ae21-4de6-9ca7-1b45a023cda2", "value": "12288:BamncoLAbcddxmSc/Jf/ngwFGMD0sg5w:cCAQdXmS2JftGhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649806196, "uuid": "817d73b6-822b-4347-ac5a-642f67c689b7", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649806196, "uuid": "0ca68b18-f85c-4d95-8c94-805a9e0bfd91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806196, "uuid": "d14bd5cd-e921-4309-987c-45e3cef4c4e9", "value": "emotet_exe_e5_a3ed5023f270bbc1608ab442d0c5768ffacd9416f0c0454487e8892f75044441_2022-04-12__232949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cce630-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793261, "uuid": "9f3b4b2c-4c3e-43f2-a24b-7bfca15e4e42", "comment": "Malware payload", "value": "506ebbb91a65451431d312e644257a1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793261, "uuid": "05ecedab-e607-4311-bede-56650bcc4d3e", "comment": "Malware payload", "value": "304881c7a0bc871272695edb19a0b09b55b74e8d7d46c1fe49e17c07008a0a42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793261, "uuid": "248dcdf1-69bb-4dad-b0a5-b0ca08a5c7c7", "comment": "Malware payload", "value": "bfac524e941174a60d407aaef5dac0d2ebe359e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793261, "uuid": "becfe9f9-48b7-4788-8cbd-773afc164e4a", "comment": "Malware payload", "value": "9d4f98c42d1855e03cb3e756147d28e42e164e4c54307514d0f022d28b779fcd23faa51e268da6e2b48405df21c4fb98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793261, "uuid": "8f32cd18-6af0-4fc1-8d7a-7b50533e079d", "value": "T1D84423ECD983A4B73D3186BD71D936D940ACE1ED823E3A22E346A15BD21A053AC84D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793261, "uuid": "7ae531ec-d87f-494b-bc06-a7cf832ce2b3", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCPhhhR//mqYC:mZRgUY/fsJcO1KOiXOhhhBeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793261, "uuid": "e97a1757-0450-4cc3-b62d-da10650be499", "value": 253386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793261, "uuid": "02a33133-6c14-4697-9bbc-b121b742e93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793261, "uuid": "09167421-afd2-4e8f-9b4d-09e985d2398a", "value": "intelgeneric3.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e134511c-ba50-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649761708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761708, "uuid": "f11415b3-b06a-42d2-aec8-f134d135b491", "comment": "Malware payload (AgentTesla)", "value": "bbab92cfe84976f818f84d3763c7ff37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761708, "uuid": "085cb08b-5542-4a79-8475-af36760312e6", "comment": "Malware payload (AgentTesla)", "value": "30741cd9e619032936c5be2d624c2065decd1b48866a5ea3ee14bd7ba5c2a729", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761708, "uuid": "d7ed9b7f-d554-4e3d-aff9-e6bf4fd6e5bb", "comment": "Malware payload (AgentTesla)", "value": "eb71e69ce62a2c4e52758bc7c964a8e887454e61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761708, "uuid": "e6c3f9a6-9f52-4181-8c00-8140cb70fdc7", "comment": "Malware payload (AgentTesla)", "value": "5b16f4e84a61be1dbeeae56db888c18ce263b3d8ac2fed4e3a88d92be3899e922b2436866cb4c651104034fbfa118d94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761708, "uuid": "ec34ca00-a9ac-4c6c-9544-63d2669c47b4", "value": "T1997423F23D161BF2C8471F3C9C3A55E9C4DDEC25DB62028E1E227C8CC6B6A70566A635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761708, "uuid": "479e4a71-5fec-40c0-a389-88dd2ec39c43", "value": "6144:YS5mvOyuqFYRxRwGhnpuEtX1KtrbM8Eb1pkhh4cxJB2hcmI9nNzaTvvtF8uE:YtvOyvQxRoEtXObM9pk7HxJshcmuhobQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761708, "uuid": "2f5547f1-c11b-418d-b4a3-cbc7519df04a", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761708, "uuid": "f06f75bd-e2e5-4f17-85df-cd09116c8691", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761708, "uuid": "e3a54e98-4ced-4411-ab97-994b8c473322", "value": "RFQ 37 - DR104505 - 9404864 -ArcelorMittal.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b4c730-ba77-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649778276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778276, "uuid": "e11d8aa9-7f03-46a7-88e4-be450ad425e6", "comment": "Malware payload (Heodo)", "value": "2215d720ff19f0ccb1eadfe700f44ace", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778276, "uuid": "2e426a7b-0ce3-4ba8-a7bd-55c5ef88428a", "comment": "Malware payload (Heodo)", "value": "30d60545ab1cc010bfc93070db1618c774f48bda4dd905b065ec60728d08d635", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778276, "uuid": "57b20ee3-45a5-469d-a4d6-c16b02e91b46", "comment": "Malware payload (Heodo)", "value": "d634f75af58b11dac1c854a3fb8a945e2c2f675e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778276, "uuid": "28b0add7-017e-49e5-80bc-100249353aae", "comment": "Malware payload (Heodo)", "value": "a06afebcdcb7013fad6e6c292c7e12728dc0534d7f727d7a6feb5c1ba044ab75832edf186b2cf01c0c9e646e7aa5c03e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778276, "uuid": "a168dc9b-5d9d-40d9-b36f-3e8e3f01e953", "value": "T17964E61233C391F0CA53B574800FD525ACB6B43C6B25497DA287657F87EB8D09A34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778276, "uuid": "8a8b05f7-dbf6-4bf7-aee7-f2045149bba6", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yL:S54yM33d3q3Z7BoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778276, "uuid": "c5dc81f2-1b27-4c90-b596-f91f52526ac8", "value": 312216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778276, "uuid": "08ee8a8d-1213-4a4a-ba52-985c630c5605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778276, "uuid": "18bb19b8-406b-4502-a707-36d0b4c3f5a1", "value": "emotet_exe_e5_30d60545ab1cc010bfc93070db1618c774f48bda4dd905b065ec60728d08d635_2022-04-12__154432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9d7744-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649767444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767444, "uuid": "5d6a03c0-6b89-42a2-932f-64f7049ae8c0", "comment": "Malware payload (AsyncRAT)", "value": "8b259b27ec3032be9da39ac9993cfe69", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767444, "uuid": "32966665-92ad-4778-8805-9178735b2c12", "comment": "Malware payload (AsyncRAT)", "value": "31325ab8e1ff304852042e03613425c9bac4f03a8aa70745bb8613ad865d59f9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767444, "uuid": "ebf73e15-ee21-4f76-af62-10fd86ff4616", "comment": "Malware payload (AsyncRAT)", "value": "18f7cd9a10c98507ccab0afc108510c3ae427621", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767444, "uuid": "4c602173-530f-4489-a44d-19dd66c964f8", "comment": "Malware payload (AsyncRAT)", "value": "649ce3c64de44a8bede0ee5459590031f853a1a5fe80401e404f265b04019794ea402d44bdd539c3b5976a77dbc50e3a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767444, "uuid": "62c36aff-859b-4e08-8cf3-6cf929e84367", "value": "T13C94EF0334EC81DBE9ED1EB05C28F72D266A6E2121109D4A7F84FE4E757994240FBA7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767444, "uuid": "418f6bc9-1e2f-4460-8705-d3471afb2803", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767444, "uuid": "f347933a-74d1-4db7-b1f0-c4626508b1b1", "value": "6144:QNeZKwzd7MlyWOk0zzKjEoBvMrvasVjnAcvKrlWElVV6mVD0kHoA9Vhn4N:QN/wx7MvI/KGvadm0sErjHxVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767444, "uuid": "9eb8cec3-c69f-48ce-98a5-af9761d9a59e", "value": 417090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767444, "uuid": "d92620b3-45ec-46f8-b9bd-45d498a78f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767444, "uuid": "4000f868-299c-491e-b9a6-dbbeaed9cb1c", "value": "8b259b27ec3032be9da39ac9993cfe69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4445eb-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649765996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765996, "uuid": "8ddd1557-c405-4d8b-b0d8-e2b14f0cb96f", "comment": "Malware payload (AgentTesla)", "value": "2ab72358b6a04a47e38b746467b97657", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765996, "uuid": "5a980b53-13c1-4d10-962d-5c44597efabb", "comment": "Malware payload (AgentTesla)", "value": "31974a19ae09f65adfb2b422558e32e598bf9b84ab6a37c58ffe9be073f29b5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765996, "uuid": "8bba97b4-0e7c-456b-b847-99ffd3a68ee1", "comment": "Malware payload (AgentTesla)", "value": "3e8793381a99e2edf870dde3c91bb679bb50cc9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765996, "uuid": "855d544f-f7b8-4a11-919c-749f7ae68502", "comment": "Malware payload (AgentTesla)", "value": "29aee3ac97f1eceecf3a303b9e7bb6ad492eb0134be6b02004d663b32a6e3b97ddb8078674ecd8935847b05ed04fe1c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765996, "uuid": "5b58779d-0b36-4e48-bf46-063f7137e6f2", "value": "T10CF4C015FAABC912D2A80777C0E70C0407B5AA62D95ED32F3B91A2D91D133EB8D43797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765996, "uuid": "fdbcfe83-f6fe-49fc-886c-8f03e8241884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765996, "uuid": "93874899-8038-4e2c-b3b3-82ce0c649765", "value": "12288:Ar+ESB9LZc4qpHLjT6AX2N0DdtbWU86h4RTTKvvh3lOclT6FJg2g6:LBLNqprjd2NKCUbOTTod9Uqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765996, "uuid": "5d7830e3-560d-43d0-8c1e-a4ad8be936f3", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765996, "uuid": "e3d7adc7-8a9a-4bf9-832a-9570d1ea486e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765996, "uuid": "59a4dc18-cde6-4deb-9b58-e5d1ec4cb3e2", "value": "Halkbank002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcbd833-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "b7c7abdf-822f-413b-b24f-d4fb7e5fa48d", "comment": "Malware payload (Mirai)", "value": "a22f4c52d1458b68c7d6719122477533", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "c4a6dc72-123e-470c-b861-e90938af6e1d", "comment": "Malware payload (Mirai)", "value": "32520714c17f60b33fa7579d278864db0f3f4508daf5a64afa5b12a20ee5ee6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "55bce1b4-6128-4d88-80f1-fe5eaa6eb1ca", "comment": "Malware payload (Mirai)", "value": "349d9cbd3d8f5f2387e9f5c9f3361438ff4ce499", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "9ed881fe-d682-4e33-9468-f485bc331f70", "comment": "Malware payload (Mirai)", "value": "6c555c70b90beec64d0acd87355b4bfde708b873987078d3c3e7b556797e29f05f4eece780a2eb957f7663d11bbd30c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "2d5609a2-d466-45db-b3ef-28d542eae059", "value": "T10FA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "77895add-68fe-41ea-8b9c-163b1adfba70", "value": "3072:VK1z13U6HzHoXRtmTUhQogVEmmFVcqq0GnDZT:VK7DDeKlogVEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753404, "uuid": "624f64ae-6a6f-41a7-a7d6-8a25d4c38ec7", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753404, "uuid": "94db94b1-587c-4ece-b9e8-5895b872cc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "de62e542-ef97-408f-8ac5-266ac15bb1da", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bafd2eb-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (CryptBot)", "timestamp": 1649775630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775630, "uuid": "881b6836-9c59-4eb3-92f8-89f0bdd76f13", "comment": "Malware payload (CryptBot)", "value": "884266406f11e034de97c494abd1106a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775630, "uuid": "b3b514c5-2391-43f6-9ab8-45c3670147da", "comment": "Malware payload (CryptBot)", "value": "328132c92e6b42bd191853561730acf00f4a4dd056b8bbd872cdae394d391bc2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775630, "uuid": "feb82494-5893-4e46-a45d-e001561fc34d", "comment": "Malware payload (CryptBot)", "value": "d3f9c78d3d47468688819272182ca1149221aaef", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775630, "uuid": "02790aa4-5776-4de2-bfd4-6487148e4f2e", "comment": "Malware payload (CryptBot)", "value": "d269c1749c8cfd269a49b404eec97ac0ad5d27542aa00cf4cf0466b7d8bddb732e78a2dd6353ae356e397facfa08b1bf", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775630, "uuid": "661d3ea1-e672-4c8d-9734-54f0e23c5a46", "value": "T16F74CF00B690D035F5F722F45ABAC368B92E7EA16B2451CB21D536EE5734AE0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775630, "uuid": "e164a694-97c1-4749-9c11-1b1b95bd8baa", "value": "da226befdbef45462493cbd252b0858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775630, "uuid": "5d4915fc-a1d2-4097-9364-0ff9f3614298", "value": "6144:480OsrsgQQ/0qrs+BYWo5nUegqmXnv+9FZSmzOQXpPFRWd0qblBipTiHlII7uhQQ:XbsNsqrfBYWcbgqmXm9SmKQzRWd0qNFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775630, "uuid": "fcd1a2ab-7484-4304-9dc1-c5a843e567f1", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775630, "uuid": "a4f7754d-d069-43b2-9d05-33274ce85354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775630, "uuid": "6cf06df4-c852-4441-bae2-5f9a85ccaba2", "value": "884266406f11e034de97c494abd1106a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf09e10-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649767418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767418, "uuid": "e52661f3-fe73-4052-8050-ed5bb7a6bb23", "comment": "Malware payload (RedLineStealer)", "value": "ee01e59d32d28796c1102c860e0392fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767418, "uuid": "746d6dc6-4b44-4f31-93d8-6121ba7cbc54", "comment": "Malware payload (RedLineStealer)", "value": "32ad550f5d96a9e8fce577e0337f16dfa50dcd680bb1d391efdd4cd646e8496d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767418, "uuid": "385a359a-1b0b-4292-a0a0-1e75e2c4d5d6", "comment": "Malware payload (RedLineStealer)", "value": "72e670efc2595a75e1a5d2249142d64b5bc54283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767418, "uuid": "548deffa-bcf9-4aa6-83cf-37e5f38b05a4", "comment": "Malware payload (RedLineStealer)", "value": "5489e18363ef80f3eb2d4aa832cfc45e0e7d60a54ccc5508fbf667e8d718fa1ca79baf4f9c24a1b0b79345ac96478726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767418, "uuid": "8601bd4a-0482-47a7-b717-719795d8fcdf", "value": "T18C84C010B690D039E1F356F44ABAD398B92E7EE15B2450CF62C46AEE47346E1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767418, "uuid": "11e1bf8c-6f4c-44a4-b8a6-63f1327a4738", "value": "da226befdbef45462493cbd252b0858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767418, "uuid": "228f06ef-54cc-4b3b-8369-2479675b4498", "value": "6144:NJGfvN5Ur4b15ZYAmw3t1CU+jKz1eInvFPcTNQeAbN8ZqNPbOmY1W5EzjzF7Y:XGTu4brZYAk3jKz1bvUCeAbN8Mc9Y2jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767418, "uuid": "794e6ea9-795e-4bb1-a3c1-9d7dc2aa3f83", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767418, "uuid": "75cc946b-a7b3-4987-b00c-8e323c76124d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767418, "uuid": "1fff135b-662a-4fb8-9c25-928337109920", "value": "ee01e59d32d28796c1102c860e0392fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e343873a-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649766006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766006, "uuid": "936e6596-d50d-455c-8cf8-a7901174a25b", "comment": "Malware payload (AgentTesla)", "value": "b361a14457781df913db8fcf6fbf5b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766006, "uuid": "77dacd21-dd03-4409-a8ad-427915ffa610", "comment": "Malware payload (AgentTesla)", "value": "32edcbc565534dfe2c91695f8449a1abe8880e8f9d1b8daf6e58d95efc482bf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766006, "uuid": "f7eef012-fadf-47ed-8ad8-0ad138398539", "comment": "Malware payload (AgentTesla)", "value": "a15d489e3710bfd32286798f41d72015fbe98cc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766006, "uuid": "cdeb5cd5-da25-41cf-b3a9-b35e7fbd14ed", "comment": "Malware payload (AgentTesla)", "value": "20879095c714e0dd4680effee255bb8f55861cfb8d7573a31ace191a672000b6e8b5eb49da306cf83b7630f5c4bee7eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766006, "uuid": "ebce73d5-cfa0-4daf-8bab-c91f19876d29", "value": "T148F4C019FAA6CE12EAA80737C0F7190807F1AA43D526D73F378166990D533A74D07B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766006, "uuid": "b75e94cc-04e8-4c5e-875f-d3bed8e11622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766006, "uuid": "7fa49afb-f985-4975-8359-d3ece01cea02", "value": "12288:AoV4qsgXT0MyIQf3YVuBTyoVTXb9lol8bfq7oGLA/dTBg6:AoyqHjnQf3Y+PFXb9D7aXLA/VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766006, "uuid": "f7d74957-0007-48a3-9204-7377654f07a0", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766006, "uuid": "7f7d2378-f0a4-4fbb-8271-19cba437b2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766006, "uuid": "bfffaff0-495a-4d5d-9d51-8417bd28e3d3", "value": "Dekont_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac3d9a3-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649764032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "9c07a69e-9225-49a3-b3e6-78c3bd46f20c", "comment": "Malware payload (Gozi)", "value": "fec2835e33343e70d7655d45214fa39d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "0f9949ec-f84d-411b-8522-400eb6da231e", "comment": "Malware payload (Gozi)", "value": "331594023f5e6ddef910b26f9895ca014db26df6e87d60c65a7ecfb0576867d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "73fb9df2-bd63-4138-b300-84f8473845fd", "comment": "Malware payload (Gozi)", "value": "1845d523984ac4110b388ef869c8bea6c9e80d4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "b783a712-da9f-4724-b42b-a75bf5738c3f", "comment": "Malware payload (Gozi)", "value": "dad1936a31746380e35e1bfcbb4a832847ffe737da23d55cf7178628ca31f3b45e1a7bfcf45db290524cf400191085d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "f0d0ff4b-edcd-4774-9ca2-2317c110c8fc", "value": "T15E71FF1A57F8462BE8B787746EF347127BF1FC609FB2931E1980032A6C626645D31BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "ebfba24d-e7ba-4311-9fcc-9556aa84f720", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "30ab9afc-fcd0-442c-9877-772fb7759b26", "value": "24:etGS1t8OmU0t3lm85lGCk3elpUG94xf6PutkZfgSbmVUWI+ycuZhNhgakSuFPNnq:6hXQ3r5liGNhJgSi31ulhga3ufq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764032, "uuid": "c6bedf04-eb0a-4561-88f6-669acf6d260f", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764032, "uuid": "0f74ad5f-8c5d-4453-8943-f06711dbcc5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "382dde6f-5da4-4886-9770-a32bd9465912", "value": "yfkzejox_v0.0.0.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf97778-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "cab36a43-a2e4-42a4-a83c-a99eac365028", "comment": "Malware payload (Mirai)", "value": "2f06e83719d463d1a04312caf5876f4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "fdae7d50-7c86-4c24-9595-47348171ca0b", "comment": "Malware payload (Mirai)", "value": "332aa2503393dee924222e767e5808c9df2b85368fe3a48df5a2cceb58de7f76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "c74a3571-51b9-403d-b49f-b1fe346cfc2e", "comment": "Malware payload (Mirai)", "value": "908e4cf9f5a0bdd773c131b0c0295eaba694bc33", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753406, "uuid": "6cb71079-b7e6-4bd5-9999-c6fca95240e1", "comment": "Malware payload (Mirai)", "value": "d375c68b54a09d59adf0961d0eed30119961a7702feda28c3bd5d5ffce525f090e4451fb091cda517bf048bc1fe912e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753406, "uuid": "18d1159e-b338-409d-8fc5-2daac9190208", "value": "T1EDC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753406, "uuid": "5ba88aed-f502-478b-bb87-a17965bef2ea", "value": "3072:6jVlyaL5JCrIpv04sPbttiEiTmP46aQyfPlfKsNb:yoCJCN4sPbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753406, "uuid": "c1f14e94-05fc-4903-93dc-1741dc22a1d4", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753406, "uuid": "08402312-7613-49e2-b97e-392322dce264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753406, "uuid": "1c7eac6a-053b-483e-aef3-198857d64498", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa354e8d-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649765910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765910, "uuid": "9a435eba-d3f5-45c3-b729-cb96794a08c3", "comment": "Malware payload", "value": "ccf4d97ac6ad90583ff8b2ae70968d8e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765910, "uuid": "d1dfce10-fa7a-444f-816c-25623ca30564", "comment": "Malware payload", "value": "337b2aca600cbb0a5081842a5e89cf7bbf8a539a30524a9666342b10427c2f03", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765910, "uuid": "f679bd41-0bce-4bb0-8d36-209d5184797b", "comment": "Malware payload", "value": "44ba90ad02eec2693628a13bb8ab816ebf015786", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765910, "uuid": "6212b4d3-16b9-4a57-8d24-758d45220f87", "comment": "Malware payload", "value": "95cdaf062b15dee34bfaf816279fd36218cdb6ae1bb9eb57ec4a0ac8f2c7e941131aa37214315cfd154fd118435156c6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765910, "uuid": "73ccd964-f432-4888-bcca-eb2d511320ac", "value": "T1BF3442B8A60F8872D208DE0E659471455E75FFA374D180B533AFE078EF69AF29EC4442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765910, "uuid": "90cb7233-bef6-40fc-b3cf-8d71d657cd80", "value": "1536:igDjwZMIed/0xHp/0uMihOUNb440Mj/+U8QV9lcPdzFz76mAg5eeVhMDw5wfLU:izNRNbYdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765910, "uuid": "3403f512-703e-4042-9523-c8066ed2ea4f", "value": 247422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765910, "uuid": "aaa3c4c9-b9fa-485c-ab75-fce30786deb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765910, "uuid": "7c7db586-2181-47af-8122-3b1049e63995", "value": "Proof of Payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d69ba1-ba0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649732451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732451, "uuid": "2d693025-52b1-44df-bc05-3f81253dbc49", "comment": "Malware payload (Formbook)", "value": "40f4786eb2a34f90b90dd0d2711962fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732451, "uuid": "26678732-c26f-4429-9ea5-622ed34de537", "comment": "Malware payload (Formbook)", "value": "33d9ff922b2b34291e7e84fee8cb11062f4e1eb56cff714fca88f8fa5b507c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732451, "uuid": "ad28aec8-790d-4520-9290-73230854198d", "comment": "Malware payload (Formbook)", "value": "1c1b5c3c84493437a15a7e62f5884f8bae2546da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732451, "uuid": "4acf5fd8-3c5f-4e77-9536-a2fd3a6f58b4", "comment": "Malware payload (Formbook)", "value": "b9e1be14de0878d29795fb6fe1c49a61cd004774342710ec6f2ab751e466b88d7dcba21bcceef5a31267fd84cf97d5c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732451, "uuid": "fb994f05-3d1b-4ef1-87c0-19ef45f8e49f", "value": "T149D4E1157BFC8525E9BE07BDA07401804BF6762B6816E37D5E01A5EA3D233D09B03B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732451, "uuid": "680980a7-5b6e-4bc5-a8af-2f27fc8eaffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732451, "uuid": "86cbafaf-3a4f-483a-a1f5-b4801434fd19", "value": "12288:4kKUk6AD04qnNXNsb/m5PqbxCPnyn7Ie76QlODMpOLYYtAGpBBUjgVgz:4kKX6ADPqnNXuDm5PRyMe768O0O0eLBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732451, "uuid": "26df49dc-6ccd-4047-b3b4-9c80539a8c0a", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732451, "uuid": "5ab23657-a829-4f91-8463-a64376cf8232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732451, "uuid": "2abbe1b7-bfec-45b3-b8a9-fd5aa1940f7b", "value": "SecuriteInfo.com.Scr.Malcodegdn30.25859.19161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02d9c22-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731668, "uuid": "4a166266-56de-42c9-bbe8-59308842ea91", "comment": "Malware payload (Mirai)", "value": "a40abeb018b5c29e56042c012f394514", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731668, "uuid": "c83d1c17-b989-44ef-9756-019ab1274984", "comment": "Malware payload (Mirai)", "value": "33dbc38804a636b9b331de0e4d6af8c0e9e42fecacd5be6897bba56165e44306", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731668, "uuid": "e96ee1ea-c279-4f78-9c20-3ffb0d64a379", "comment": "Malware payload (Mirai)", "value": "316a465e9f753d32fa66d512a0a852532caa370f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731668, "uuid": "1c52e110-f633-4648-a1b7-104424e39b0f", "comment": "Malware payload (Mirai)", "value": "c5b8fe6de59d955151288aa9d3437049ba5d3a7402c742693d107d53f06c9663de350e38f895a931b5529e6871e9ed67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731668, "uuid": "5f903ddb-097c-477f-afd0-ac6b148c35ef", "value": "T157131A4AFCE18A6AC6C017B6BA1F518D3311A3D8C1DF320BDD185F2476CA62E4E37556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731668, "uuid": "fdfdd60c-7b27-4ab9-9b8f-c31fcb94760d", "value": "768:aspBZFLnA3/qtC7mn95rw3RfLh3aiJ/SU5HiaPX48hk07oWrgK1BNh2Srt:/DnAamAqJLh3amS6CyX4/0mKb2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731668, "uuid": "4384ab96-6b44-4cb8-9af3-5459830bec80", "value": 42572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731668, "uuid": "f32a08b3-2779-4f93-ba00-3d84c677fc3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731668, "uuid": "164f62bb-403d-4079-a0f8-63e5ffcfa62a", "value": "arm5-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28425094-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793180, "uuid": "4e93400e-acd7-4a0e-808f-7c8b402a266b", "comment": "Malware payload", "value": "b74a3bc4e25fd6cccb521927d6c71e82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793180, "uuid": "3cce4496-e753-4767-b857-94389d7d7737", "comment": "Malware payload", "value": "352db569c9b058bb1af61d508d8ec7f9bd81fcc1a44fcc03b2b1b85ff2d517f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793180, "uuid": "2a586c59-4666-4988-9c02-db68b0178f4a", "comment": "Malware payload", "value": "8a8fa2b9dca2e315400d58d4111bb4591fa63c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793180, "uuid": "cdbbd8d5-8f44-4ac8-91e3-7783d17bb6f1", "comment": "Malware payload", "value": "0abf71729839971b7602b9375d5ee8f3ad594e163946fc2a4b151855aeda7a6558f04c7f4836c000e6737f00f0a8368b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793180, "uuid": "2ade55a8-4beb-40e5-b218-d58ed87ceda2", "value": "T1334422FCEA46E1B3A93107BE704836E9019CE5DE41BE3625E35DE086D236183EC85E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793180, "uuid": "8cc5260a-20c6-46de-9ebe-57fef9b85148", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCnSgmQ/mqY5:mZRgUY/fsJcO1KOiXe+Qe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793180, "uuid": "b938876c-fd13-4185-8a01-c196e88d7772", "value": 253375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793180, "uuid": "6f366425-06a9-4c80-89eb-b2503d21c09e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793180, "uuid": "3dca8a56-50fb-4bbb-af24-6efe7150f5ad", "value": "intelgeneric1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6158b3-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649764570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764570, "uuid": "afaa0f2e-cdc4-4ba4-b09e-faf2e5adeb5b", "comment": "Malware payload (RedLineStealer)", "value": "c754a222b6fc3178dfd583864880a9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764570, "uuid": "210ccba0-2c2f-42d4-8f10-4e7a81f3903b", "comment": "Malware payload (RedLineStealer)", "value": "35b95a8cf490deea69c6418f9dff0d8ca6354e059d0bb9b1e77bb4578c96f264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764570, "uuid": "af2b7b5c-4d4b-45e6-9d57-28a0323009cc", "comment": "Malware payload (RedLineStealer)", "value": "235f9677cfb79cddfb50bd5f7c9e3abf016ca1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764570, "uuid": "e3f2d657-201a-4506-84f6-3387f6f9ac25", "comment": "Malware payload (RedLineStealer)", "value": "b314d2258e2c7a6a1aaddc4847a9d2467ed52379c1527a04382cf7900b849306e9e3ea9eaf3700a36d10c01bcca79dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764570, "uuid": "8bb688eb-b40a-444f-bf64-556dfa975601", "value": "T15F84CF00B690D039F1B712F85AB983ACBA3E7EA15B2450CF62D566EE57346E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764570, "uuid": "9308e122-81fd-4d31-bcc1-140a9b5319b1", "value": "b2491f91b932b5e67844520efb025825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764570, "uuid": "288feb19-1811-46ad-b4f2-34e275f389c3", "value": "6144:ZMdQtXHdKbCBjOphE2DeD8wC2zNxbSjChwjEy0hgxUY9O9pX1TqO:Gdi9KbCBj0TDe4KNxbiGl+UVXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764570, "uuid": "67f14f27-7ac8-405c-9fe2-ee5e0b44840e", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764570, "uuid": "f003427e-9df0-4124-85e6-23336e9725fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764570, "uuid": "73415ba2-91db-4604-b0ad-7046e82ee0a6", "value": "c754a222b6fc3178dfd583864880a9ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ca05ed-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1649765852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765852, "uuid": "321ed3c9-0980-4e23-ba55-ff3517799846", "comment": "Malware payload (Socelars)", "value": "9bb281af432af3b64f5fbe1026262164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765852, "uuid": "365590d2-fa32-4cdd-bdbd-276dc9d09b9d", "comment": "Malware payload (Socelars)", "value": "36adfea999715f71e99f4ee0160421ae30bc4500682f673fd7ef1ea4a8fb640d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765852, "uuid": "1b1eff19-b09b-4b94-9946-aaaab58371d6", "comment": "Malware payload (Socelars)", "value": "7c29954deb7d50a395923997aa770da2f9f8a6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765852, "uuid": "1e94b9ab-ed59-4ec6-ad94-5c21da89705f", "comment": "Malware payload (Socelars)", "value": "a59824c76ecca3ed0b063c33b179b518d78e7298ba360ca0063b4b0be742bfb493ebdd7816dc79a102a4f607e822c710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765852, "uuid": "f78ef8b9-c804-4b1f-8ade-fce2d6d1eaae", "value": "T1BC658E11F642A036E8E310B381FF4AFE8D68AE21031854D7D3C47E6A5A715F27A37A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765852, "uuid": "f066344f-2e8d-4bab-a3f9-b9154d95f7cb", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765852, "uuid": "b9cac66a-d6ef-4dc8-af79-a8d96e5a96bd", "value": "24576:pwpk4V9rRM1oDb+enGs2Q6E9ZBJRPHJTrFSJ84ufAtKFGng:ipRc1OMcV/sJjAAtKsng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765852, "uuid": "d5479be6-4387-47ea-92a7-0764712e2309", "value": 1488896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765852, "uuid": "5842c69a-47d9-4e9b-b1d4-8920b8d15a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765852, "uuid": "0afcb100-3103-486a-98fb-773d5fe2f132", "value": "9bb281af432af3b64f5fbe1026262164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd74a23-ba38-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649751203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751203, "uuid": "a202df25-5bfa-4fe0-b40e-5d2e0ee0abcc", "comment": "Malware payload", "value": "087fe2b4c573756acb7b6ad2e871736b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751203, "uuid": "19f36145-3b63-4b45-82c9-82b2f373ce99", "comment": "Malware payload", "value": "36fb291629a2bfaf3cbab87dd0120bddaf7f3f9277c7aeca0f7a9f758e014226", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751203, "uuid": "75f35771-e103-4a13-a948-331c7de53774", "comment": "Malware payload", "value": "b79ae63f401e29238ffe80322c6d4bdb93d3ca80", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751203, "uuid": "aceec393-00f9-40d7-90db-7eef17e9a363", "comment": "Malware payload", "value": "3869c995bc86cf9ea388282f1873e37c817a739035f628bedeec7798e8ce682696e3da08ea05cd15e1204edbd57cbac8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751203, "uuid": "c537aecf-0b11-46f7-8f5d-af0029626e3c", "value": "T118F4232A52C7330F6A9C9C322525B627015FCAD51364F2F42AFC1879D67C34BBE0D986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751203, "uuid": "5b59cad0-4933-4e93-b7ff-5517dad40900", "value": "12288:EXRWLXA6RntCimaFDdFUoXi/AJGsmPhDWZN7fwvVtDp5OUdR9swuFxJzE7W46U8Q:EXwN6kD77i/MmVKUtDjOXws68U8tDBEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751203, "uuid": "2d280ab3-ef98-462f-ac86-b015c5fef4cd", "value": 734768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751203, "uuid": "cdd6de8b-914f-436e-b013-714ed2803141", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751203, "uuid": "e94d810a-38c5-4c90-8456-afe79b0cf280", "value": "ceeuipturxiq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9ac968-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649741599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741599, "uuid": "801d5023-ea71-4834-bf98-86be06b64558", "comment": "Malware payload (Loki)", "value": "eef05f8835982cee2b4ee418add59361", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741599, "uuid": "7c016a1a-7eba-4b32-a9b5-dc88ed868d49", "comment": "Malware payload (Loki)", "value": "3754117ddffc1b9ad646d8f6593629fa0ea33eebffaa49e42eddb713c11a4fe8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741599, "uuid": "80ca903a-60c2-4fc6-acc6-7dc07dc765ec", "comment": "Malware payload (Loki)", "value": "4ea5956ce065ed6cda02308b4a2845655de43f61", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741599, "uuid": "abd36d5b-b62b-4bca-ab56-9374f39319ab", "comment": "Malware payload (Loki)", "value": "f89dc255fa050391e3c55fa41133c5df88bc1740e4bd73269512d5fa30f8e0bc2838664b1af22e7865b5b71086feacb4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741599, "uuid": "3663e59e-3a00-4b4d-8c3f-790492c4da88", "value": "T1E474124D3090DB6BE9F30579EB54469EDAABDD5A8B4107E76302B03FE8F02917A04E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741599, "uuid": "454ab42e-25d2-4249-9195-74ebfb9630f4", "value": "6144:KHV0hS+JmQV8Jdl71yF9YivycUF0Fl/qvDaPcnPybExYelCrzTKjek:KL+9V8byPvUSkbQc6bgYH/TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741599, "uuid": "3d4d19e5-639e-4e75-a7b4-da8f23dba629", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741599, "uuid": "afdae551-12a2-43b9-8453-14e9820e2e1d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741599, "uuid": "4e541294-9f08-4172-8bed-5719f21ae79a", "value": "supply.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e1e822-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649769361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769361, "uuid": "6b468393-99ee-4f3d-8053-58257af2a127", "comment": "Malware payload (Mirai)", "value": "021d175d1e71f8f4f42a1b53e118324d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769361, "uuid": "35f6d6a8-a037-49f4-b09f-6efe5ac6221b", "comment": "Malware payload (Mirai)", "value": "376b02704be62bc5ee1d5aacce644c5af8fd188603339680fb412062eac6f9dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769361, "uuid": "39db101f-21a6-4649-81e7-3cdb84632905", "comment": "Malware payload (Mirai)", "value": "15e68cd48367e7992f06d1cb1ae9f8937794e70c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769361, "uuid": "3c079129-8db7-4539-b69a-70f644ca4c8c", "comment": "Malware payload (Mirai)", "value": "54ad33c28a2dd1c002daa6eb7871985d4dc039c0b78af446d884a0b78b838979a80a7dda98b06172932cbdfbff6d4b68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769361, "uuid": "20b6cd58-57fa-4c5e-aefc-f83a98fb1a99", "value": "T120B2D01EC0AE3E74FEDB79356941E2816B619BDF3E61CDC017C15B110622D291F886E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769361, "uuid": "59160668-6cc4-4362-9e1b-7ea183b7c2c5", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoCM4uVcqgw05VxJO:2AApCdvwJr69VJoA8FZtxCo804uVcqgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769361, "uuid": "8348f0e3-403a-4ddb-8538-0f69de695cfa", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769361, "uuid": "162c22c6-637d-4ce3-8875-f6fcb0a4c2ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769361, "uuid": "44728b10-be70-47f7-81e6-cf7186d2741f", "value": "021d175d1e71f8f4f42a1b53e118324d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266d96ec-ba2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649745932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745932, "uuid": "c9e894db-0552-4d38-9c7b-9d3fd9e8017a", "comment": "Malware payload (AgentTesla)", "value": "787358337f005a8043567a866ea67a9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745932, "uuid": "8b75c2bc-560c-44a5-9c91-a9391c9d7f8b", "comment": "Malware payload (AgentTesla)", "value": "384d49f712f3003c50359834df5ecc7e1c31ee2d24c9bc111a50c3e36cf9149f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745932, "uuid": "530c76f4-2f7a-45fc-a647-bda356a30162", "comment": "Malware payload (AgentTesla)", "value": "cfbfe523f732ed0957867f2983515250a49fb471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745932, "uuid": "038dea63-459a-40e2-95dc-b5b938f2c5c7", "comment": "Malware payload (AgentTesla)", "value": "5dbe99a7bd94b5101b77bd6a936b42d921432eb8ba00df3ecb51e0ccc3f5b81f7c8801c540a20ea23313fadb078f9d1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745932, "uuid": "35f27eae-ddc5-4144-a546-f5490f6c4381", "value": "T1DF758D98765071DFC8A7C4329A69DC74AB517CBA831B520660D73D9EBEAC893CF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745932, "uuid": "d68870b3-d7b4-4eaa-b2b6-32757e874813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745932, "uuid": "782a570f-7e3f-43eb-8572-8e839922a71f", "value": "49152:e7zqdBqCafeEVVZTgDjCnyEB0OpFFD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMp:SeyfHVBgDOnpGYFFjMMMMMMMMMMMMMM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745932, "uuid": "92fdf20a-e895-4550-b656-ec7d7ce634cf", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745932, "uuid": "5083b1e7-0db8-4dc3-bc44-1ea6607bfdb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745932, "uuid": "754a4927-5c2e-40ee-aa19-d69c09129e62", "value": "Overdue_Payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7460b8d2-ba43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649755941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755941, "uuid": "4bf29593-c7e4-440f-9b01-546927afc9e3", "comment": "Malware payload", "value": "b2ada9ebc459019ec5fed078aae2cb26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755941, "uuid": "d0d1b31c-70b2-47d1-93e1-a7f1233d3f81", "comment": "Malware payload", "value": "387ced119b8328db98943656e9c80c4c21678ff33d9e75402ae6080ef7c03a41", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755941, "uuid": "d51135f0-9fee-4ed6-87c1-45fd80d780dd", "comment": "Malware payload", "value": "bd98b21a4a4db3a6242270f409f99813de17d177", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755941, "uuid": "efc094f8-a7f6-4f97-ac9d-f605f413f365", "comment": "Malware payload", "value": "65bf3c3b5558ba28d8229fcb86965f0e274abd6a947a8e07ae028a236b767c004f0c6e212ff84dd8e14e5703666401f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755941, "uuid": "4c7d3d27-5f6f-4f33-99bd-b192669fccf6", "value": "T14C41E70276FA454CF1F3AF56ABBE68618A7FFD620A19E90E1040151F04F2E408DA2F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755941, "uuid": "f440ef39-6911-4695-b3af-9f5283607dba", "value": "48:EXjkvSl9k1M0vSyaglN9/uxg6qG6ZHjvnwrofY3ksWwTb:EzEnXagN9ug3jZHjvnwrofY3kzEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755941, "uuid": "c361005c-da50-403c-a892-07b4c9e98c5e", "value": 2436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755941, "uuid": "73f0a219-8b52-4c28-b716-e71866e54ba9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755941, "uuid": "19f899d3-3578-459e-8f69-5b1b8ae31c75", "value": "miUqzsHT.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15080712-ba5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649767807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767807, "uuid": "9b51bcd8-89cb-427e-88af-a92941279871", "comment": "Malware payload (Mirai)", "value": "639df136e988be6361a1642220b0e9e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767807, "uuid": "cd8e05eb-7ea7-4818-8245-0cad9280d4d6", "comment": "Malware payload (Mirai)", "value": "3882aaed4933741f68736c3eafdfd0e3187e9dd314ff55f068767938fbaa54e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767807, "uuid": "1cc165ba-a5dd-498c-b4a3-a6b0ea4371fb", "comment": "Malware payload (Mirai)", "value": "b9dfca8afb757687088965109bba2ef939f01afe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767807, "uuid": "70f0fe84-1e69-4833-9029-3944d6df6543", "comment": "Malware payload (Mirai)", "value": "fd3c9030982744f6b918312987cf36df2da13ea3bce9b0bf0360d2620fc5de96e114c878316127f9f5af7a7fdaff6978", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767807, "uuid": "8295bf3f-5244-4008-841c-582a3c924c07", "value": "T10DB2C0717011B8B3C7A50077A9EECA83BB801EFCD0E873395465099DAAD5D52BAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767807, "uuid": "07bc07f6-d02d-4777-9e0f-9571b49999b6", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p5hymdGUop5h9:5X9nxn8o9wnBoWzEQf2EjKb3p5s3Uoz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767807, "uuid": "630d2cdd-0024-46fb-9c1b-7081ff1f8762", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767807, "uuid": "971b3a4c-935a-43f1-8c07-f37b95e8facf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767807, "uuid": "33264bc5-e302-4d56-b707-19468bdf1c00", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae00aeb-ba3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649752973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752973, "uuid": "eb154e39-885b-41d1-92e3-3733704435d2", "comment": "Malware payload (AgentTesla)", "value": "8702c0b5065ccce06a398deedf9117ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752973, "uuid": "d7e2b33a-b1c2-468d-aab9-346138087c2b", "comment": "Malware payload (AgentTesla)", "value": "389f26e724fb424703106ca4398bcfc6f797561473746a2aa949c1cdedd2a220", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752973, "uuid": "d8259e91-6b78-40ec-8819-4d7c152b5862", "comment": "Malware payload (AgentTesla)", "value": "425699b3c6432536b8f48b71229399c60ed7481a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752973, "uuid": "47338a01-7133-432b-937a-5623125904a2", "comment": "Malware payload (AgentTesla)", "value": "d9ec1e63eed56bc93b17427ebc674b0d077ebe190c938336bf57987a0a6f696b39fef3f01ab31e1a65b224045d5fccea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752973, "uuid": "b6148a04-2a09-43ca-b05e-51c6cc0b0439", "value": "T121250233BB56DEA3CDEC86780421BFC5A2F182229297D74FACCC91A5B7836D857051C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752973, "uuid": "33c0494e-cdbc-4e28-9baf-2f557151c66e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752973, "uuid": "28fbaf36-aa89-4651-9fe7-8089c08d775a", "value": "24576:YdBqCebfeuXVgO/erX1ilSy/Wb7tZTgMYnU:YdBqCafeEVdez1Rb7tZTgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752973, "uuid": "2fc3b7d3-1e63-4705-a745-220755f7ef80", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752973, "uuid": "4ff4c21e-5024-4be8-94c7-4bfce7d4da99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752973, "uuid": "966dc9c9-cf89-4ac4-939b-e4cd26bc990a", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bfba84-ba4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649761203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761203, "uuid": "d438557c-af0f-4cd9-bed6-0c2c4306cff7", "comment": "Malware payload (Mirai)", "value": "3ab40fe91ff439b4ef917cf53d79f611", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761203, "uuid": "08b48c69-4fa3-4291-aea2-186968dc27fa", "comment": "Malware payload (Mirai)", "value": "38dcd3222f7dca50a99df6ac61caec55b4a7df498b291e13b86dbb8359d9103c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761203, "uuid": "cc2a054d-e2af-4bf4-9bee-69f2b938a052", "comment": "Malware payload (Mirai)", "value": "e062ea44b4466db48f766bbe1e8a511190b5aa09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761203, "uuid": "fd22b32c-7788-4e7c-bc6a-e5e7e47ba014", "comment": "Malware payload (Mirai)", "value": "adf0ea410b0cc6a524edf3f0a5984f015a216a56bb40a25611aa32c7b48b65e54bbb28d1ced9a23944b67c8aa6b8fd30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761203, "uuid": "8aa14dea-bc9c-4948-b9d8-5f9ce205874e", "value": "T1A76301E6EEBAA6FBEFB04970DD184E401CF51F5023ACB41AE4A1973101505C5FB98EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761203, "uuid": "d790cfee-cedb-4e22-ba40-4e97a7c87861", "value": "1536:/yCRramkgerF02LdkkiE+F10L2FJMJmLOLyGDZNOlVf462IJqneOTXg:/Fwf62LdW10L2FJuLLZDZNOv46dqeYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761203, "uuid": "fa447c13-895b-4cd5-a424-2824c0aba417", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761203, "uuid": "5dbcc3e5-84fc-4403-a00b-77c86bb74436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761203, "uuid": "b058c491-95f8-45c7-af04-a37488385140", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91c7d7b-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736380, "uuid": "39ecdb26-cec2-4b85-b14a-8c7f32cee8a4", "comment": "Malware payload (Mirai)", "value": "44f50a84c1230669e99c370ebf0b8489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736380, "uuid": "24818a25-4f4c-46c2-a7aa-54a2d660406e", "comment": "Malware payload (Mirai)", "value": "393838cc85b99ebbb81f06075203708dd69922262f8fde51d0ee571d38265ee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736380, "uuid": "26533ca5-f36e-4a60-8421-0a4b09e97f60", "comment": "Malware payload (Mirai)", "value": "9148ffe16015b16f63f04ddfb51e70379c8aae16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736380, "uuid": "a71a535e-f6dc-4927-9403-dfa53330b6b2", "comment": "Malware payload (Mirai)", "value": "e199dcce9262b87aa7ad6db0ec3f1636b68e15788f930d07b04f7594f0e024677b7e5af09d3c26bb7f7ab68fce7a7467", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736380, "uuid": "67da3085-c871-482d-aa39-1571e6f456b1", "value": "T1CB83B5197E319FBDF7AD863447BB8E216A5823D636E1C180E19CDA011E7024E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736380, "uuid": "3702744a-fa29-4cc3-b739-1e7999f913a7", "value": "1536:GslzEe5ycvD4iVC2txzUJZTX9HshmFol3wKWTo6Xa10KW:NzEev9VC2I19Hsgol3wK6ozhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736380, "uuid": "93723576-cb2f-489a-bcae-b316a8f3cd46", "value": 85652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736380, "uuid": "bba6fe7a-6a22-4433-a6d9-5d32a1fc7ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736380, "uuid": "2f6be53a-f153-430d-89c6-5b8eb6e27b36", "value": "44f50a84c1230669e99c370ebf0b8489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b4028e-ba0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649733497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649733497, "uuid": "fd121e19-85cb-4a1a-9fcb-753d4f62707d", "comment": "Malware payload (AgentTesla)", "value": "8b7da3afc5e3aeac5e9bbbbbcc3daa7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649733497, "uuid": "a460efa3-f664-4e82-ab20-f2b3839509b0", "comment": "Malware payload (AgentTesla)", "value": "39c37c1f1eacc4e7d5429c3c06e297e248e0118d80d3aa69575ab60433b9a4a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649733497, "uuid": "e819a260-86a8-4d10-b99e-6b9791880dc5", "comment": "Malware payload (AgentTesla)", "value": "7159403280e8a3b97f5c33155f0cbe215ba02f2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649733497, "uuid": "f36ac867-53e6-4ba2-b2b6-fc4e1bd0c93c", "comment": "Malware payload (AgentTesla)", "value": "526e20df2d407650e17aad975ad64d558ba0690d39d8a426d56d3837b877cbbd3217d18be8fb852edcea2568044cdee4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649733497, "uuid": "a2315fa1-14c3-4fe2-aca0-d0f239dc2a16", "value": "T1DA350273BB55DE93DEEC927C08217EC593E283269243D74EACCCA1ADB7826D857011C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649733497, "uuid": "11aca4c7-e70d-417f-ac08-7a2b9f623e72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649733497, "uuid": "c0a9fb01-7b32-4157-95e5-60195b62b2af", "value": "12288:aShK1UwBYXRC9wjZAafeugkVgNEU/Gl4lGZ0wr85GxBYjI/ojniZORApEN0alGQN:6dBqCebfeuXVgOnZTg+4qQMqSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649733497, "uuid": "6755420c-e756-4a99-a3c0-de6c76d3ad19", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649733497, "uuid": "adb271e7-63a0-4493-9b94-8b4ff555193a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649733497, "uuid": "5aa3f1ff-c43b-4750-8682-f074948ad019", "value": "Payment Notice_93653 23001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70d5514-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1649767220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767220, "uuid": "b44ec8f7-578d-4c38-b9bd-681da508dfef", "comment": "Malware payload (BitRAT)", "value": "58b756316b232975a709148b774bd66c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767220, "uuid": "379262b6-16ee-42f0-ab5b-dc9b74ec4743", "comment": "Malware payload (BitRAT)", "value": "39d180e2f5c447706ad8e4f2fc0a86c2cbd586426dd1343f37f3008569f1a60b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767220, "uuid": "76cf7b2a-2081-441f-aec2-d9fe9999b142", "comment": "Malware payload (BitRAT)", "value": "4263dc71f89dfba45d79647d5ca73cd7841b039b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767220, "uuid": "ff9e190d-11b9-4ce7-a0bb-77ca07b284f5", "comment": "Malware payload (BitRAT)", "value": "01cb605d58bdfd85eb8e7aa9f9a429215677db2914dbf4e066096e43eddcd407152b1b20495b5bfaea13cced5bd4cdfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767220, "uuid": "7a8d5854-d69e-4f2e-b7e4-db62555b826c", "value": "T1BDE5E04C679B8825FD009334E8B377547B9C9A394849670363AA31BEF41F7E46F90B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767220, "uuid": "445fd5e1-1a50-449e-b188-e3a5f2d4b74d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767220, "uuid": "144fcf3d-d39f-4929-b650-53c768ffe2a7", "value": "98304:UwSHnnbzHM4H+IVgSH48w5aLfYxm2Fqp2qTGCDQdCB:UzHdhH4A7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767220, "uuid": "950c53e7-d7be-4d21-98e2-e2bc15dc5b4a", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767220, "uuid": "1980d376-8b81-4683-928c-691680067d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767220, "uuid": "a7ba1cb9-3922-4e3e-ba7e-08a23cf8543d", "value": "58b756316b232975a709148b774bd66c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa726d6-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649769374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769374, "uuid": "a60a161d-2006-4b2e-8cd3-1daa3443330d", "comment": "Malware payload (Mirai)", "value": "da18e75d3dc2a5ef63a27088b53fcde1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769374, "uuid": "ea50dcdd-0d81-4853-bf70-d68e80976c2a", "comment": "Malware payload (Mirai)", "value": "3a3db110eb75d5635f34d94856b85f003568496035131c2643e362b9ac46e607", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769374, "uuid": "2144a264-4c70-41b5-b8ac-6f7c6f9add05", "comment": "Malware payload (Mirai)", "value": "4c6d97e741ea7164af14e2fed4ecc0ebf5656e2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769374, "uuid": "f25906e7-6a8a-4499-a907-6cffa3bce047", "comment": "Malware payload (Mirai)", "value": "86a19bf72b06d1674f2e2c3792506c3dcf3dcf867c9c1e9369baa76c51e3b2e741c1b232066bfc48544f75c6b3f81a17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769374, "uuid": "06938083-ae66-4fc7-8e72-68b498612561", "value": "T158C2D0DFB49A7885C81C5CBC258C5AE115A9A3C7234B9F0837503DCDA67645FB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769374, "uuid": "4b39f90e-b223-439c-9572-8c439362c602", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBSWM:5CrJgHiOJrfwmQrctU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769374, "uuid": "33507405-a805-4039-8381-f5dffbbd0b0a", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769374, "uuid": "2d477d95-92f7-4338-8220-cf68593bb9f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769374, "uuid": "a6fc8669-9696-49e5-be51-d08995974e8f", "value": "da18e75d3dc2a5ef63a27088b53fcde1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4568ea-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649747794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747794, "uuid": "2728df69-6580-438a-a7f1-4dbaa87ec8c7", "comment": "Malware payload (Formbook)", "value": "55b0a801d55a185a5f0cd90d96a3220f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747794, "uuid": "848c09d9-1595-4622-8699-ac5bf6f3ab5d", "comment": "Malware payload (Formbook)", "value": "3b09da74a064a61e7ab0c1ebda53ec9672808950178ae4691ee5ebddf8b278aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747794, "uuid": "43f9fe14-10e1-4dd1-bdc5-77d2e39b943a", "comment": "Malware payload (Formbook)", "value": "9ece3d8b910d40de4492da23d0640552d860fec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747794, "uuid": "2b65eb4f-7327-47bc-afc9-3c16961c9e24", "comment": "Malware payload (Formbook)", "value": "293584a5e38abce8a29c6b955c8c361c9247a7d9b7ce75f58623317c7207616a553a08f602f1a03757db48bb9b68fc37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747794, "uuid": "7bd86571-196d-4c89-8479-6c5795e4569c", "value": "T1E7A4016C36B2951FD006127C4D58BB6CD1B8AFDA2A819357B360AF7F3F75B82C984250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747794, "uuid": "9256abe4-1dc6-4fbb-85f6-430d8dbf7cfb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747794, "uuid": "14cdd7b0-ade1-4274-b62f-bf5b472b35a3", "value": "12288:Z1Sb/h/RuMjikALg3dHy0G27ZCjYqcUxh2pM3H1:KThYM+kwgNHy0L7ZCvxcpM3H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747794, "uuid": "885e8ba4-a4d0-487e-8e18-dd278c041851", "value": 472665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747794, "uuid": "24a28d50-cce9-4253-8cb4-76d715665049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747794, "uuid": "6af4bcd6-f668-4733-a368-1a468509becf", "value": "Payment Copy [GLV12567196618420067].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d87580-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746367, "uuid": "c7b829ee-22f7-4562-baf5-2fa21528d5fb", "comment": "Malware payload (Mirai)", "value": "04aa3087f25dbddd6ae5d0ed3672bce3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746367, "uuid": "32ce255a-6331-4032-9787-b83f2a95156b", "comment": "Malware payload (Mirai)", "value": "3b3f1f6a27f58158ca8e60964ce853301acfb5c36ace4e407705167cf1b44da1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746367, "uuid": "7d1f3745-5113-43c0-a700-2212cc2fd89f", "comment": "Malware payload (Mirai)", "value": "46dfd1abdc64a89e5497c51f535f458d9fa2eee9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746367, "uuid": "ba596e0d-a1de-44dc-91f3-ee484af9026c", "comment": "Malware payload (Mirai)", "value": "c963c9f0d1275b18b7c2549c9523e288b13289022bbc773f41386cfcf718e8a09be88cff586920ebac6c7b6c5fd2ab78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746367, "uuid": "da95c2a2-bf79-480f-964d-d97052141af1", "value": "T16D63AD62C9791E68C2998AB4B124CF359723D50092473FFE90A5C369A883DDCF6093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746367, "uuid": "6a7bf9d1-f5e0-4952-a0d1-81b482c17d88", "value": "1536:c7lBAXjTNZ7BSZK622GRPTiznyLjCCc5VJhKqLABqM9:O2Xj3IK62XknyLjkSqu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746367, "uuid": "99da44b1-43f1-4a9d-a335-c1a6b9a93d3f", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746367, "uuid": "b302169c-9014-4e87-950a-8cc62e59c49b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746367, "uuid": "cf15b91a-e67a-4be6-81ee-cfbb79f5b410", "value": "04aa3087f25dbddd6ae5d0ed3672bce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e11f291-ba07-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649730161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649730161, "uuid": "01d1c32a-042c-4810-af16-0a6b8cba84a2", "comment": "Malware payload (AgentTesla)", "value": "f6f3ec2234e8df802123c1db515e09ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649730161, "uuid": "dfd25f3b-8366-4845-802e-66e1cd156358", "comment": "Malware payload (AgentTesla)", "value": "3b3ff2afcf8f10b9221e2bd5a293652103782881a9721eb94b321e20cada320a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649730161, "uuid": "5e52de6c-76a1-4f79-b64c-ac8d09fdb08e", "comment": "Malware payload (AgentTesla)", "value": "760341747afba84109b41ddfa237bd94d6e6cec2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649730161, "uuid": "3474316a-5a50-4afb-95b9-99849f55e19d", "comment": "Malware payload (AgentTesla)", "value": "6f3d839ac5431a5c9a4011b34ff20edcbf6417d64e4282fe3c443198fdf67e2220ec7414ab2fb827e48d7678eb285001", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649730161, "uuid": "571bf4a2-b8f0-4101-b3bf-87b0e52aa428", "value": "T18D350277BB569EA7CDFC92780471BEC2A2F192235247E74EACCC91A5B3436D85B010C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649730161, "uuid": "19adfef5-065c-4809-b4b5-5f4c8382410d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649730161, "uuid": "51e74171-4106-4deb-9a5e-b99ef3ae3ab8", "value": "24576:5dBqCebfeuXVgOnZTg71YGQONXX/wLvOJH6SHa:5dBqCafeEVVZTgBtQONH/+mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649730161, "uuid": "954bf3b2-a1c2-4b85-8642-0bf4450d23bb", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649730161, "uuid": "27383de9-11d4-4085-b5a4-a12ea3b04a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649730161, "uuid": "9ce99aae-12b7-4294-ae4b-102c84416793", "value": "payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1a0885-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Adwind)", "timestamp": 1649764469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764469, "uuid": "824098be-b810-4f76-87dc-6e87ea43da5d", "comment": "Malware payload (Adwind)", "value": "f5a470916e0c75a262fc5921d1824884", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764469, "uuid": "2f426ea8-2184-4b25-b5f4-2d72996ed16f", "comment": "Malware payload (Adwind)", "value": "3b86e5da4edb0a07901b9b7a0e48d8925ea69246150d69a2838e4776712aee12", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764469, "uuid": "15a740e1-f0c8-4053-a889-214c8302b085", "comment": "Malware payload (Adwind)", "value": "c78a59a178a74e4a4164b9e3ffe99dd29d17c51c", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764469, "uuid": "e6f51f5a-05a5-4fd0-ac97-6d24244a0385", "comment": "Malware payload (Adwind)", "value": "f7fd8630ce80552d3eaf1562f66a7bf35905626e661566e0190e31cf35decdb4d37846caf08071ef72eaa847a60c97ec", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764469, "uuid": "423b02c0-f316-43ee-8fda-24ece2e9ec7f", "value": "T17F15337D6DD12E392FAFA521E25171FE8066FAC0B0C9CE425FC4A4F5864ED264063AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764469, "uuid": "a3783bb9-db07-45d2-9eb4-97d272952b35", "value": "24576:lA7jPFCP/eOcvZtOA70EcDC4ahAu3XRV4K5k+:lQs+OcvZAA70EwC4aemXRVd5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764469, "uuid": "fe69ca7f-35fc-49e9-8cc8-5e9ed6942e62", "value": 917050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764469, "uuid": "b2a6dc32-e86a-4abf-8a8d-eafe996641a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764469, "uuid": "c1d540e2-b67c-4170-8ac0-9ffc38036104", "value": "Transfer_slip-030303.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f76d517-ba0d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649732579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732579, "uuid": "b3a711ee-afc0-4b32-84ee-b7bb19c1e909", "comment": "Malware payload (Heodo)", "value": "2953e667891965a1546535909de78d64", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732579, "uuid": "1a55b136-79bf-4a09-b464-2b4fb9a02d67", "comment": "Malware payload (Heodo)", "value": "3ba0c75c57e047ef55ee8dc6a00a87326fc9591544441c9e21cd8b9bb94ea3f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732579, "uuid": "bdd574e1-9a8c-451d-889e-b5f55fcb960a", "comment": "Malware payload (Heodo)", "value": "feb46eebfc7d7db97e3ce701272d06d0d303c63f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732579, "uuid": "e43715bc-0945-4212-9fa1-f468412acbb4", "comment": "Malware payload (Heodo)", "value": "c2dd1b8d03288d6b8a6b1b08e58c881c8fbff92d4884de4f85a27abd2c2b47848bba3277e7c35b19371794a29b84a26a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732579, "uuid": "8c1f5ed1-d182-4c4d-ad85-017e17bb254d", "value": "T169248D3132C6C077E1A722325716922AB3F5B6B095F6CA8A9BE11E45DF35543C33D28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732579, "uuid": "a280354a-8cd0-4d18-b9e4-d23090c8e5e6", "value": "6144:buZlJOFmzvtg1Eyid5GX5BVhthqnhdDpp:bGptged525pthqnhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732579, "uuid": "1b183f95-f97d-4164-a79b-16eb9bcfd0dc", "value": 222453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732579, "uuid": "9de1a752-40a5-41cc-8e6a-f97175681df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732579, "uuid": "14754f24-2d89-4c5e-8881-ea803103ca7c", "value": "emotet_exe_e5_3ba0c75c57e047ef55ee8dc6a00a87326fc9591544441c9e21cd8b9bb94ea3f1_2022-04-12__030255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636d36f1-ba6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649773952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773952, "uuid": "84d7dfc2-e27b-4f26-860d-100236cd2b67", "comment": "Malware payload (Formbook)", "value": "ef96b4025adbcb02633954d78cffbf20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773952, "uuid": "47522f40-5741-4236-94ff-fd5fbbf1be09", "comment": "Malware payload (Formbook)", "value": "3be0ec47961daf00ad70c778e46eb97964a4a0c53b281e3ae7828c2ee79e0f62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773952, "uuid": "8e4f32ae-996f-4972-a653-6ba95afcfad0", "comment": "Malware payload (Formbook)", "value": "d5edaed671be6c1f3e9a43cf79ce104a0b19e0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773952, "uuid": "f2ecd409-9130-410c-ac66-f63b2989ccaf", "comment": "Malware payload (Formbook)", "value": "d761e56b624dc2b3f53e3eb7337647a1778d37dd48504fc66e028727445fec8d195a96f8fbef499f7622875d846f8c8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773952, "uuid": "d20fa4f0-6b4e-4fbc-ab5d-12472f4daf54", "value": "T15B350277AB56DD93CDEDD2780821BED2A3E183135287D74FACCC81A9B7462E94B011C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773952, "uuid": "8122db96-b57d-48d3-9d7f-72906ae16b97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773952, "uuid": "d6a4744b-7421-48b5-b891-46295a20a7f3", "value": "24576:fdBqCebfeuXVgOnZTgYSW3FKFFnaqfFclDo:fdBqCafeEVVZTg1EIFFZFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649773952, "uuid": "2516bf86-3f9f-4458-84fd-eb6613264412", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649773952, "uuid": "8e314249-1215-4cdb-99ae-3441d1194849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773952, "uuid": "501f7813-a3d6-414d-a32a-97d4fac0cef4", "value": "PO#PCL2003827677#Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3c13be-b9ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649726964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726964, "uuid": "d4e57603-0ce5-49ac-8073-2c69d795dae9", "comment": "Malware payload (Formbook)", "value": "1de392052b1eb2494b763b5bb32d2b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726964, "uuid": "6551dc86-fb15-4542-bfa5-c63ac7e221b3", "comment": "Malware payload (Formbook)", "value": "3c24b4fa538ae960f1c4148093d4ada972aeddc97366a42fc75c465d70dba293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726964, "uuid": "c5b563b3-971c-4366-b5d7-75d2aceaf1ab", "comment": "Malware payload (Formbook)", "value": "eec7ad411238d91a47bb6b838a9bbf9d5b37d472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726964, "uuid": "ad1933a6-3160-4b86-a5f0-573edc7559cc", "comment": "Malware payload (Formbook)", "value": "ba371c18c621d5ddd9ac805aa69fcc9c82f2ccd1134443710ca2213bee028977e79846f292158d628adba332bc2c2b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726964, "uuid": "63b76ff7-3f3f-4470-b592-0d7d6699a612", "value": "T1243412CF72C08CE3F59B4A3011D6EBA6D9F9E64629621E07475E0FF57B162439A311E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726964, "uuid": "088258af-c05d-4143-bd0b-040fc08611eb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726964, "uuid": "751d2529-0afc-47a2-8c4d-84b1e4226975", "value": "6144:8Qq+ZqL29xcqP6VSZLOcFEeH/kudvkaiygpSHqZS:T8L2vcK6wZLHFEeHXdvkaiyggKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649726964, "uuid": "5e79164b-b074-452a-9ee1-96bd0c741cfe", "value": 243461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649726964, "uuid": "1fe154b8-a37e-4e78-9011-141a73aa207b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726964, "uuid": "c3751a9b-cef4-4240-bf08-b6d9fb626564", "value": "Enquiry -Data Sheet 0041122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5926ae05-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764056, "uuid": "79231300-1436-4803-8b8c-cfc48300d689", "comment": "Malware payload (SnakeKeylogger)", "value": "57306647eb6273fbcb4576c640ff756d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764056, "uuid": "d7bb2abe-7b07-4941-bad4-73f4235f96de", "comment": "Malware payload (SnakeKeylogger)", "value": "3c773996e68574e5aff0f884e9c0a8ea6fd7055f17fa694af0985d5e5ecb5bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764056, "uuid": "003a944f-1fca-47a6-9151-3e92fd4d17e0", "comment": "Malware payload (SnakeKeylogger)", "value": "0e85d8ebb818e960be19353dd702c6e09a853e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764056, "uuid": "045c4539-80ee-46a3-bc48-09e792730394", "comment": "Malware payload (SnakeKeylogger)", "value": "5809843c4513419b518f6ae5151bd8e3d76aa60773db7b68987f4f3d5bb5c622d46c5c0a038c267831773411827ee2f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764056, "uuid": "c80b9459-5bc4-4e85-af7c-3735fccdb016", "value": "T16AA40105ABEBDE16D97C96B398D225454370AA13F063DB4F1FDC46AB96063D60E02BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764056, "uuid": "b1725037-c58c-4bd2-a0ee-0ea1419669f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764056, "uuid": "8b295cea-6c52-45f5-a187-48710b445764", "value": "12288:481WlwGq7OJ4GpIAdndKuRpgalt7RxyXfabjMFQ9F:uS2aGeAdnPpXTxyv49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764056, "uuid": "331e20e3-7dd8-4a05-bcb1-8c480518f685", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764056, "uuid": "74bb55fb-3998-4727-a194-fcf809320e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764056, "uuid": "b0a69622-0596-479a-a887-35078a7fbe1b", "value": "57306647eb6273fbcb4576c640ff756d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48716ceb-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764028, "uuid": "e1fc6c31-e007-4ff3-95a8-231cc0f11dd2", "comment": "Malware payload (SnakeKeylogger)", "value": "f8237a3a357e5ae49c8975d67e0328a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764028, "uuid": "7b250004-c63d-47e2-9ea0-7dbb81ad22c0", "comment": "Malware payload (SnakeKeylogger)", "value": "3cabe68c91b8dc4957237808b4c336261d9640af18c395a8e273dc056839e922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764028, "uuid": "303b9dfd-c6c6-4147-b5ae-1002e95c02ea", "comment": "Malware payload (SnakeKeylogger)", "value": "ca9f7ec243e17746e56df1c1dc40843918303dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764028, "uuid": "58916926-6cb4-486c-afbc-18201ef76f60", "comment": "Malware payload (SnakeKeylogger)", "value": "25c8ecf1538d675e48270a7242ece26c4a4852381b0e5b4fddf20d2ca08f9544d77007e22ebcbc58081a21717b83efc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764028, "uuid": "fe4cc394-0d17-46ca-a896-7ce45182b934", "value": "T15FC4E0117AFC8614D5FE17BDE43801908BF576276826E3BD6E05A0D62E233D0DA43B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764028, "uuid": "acd29496-5279-4425-a699-342ffe0c1186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764028, "uuid": "29538200-3394-4ee1-bc16-e8f2a1c778e8", "value": "12288:4kKUk6MUwx4qo+Kz/mdtCBHNIhuyWVu2C37EIzO3HNTgVgz:4kKX6MnOqxKCHKNIhuvvC4AGcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764028, "uuid": "ebcf04f9-c52d-46f8-b4f7-063baff9e06d", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764028, "uuid": "443d2834-1baa-4db0-bcb6-8a7863daec77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764028, "uuid": "e5e8d453-365e-4c6b-b915-73cb08c40ca1", "value": "img-000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f6c62c-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764138, "uuid": "b2865d73-08c4-487d-b2d9-97398c709b7a", "comment": "Malware payload (Formbook)", "value": "ac1856dce2a0217dfe0e9ba506c7ca44", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764138, "uuid": "cf7c2c07-a109-4dc8-9de9-4c1eb18119ce", "comment": "Malware payload (Formbook)", "value": "3db84de7c515ee983952cf7f61787260005eac2ab5e2b079b00419680cdf95a8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764138, "uuid": "9b4caa2f-44e3-4112-8259-b0e36644d9b2", "comment": "Malware payload (Formbook)", "value": "d2f6647abb3cf4752716c1363c638e1d242310b4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764138, "uuid": "f44adcd1-d50c-4123-a28a-182159298f0c", "comment": "Malware payload (Formbook)", "value": "65cb52b9209a8fa8303b234c87f8e813de2bbaa8a507c957b9f2e90d995d8ea7b1aa3a2b15a7610a6ef29dd084b55319", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764138, "uuid": "02d37691-5f9d-4b20-a1bc-809f17e15fd3", "value": "T1F224D8B4684F0872D309DC1E25A8B605AE79FEE374C1557223AFE434CF9AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764138, "uuid": "78a3122c-5fb7-412c-8de7-dd4c2e949572", "value": "1536:i2TDfpPIx7Jz7vH38zGzIpWo0FmbucHKdzFz76mAg5eeVhMDw5wfLU:ipDqCQ0zdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764138, "uuid": "98a0a915-d5da-42b8-a891-309eefc3a971", "value": 222592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764138, "uuid": "824b7537-6640-454c-9c31-df325759ee8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764138, "uuid": "b00290d0-700a-4ef1-bba2-ac47ac0f6334", "value": "swift.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6261eaab-ba43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649755911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755911, "uuid": "2dfb2f42-b69d-444b-aa97-09c570dbf712", "comment": "Malware payload", "value": "4698476f41e3ee39f55126af7286120f", "object_relation": "md5", "Tag": [ { "name": "mars", "colour": "#592EA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755911, "uuid": "8bebb391-c3a8-4e40-857d-fc884abc5589", "comment": "Malware payload", "value": "3de1fb0d1108907fd61d6d6b9a4c6b856af509e0af35578f158cfce5d634fe07", "object_relation": "sha256", "Tag": [ { "name": "mars", "colour": "#592EA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755911, "uuid": "e81d4070-c7c0-4512-ab9b-e29264c1bd26", "comment": "Malware payload", "value": "ba204fea5acef9c478ae82e09dd199331413ab61", "object_relation": "sha1", "Tag": [ { "name": "mars", "colour": "#592EA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755911, "uuid": "ac75782e-de1f-4428-a55a-b5d9a1eeddf3", "comment": "Malware payload", "value": "fc4a0c365a6012384eeeda34ef261500624a685a3f4add2be6bcc1fd9d7fb5bd2ec3aa462bbef0afcac4e66f4a5e7243", "object_relation": "sha3-384", "Tag": [ { "name": "mars", "colour": "#592EA9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755911, "uuid": "a0aaa7cc-e504-40be-b4e1-6f128196c9e7", "value": "T1127533F17ACF9F4D7511B8E1198879F91133F0790661FECCA94ADD8085FE6042A42FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755911, "uuid": "560d7914-9655-4e08-8fe7-1eaddc777ce4", "value": "24576:4tr47pjNheBynVEOeDJtzRbUru8QFZvQ7wu/+BPLybOYyyhB0xyqlYmRa2yaCcn1:4tr4VxxEbNxRwQFhpu/+Beb30xyaRaJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755911, "uuid": "13760900-ac60-44e5-811b-ef31d18ffe78", "value": 1565849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755911, "uuid": "4ad8e0a8-4bcd-403a-a57b-9b43af6d8fd6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755911, "uuid": "ef2de510-b72a-438c-81c4-c6c83bb35cd5", "value": "request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c34d42-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload (XorDDoS)", "timestamp": 1649747706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747706, "uuid": "ab50af30-861b-4d91-8d3f-386b5003076b", "comment": "Malware payload (XorDDoS)", "value": "96a2bccfb4ed79ec324e4964a96f7503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747706, "uuid": "18de6af9-d730-42d8-a535-17a39869e57d", "comment": "Malware payload (XorDDoS)", "value": "3e442fe024a5642343b4398217dd13e033bfbc9f30bb68a0a18c63090c5de4d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747706, "uuid": "abe59e9e-e551-41ed-bc9d-34305392682b", "comment": "Malware payload (XorDDoS)", "value": "0554f84a3a04bc14a22edcc73faa905c2b1478e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747706, "uuid": "7856e30d-2062-4eeb-9b83-7484162b8ea4", "comment": "Malware payload (XorDDoS)", "value": "3d9ea4ad953a1f0309fca9b49f6286c6d3a3bb648d2d71c06bb7af403f27a06b298619d30f6758acbab8caf65e02d062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747706, "uuid": "0f2c188e-42a6-40d2-8247-bb0606f6b8ea", "value": "T1F392C61DE003E1F7DC4349B2520BF1AF72187B38D8216D4EEFD40DA9F639D9AA2452A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747706, "uuid": "f8b5dcf3-30fc-4b63-a6ec-52e28a13bb8a", "value": "384:fB4oWqyEJekEO20l6ZRWT1WlL2FZ7K5Dwcsss61BXzGZ5mx+ef2L:JzWqOg2K6ZRWT1Bn7cDVss7Xq0+ef2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747706, "uuid": "a56c0610-467e-4923-99fb-15cb5fe81ad2", "value": 20535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747706, "uuid": "3498619c-af53-43da-b11f-a89b3d3fc6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747706, "uuid": "5b16d542-8684-4415-bc5c-43d96965dfef", "value": "intxor.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c47eb2-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736403, "uuid": "c63d5199-a53e-4d09-9563-0f16867d10fa", "comment": "Malware payload (Mirai)", "value": "1e2074ff6cf6bfc7148cb865429a6873", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736403, "uuid": "f7c4b097-60f5-45dd-abf7-bcac23cc6835", "comment": "Malware payload (Mirai)", "value": "3e9da9db1f0cf9f5cedfa9d174b9fb5d48184a005e1a187d6993847a990a0713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736403, "uuid": "cd9db40f-d5e6-4516-b688-a5e8b0655613", "comment": "Malware payload (Mirai)", "value": "c2874979e951f10bd0c5f5d61bda58bbeed5fadd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736403, "uuid": "e5e9f4dd-067b-43b3-b094-1fd063b9f25b", "comment": "Malware payload (Mirai)", "value": "8212d453408161ef55a2f23ef80906bc33320cb8427958d809baa3e861b0961dd893f148caa6939ccfd72a47942ce5ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736403, "uuid": "584895d8-c31e-4dcf-bcc6-ce0e6c7d85a6", "value": "T134D33B56FB408B13C4D51776BAAF42453322A794A3DB330699285FF43F86B9F0E27906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736403, "uuid": "13622554-48c7-4420-b11c-6313a9b2b784", "value": "3072:RXs7EfMszZjkF/Pzwc4EPu/JFKotvjn9wurGrLxVPYm7wGgWT3:R87EpNwdPGEPu/JFDtLiurGrLxVQm7w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736403, "uuid": "f1bc9f81-087b-4ad0-a87b-273492fb1906", "value": 141262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736403, "uuid": "d56e0db9-cca3-480a-9abf-f39794de0ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736403, "uuid": "3188481e-9d39-4d23-b09a-f257696c70e1", "value": "1e2074ff6cf6bfc7148cb865429a6873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9873a6a0-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749989, "uuid": "086f3424-6d54-4aaf-b4ff-8e70f5c58f7c", "comment": "Malware payload (Mirai)", "value": "82ef2511878d576b8644a9767e633014", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749989, "uuid": "72e2758a-f6f9-4cf6-b28d-3ca7e1be3447", "comment": "Malware payload (Mirai)", "value": "3f8cb1d6b9d074ca3f79ffd3ee856238948f203674c85e37e31b2c89699324f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749989, "uuid": "91ebaf3d-cd04-4201-9e76-8600ee0cf808", "comment": "Malware payload (Mirai)", "value": "fa463a23022bc46d1a35143916f0cd1fc4a08a18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749989, "uuid": "816bb818-f553-496c-9521-67ef1f73195a", "comment": "Malware payload (Mirai)", "value": "ebede54d54516151c28d8f23d0fc63bbfbce6ad9cf1ede6aa81914a4e71b2a355273b51bce35173cf8b62fdd371f4323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749989, "uuid": "a6924397-9a58-4c2d-b598-f939532e421a", "value": "T1C3B2E1EEE69C75C5CEACA4BB98AE0795CB80B1D4378B8F155314DCFCE09164FB5480A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749989, "uuid": "def26080-bef4-45a4-98a0-927ffb2a8ceb", "value": "384:SNuV2Kf5T+KeG2EZQOwyjxKsev3s0twBUG3y8OCgvD/Gy+RWGVCz0Nvw6:SoV2K1zeOwyMs6jmh8yWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749989, "uuid": "73833b23-4a3f-4b21-ac94-2085b0e9da7e", "value": 24548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749989, "uuid": "4c79d6f1-b9d2-4637-b5b1-8a3871b6d92f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749989, "uuid": "87c05a34-5bbf-414e-b84c-719fa073d4f2", "value": "82ef2511878d576b8644a9767e633014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20f33aa-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767212, "uuid": "687fecee-e6ac-45cb-8267-af374678d8d9", "comment": "Malware payload (Formbook)", "value": "9923ff2b7386b07a563bf101c2da75e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767212, "uuid": "2a906dee-35c9-4b69-99cd-b4c361da9529", "comment": "Malware payload (Formbook)", "value": "3fbed13bf271b55a9eca7fe2e7ec051fb9e4b02ace3dce84468b1acb57962fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767212, "uuid": "8cf3be4f-6bb7-4353-91ca-a7047e27bfb6", "comment": "Malware payload (Formbook)", "value": "d9fd1e65d30cae1ee2ebbfe9ccbcf14e7a4d516e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767212, "uuid": "2aa1be9b-e545-4767-a61d-40b740838842", "comment": "Malware payload (Formbook)", "value": "7de3a1f9a444b37c4ed38f1a14485b986f0f4872afe875816d2fea1d93ee7f7ad975a6ab9d1abddec6e27941d5fe1599", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767212, "uuid": "450cd91e-866c-4145-a544-512ea8dd7722", "value": "T123E4CF05FAA7C912E2A90777C0F70C0407B0AB76D55AD76F3B9152E94E133EB894239B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767212, "uuid": "f0c21bb6-5c65-46cd-b76b-aecb904c41fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767212, "uuid": "11611971-b578-42ab-a1a3-6a523ff69a16", "value": "12288:wJ+Z/PX4q7FacgXbrruO4rU/56o5zHwm1FWHdXdtLNg2g6:HZ/Aq7DIPru/8kodQWYnUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767212, "uuid": "507a62f4-bbef-4044-b793-60f1730dbd5c", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767212, "uuid": "ae18ebe0-1509-45e0-a876-76a0eb0a09e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767212, "uuid": "b5d3b2eb-e089-4855-b821-9aa879b16e16", "value": "9923ff2b7386b07a563bf101c2da75e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3254b6-ba51-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1649761892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761892, "uuid": "1d146c9b-f9fe-4577-bae2-d0e1ecbe11f9", "comment": "Malware payload (GuLoader)", "value": "2a9444dbfb08eb321614d3fbcc7253ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761892, "uuid": "927b169c-f920-4480-9520-7c7aa4ff0802", "comment": "Malware payload (GuLoader)", "value": "4036ac45636a80542e0252550fa74e7dbc0640d53d946d9efd4ddf8e06e91525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761892, "uuid": "eec6dd19-3cd1-4477-9729-be0a9269cd4d", "comment": "Malware payload (GuLoader)", "value": "4e4811ab12a74aef0f98e529905a80f312a14fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761892, "uuid": "4475f1a7-d64d-4a83-805d-9fca3dbb77d1", "comment": "Malware payload (GuLoader)", "value": "3af0302827edf0bc6a920da499fd841787487c1866837d010230dc4f708ebdc16c10127f25d51d6875f4479c2bffd8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761892, "uuid": "0f5e0ef3-c572-4ab5-996f-58e6dc384f42", "value": "T12025230133B8C937DC51E573F82586F3A8CAEE00E8718A1B57A17F543CB64A18B1E35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761892, "uuid": "a3d9a9d4-80ea-48ce-8ee4-076999c26608", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761892, "uuid": "e8de7d3f-78bb-4359-8352-1742fc9beee9", "value": "24576:jYvobEMgDVCJdSV+DHiXwmvAOO9WMalQmXh4RsLdNCF3JbE:MwbSiafZ6WdxasbCFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761892, "uuid": "72b3d6ed-010d-49be-acb3-a0931738646b", "value": 999016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761892, "uuid": "d9956b01-6e55-4132-8c52-bd714d233931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761892, "uuid": "8d29a06b-91ee-46a1-abd3-5daa2030eefc", "value": "photo of Mrs. Beatarisa Baro Alivarvar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8507a95-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649747976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747976, "uuid": "ae6c0afb-27c1-4f25-a1ae-c5f9beeef0a3", "comment": "Malware payload", "value": "a2cec7eb2a6c6821691d62b80bceba7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747976, "uuid": "61dd8927-d178-4107-a695-92ad4a4ac1b4", "comment": "Malware payload", "value": "4053f44899ef597cc021a62ed1bbfd87891259e6b93bc293af0c29a8cef359bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747976, "uuid": "72fcca80-b473-4c5a-bba3-812d815b524e", "comment": "Malware payload", "value": "ec55b10bff956c2d4daddfaefbb6801bce54c0b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747976, "uuid": "79c830af-cd2c-49ae-aa88-cf8ba5c83b83", "comment": "Malware payload", "value": "093487dac5bd2c6a1db8c867e2df8397eb4be05f3e8c5dc44d680c874c70c6945350083374db87d7ba8bb1cfbdd2adca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747976, "uuid": "312267be-438d-4de6-a2f6-ecf083a79c44", "value": "T11E646F43B741E67FCDD0CC7660C6B46BC59A2F638A077460A162BF7A4633452E9CBA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747976, "uuid": "0922661d-fc56-43dc-9973-59271a1ec20b", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747976, "uuid": "1cac32cf-f047-4209-884a-555a23be8f87", "value": "3072:uLUvFljhRhs3Dw4dcWukhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh3:uLUvW3DRdcdHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747976, "uuid": "66dbd0f6-e19a-45ae-a051-b28176bfbffb", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747976, "uuid": "4b3b74b0-33ab-4c37-bc9a-0053f5522ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747976, "uuid": "9126077b-689b-4db2-a6a4-a3c3a3257a48", "value": "sdraw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f43a36c-ba4e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649760604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760604, "uuid": "2fbde735-7588-4e4e-b107-7c82a4c33cb0", "comment": "Malware payload", "value": "e26d2537cf744804fdb8ad990906ae0f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760604, "uuid": "ff1cabfc-d8ac-42ef-b4b5-7364ab098f59", "comment": "Malware payload", "value": "40902f6cf7a4aa9f73a38ecd604355534a980cc527a440895e1bbf58bf5ddd72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760604, "uuid": "0f3f1ac6-5896-497f-914c-6c9e701229e2", "comment": "Malware payload", "value": "23a138660e20dbdfd2ae929cad05ca2009b188d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760604, "uuid": "2b6664e2-640d-407a-8b9f-e5fa5c13c10e", "comment": "Malware payload", "value": "1f49494b01d86d74ac8c5019de6e4d6f1c1cd9885274579a18b7a4dd1170b833162025a07f199aef21c4ec7a4eadbb45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760604, "uuid": "3a5f0e64-415a-426c-95c5-6b151305effa", "value": "T1D0730287D097D225EC21CA6DD1CE8317E315AFF677AEF610B03F8A987592C4116BE212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760604, "uuid": "b918e6b4-641b-4094-8c30-a1c681a4af6f", "value": "1536:VgmOTfNelw2jX6QtJVbwkNMyiUqqUAdzEwh9ExbA:Vg9gJFjy+ExbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760604, "uuid": "96e9b997-e262-4985-81d1-dca567467f95", "value": 76164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760604, "uuid": "964b3cd3-3d9f-4e3c-9860-7b0fca861636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760604, "uuid": "a7826ac9-15a7-44c1-8ffb-5256dfd52a1e", "value": "notabotnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ead94dc-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767555, "uuid": "6c3e1943-41a5-40a0-8bbc-798cd5f0d4b2", "comment": "Malware payload", "value": "51a6e667c3c59d0e4a2fb644a284ead4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767555, "uuid": "07c8d3d5-b639-4035-b6ae-dba2d7f18083", "comment": "Malware payload", "value": "40e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767555, "uuid": "15fc8b5a-d1ab-434c-83db-9fe1ddefc57d", "comment": "Malware payload", "value": "f2f6646aa2a70ae1520728c376d6048e5a8bf7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767555, "uuid": "33884790-2247-46e1-a68a-b8530924d348", "comment": "Malware payload", "value": "b6c913681848b95b1aa7442c6a1fcaa8d07e5e050ba8e6a2ebb70bed5d12869e78f9f328dd4fc157392d25686cd9b693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767555, "uuid": "61079333-732b-47bd-9dcc-fef2eba061ff", "value": "T17154538D3F3C640AC5F5A8BA1F5737A6EBBE4F1160A34E0099BDBF0DC1931E029A5951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767555, "uuid": "ded21cc1-7ab5-4c3c-b903-bb46d02f2b9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767555, "uuid": "654120aa-6716-423d-bb82-626f4b3da8dc", "value": "6144:X3W333a333F333O333j333M333D333q333T333R333e333W333Z333D333y333Sa:X3W333a333F333O333j333M333D333q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767555, "uuid": "4ef4df3b-da38-4ff1-86a9-4940b681cb28", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767555, "uuid": "45efe4f5-3a6c-4c47-b7cd-7aec92bd9b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767555, "uuid": "6e96b31c-fa7f-4568-bdac-8bf53074b389", "value": "51a6e667c3c59d0e4a2fb644a284ead4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4e521c-ba5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649767900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767900, "uuid": "26120ccd-df8d-43e8-95e3-3161e6c20dec", "comment": "Malware payload (AgentTesla)", "value": "346c9b041277154d9f8a700e3134933a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767900, "uuid": "6f6f02c3-b4db-4d76-af9b-d832b52d599e", "comment": "Malware payload (AgentTesla)", "value": "4182206c286cc385945b7db9fef667d3cad8f10b168dde41a725fd259686ace2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767900, "uuid": "95dc81ad-e61f-4bef-9085-55ba8532fbcf", "comment": "Malware payload (AgentTesla)", "value": "b3faedca56e721748103966ce300abd8ae10ca04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767900, "uuid": "1f5a4d43-b052-4276-a59c-4c136226ee4e", "comment": "Malware payload (AgentTesla)", "value": "0b044247f5ed2b06558df131c6c3d4371f1b5b63f8d19caaa852468ddf9873df0ad5be9e052b1f139d015958a81b1419", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767900, "uuid": "94a0b810-8f67-45c8-88c9-bd7fcfbb67d2", "value": "T14EF4CE16BAF7CD12E2A81777C0E7080407B4AA46D527D72F37C5A2991E233AB4D4739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767900, "uuid": "ca898e0a-3aea-4459-aae2-35c4c6920233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767900, "uuid": "35d0f666-c070-43c6-81c8-bc2ffb65a212", "value": "12288:JbTd4qYiybCZXGLQz7u0Nmm/h/KAkxNVODtfnypjPg2g6:kqYigEFu0mm/hTyNVw1yqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767900, "uuid": "6d21c18c-1720-4e99-9a9d-7a7b86cf1e22", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767900, "uuid": "df069a39-c2d0-4138-bc0a-df805f41c9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767900, "uuid": "b468ab53-4691-4902-8566-95190d9ebfdf", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37239fd-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649747860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747860, "uuid": "e0697c40-0755-42d6-a92d-ab2b76074b54", "comment": "Malware payload", "value": "b41d2a59ebea67d8f7c620e213abe5ff", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qukart", "colour": "#AB93DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747860, "uuid": "18d46ef0-04b9-4d88-a713-8d610e50dabb", "comment": "Malware payload", "value": "41f03c451ad97f5f01a8958dcb68bccaa1ecf87714206f759d78d62c5c9fd0c8", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qukart", "colour": "#AB93DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747860, "uuid": "f3a1a9ed-c2f0-4d94-9e34-94ac1d24e7b4", "comment": "Malware payload", "value": "b12ff1395132a9797f61084eab4d50d878a55f28", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qukart", "colour": "#AB93DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747860, "uuid": "d9743d6b-5657-443d-8782-dfed7b16eb4f", "comment": "Malware payload", "value": "eb0f15479a4b8f2de3711be89220ab63d017501f2d05b2a70a3401e94313949793ca20a9df3622b6c612ef4227105b31", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qukart", "colour": "#AB93DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747860, "uuid": "37454f60-e472-4742-9a6e-02625c0fd91e", "value": "T1B8336B823A39DCCAEEBF0CB502F6DF217311BA79132B03555E62EDEE532819C1421B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747860, "uuid": "0e8c19cf-c335-4f4d-a6e6-23d8c3bd7ab6", "value": "a64e048b98d051ae6e6b6334f77c95d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747860, "uuid": "72534010-af2e-4cd5-a769-a7c9fecc14d6", "value": "768:Wvt7P67vovcBeX6SF0BjpUboKNUlnlgG6VEKOObokoEJFCNb/1H5O:cJP6CcBFHaFUln+GffObow3CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747860, "uuid": "0a1f922c-3bdf-4972-92b4-c9334b597a30", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747860, "uuid": "0c31a2c3-5ffa-4601-bd20-030dab57ab5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747860, "uuid": "17358a02-c1b4-4fee-9972-66c725b538c8", "value": "phone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6588ee6-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649753529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753529, "uuid": "1d89f2ba-2663-49cc-afe2-990947584c47", "comment": "Malware payload (Quakbot)", "value": "eb8c01abdc92be98debacc686b2b42a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753529, "uuid": "d06e0b03-fc3b-4118-a958-ec5b64fa0b74", "comment": "Malware payload (Quakbot)", "value": "423e9834d7e38533008abe7196be51ca3d424a16c9a96fd4b2638933eab8bb83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753529, "uuid": "3bd50fe3-585b-44ef-b54f-4e962b4b4d27", "comment": "Malware payload (Quakbot)", "value": "6128dc1d2dd8f68974345ade08c5e7bd01cd718b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753529, "uuid": "59e04745-b78c-4691-b000-375fbe8cf4b5", "comment": "Malware payload (Quakbot)", "value": "61a6d6cb24e14dd79d499cca082dab9b010040531c5d54bb7504286530cae75552cb33fc7a28d6c193386ecfd64a0658", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753529, "uuid": "8ee8c538-e22a-4e67-a6f0-9a3a58f70300", "value": "T1E905AF3AD29096FFC163BA7A6C36F180AC113DE1D614E50527DFDE4E4A397822724787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753529, "uuid": "7c27aa40-e04f-45c2-a58a-81115a228846", "value": "f335497b5901bcd9e242e896ee9878b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753529, "uuid": "5d506e32-d3dc-4bab-a64d-b9e4001a92b9", "value": "12288:MvdyMlRePlWuktyda+/egKRuCQ1X8eLQRNGoDTStoMsaD2F1PrIGCnA:GnlRxuwTI4BqMeGNruaVa6FZCnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753529, "uuid": "62375af5-31ae-4371-bac3-de3653ca7a26", "value": 869808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753529, "uuid": "d780620c-730f-4728-b5a0-394532c10340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753529, "uuid": "4bc2f098-0b41-4d93-9ac1-01df0fdcb01f", "value": "423e9834d7e38533008abe7196be51ca3d424a16c9a96fd4b2638933eab8bb83.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19ea767-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649767238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767238, "uuid": "ba12672e-4460-41df-8fda-0b6717c02742", "comment": "Malware payload (Loki)", "value": "1ecdbcad8db898790240781177dd8884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767238, "uuid": "e04cacbe-6aee-460a-8bfb-e460129a678a", "comment": "Malware payload (Loki)", "value": "43c7f5fc7cfab29fae6e20f34e252bafc625d1498864cccf0450a2bb279f1df4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767238, "uuid": "f7b3e46b-2d40-48c6-a1ea-4fea920a620a", "comment": "Malware payload (Loki)", "value": "f0f7c5dd7f63e8d6418b8f65d66e2b427ab1749d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767238, "uuid": "71874071-7b45-460c-8e91-39b69cdc490c", "comment": "Malware payload (Loki)", "value": "eeb89125aea52486439956207a7939bf25a7af60781f40972a9b59055d375035eb4284c4ef069b7f6942fd72daa80d99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767238, "uuid": "b964f9cc-94db-4674-9d39-18ebd55f1a4c", "value": "T1EC3412178BC4A8E7D66696B259B6E729D5BEB3010320070B73C44EBF55263C3C60369B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767238, "uuid": "d3cec5f7-e8c9-4733-9f00-336d39196970", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767238, "uuid": "f140866b-e5d1-40c1-b3e3-6e89024130a2", "value": "6144:8Qq+OcZD5PUuc4rf73C7rQMf7hs1tNfxaBOhXbmhb:TlZ9PU94rf7S7rpf+BXbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767238, "uuid": "e5b71172-ebfe-4a0a-8fd4-14f88ae8bfb6", "value": 234993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767238, "uuid": "f27e1472-11bc-4413-94b4-2093991ae9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767238, "uuid": "f55f052a-b8d1-4ecf-8802-cbbe84a9ddef", "value": "1ecdbcad8db898790240781177dd8884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a6cff5-ba17-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649737104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737104, "uuid": "cd821c99-5441-4124-bfdd-5bb907bc66df", "comment": "Malware payload (AgentTesla)", "value": "4968759a5a5eef6270a63ce1e35c844b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737104, "uuid": "787ee219-f4a3-46b6-ad1b-64770bc136e9", "comment": "Malware payload (AgentTesla)", "value": "446a20b1229b6b9ca108c7e076e8295278057fa005f10de4c99f361fc14f5077", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737104, "uuid": "19f021a3-24ab-4df4-a16a-e0716855b459", "comment": "Malware payload (AgentTesla)", "value": "18a3af3143c1809127a721f21fd02ef764dbad43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737104, "uuid": "f40a857e-477d-4445-8ca9-f7e37d97ce9c", "comment": "Malware payload (AgentTesla)", "value": "b9e44a02c732a61f82e769297ee37f1e9c6475a698645177b39a0d1f72c3eb2c5602f49d3437ba20eef397c63265af3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737104, "uuid": "6d2a72ec-a226-4e00-87f3-8e4b02d9ea19", "value": "T16294E3B9EEDC4CCDC36945329049A77ED193FBEB09306A256DD03E4636ED24BA2113C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737104, "uuid": "12a0b7be-52e1-4cb2-a821-b0cb9a159ac9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737104, "uuid": "a1d942d9-8ff2-4e89-803c-503da131cb10", "value": "6144:ZQqTq4xpLIgYFdZRmiG8afnxKylgpE44iqnC:ZxRgZRgfxTAE44hnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649737104, "uuid": "4d128c19-9ad1-4dcc-b083-08eae99247da", "value": 432483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649737104, "uuid": "c4543326-76c3-4797-9ba1-723ebade00b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737104, "uuid": "8b868110-79fc-4190-96d9-b67812474be7", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a037bb7-ba3c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649752918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752918, "uuid": "0e9f0e8b-f844-4b80-9285-60e1d774becd", "comment": "Malware payload", "value": "8eaadc31077f5e044ee9bdaca77c9704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752918, "uuid": "f32a1dde-f26f-449b-8711-49de2a3e26d2", "comment": "Malware payload", "value": "45655131663da42a192b1af5814f4e58b4646af1433ecc34cd504ba669dac43e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752918, "uuid": "2ff8c64d-9539-4a0f-853d-c03d24031ff3", "comment": "Malware payload", "value": "539644e36f311c8381c0555e966fe7c0339f434c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752918, "uuid": "4546f092-1c9e-4cac-bc99-014c26b452b9", "comment": "Malware payload", "value": "5306dfd3e408f0356e9e7230c1213b1c95931cbe90e950172a6f5134118e98d297aed7836e3b5885daf222385d0e93c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752918, "uuid": "097b3c76-0ba1-47c2-a4d8-dc32417d8c64", "value": "T192C19449661486B7E65DCEF84C67580D3E74094013A601BA35870CCFDEF3A92F55772E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752918, "uuid": "3f94534c-25b0-4965-9f98-c4c921caa41e", "value": "2cbd54cec9737815d0bf8f7c0b774386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752918, "uuid": "ac613289-6f9d-4511-9987-4d96e40e1b52", "value": "48:iRE7GVss5hzBGK2rb0lGUEYPPhqgT3uqMlGpy25HTcdpm/+oSBmniRuqSgnn:8ss5FBBQb+GUjP3CGpyGIxBBmyxFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752918, "uuid": "39c034bc-895f-4fde-b632-d00bff20440b", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752918, "uuid": "b077a2b4-9409-44fc-85e8-dde7a9a7d7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752918, "uuid": "60c2d6b9-7fa3-48ec-a9e0-ab59a1c39241", "value": "SecuriteInfo.com.Generic.NSIS.Injector.A.A8349A68.27702.31009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2634afa4-ba51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649761823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761823, "uuid": "d9929c96-735a-493a-a461-e879e3151081", "comment": "Malware payload (Gozi)", "value": "b0288f2457e29cb15e032691bd93aa58", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761823, "uuid": "0c1acfe0-dbb9-445b-82bc-4b00055a0612", "comment": "Malware payload (Gozi)", "value": "46b94af2c99c24074676ccd88b0c4e7e07016bff97aa8c763a5226034350714f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761823, "uuid": "ac687034-d4ca-4199-b29c-cdc492864dac", "comment": "Malware payload (Gozi)", "value": "f2c2ae768321612fb01a7261f1797a40264243bc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761823, "uuid": "c4a8ad50-bf6c-452d-a58a-d752d74ee4e6", "comment": "Malware payload (Gozi)", "value": "3686869ffc81fccf98a3f40aa4975cc1da82e7aba1309a7ccd78b56502845437aaa2fe4744890bbd132d852ac9a6da48", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761823, "uuid": "6a2f8579-b77f-43d9-a496-dcb1f1aaa45a", "value": "T144C423BA555CA46AC01202F874A7B3D4D45C1888DE2D6858E0D07976F0FE9B3FF2D2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761823, "uuid": "dbaa6ee7-bf0a-4372-bb8f-e81f662f063b", "value": "12288:UdVXnCjKNdex0Wp44U6A5uXdrV38fybjzSTP9XhY6EcuDE0LJINf:IVXWy00VIrVsfybSzQjERNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761823, "uuid": "2d2651eb-888b-4e9d-9cce-da569a5f9875", "value": 593243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761823, "uuid": "5005a9dc-19d6-446a-b1aa-043d227c7118", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761823, "uuid": "10a9e960-c222-4bcb-a66d-46f06151e8c8", "value": "richiesta.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062b90a5-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763917, "uuid": "605f52bf-eb72-4b56-b98a-942f18e3c9a0", "comment": "Malware payload (Mirai)", "value": "02f2d5b2a0cf4ecb500afefcb10aa558", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763917, "uuid": "d7514941-b1ce-4fe9-9982-769b1c3f2d4f", "comment": "Malware payload (Mirai)", "value": "46f75f64f5bc20fc6ac4bdda947ccbd1e98199d62792ab84efa1266cf5620a27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763917, "uuid": "4ecdc772-42af-422a-a444-227551424244", "comment": "Malware payload (Mirai)", "value": "c27359c54b32ce47657872bbb708ff013bfe22d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763917, "uuid": "2a35ff4c-2ece-4afd-95dc-4af34d8159c5", "comment": "Malware payload (Mirai)", "value": "b26abe40013465186fa20896f3cac5ab0460abfa2d15cfd99b3fde9a4becdc4369af885a60f4485c8acb5c6edcc52e89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763917, "uuid": "7fe566c3-634a-489d-bdb5-ba3d6a3f1d5c", "value": "T14B23E0311A33E8E9DD203F75ECE6070925238A2EF9DF36B5FB39448065D5B98069D8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763917, "uuid": "21c010ee-e669-4dc8-ae22-7d4b1723211f", "value": "768:6vS9Rc8Kz9Bj4Kli7QvwbXXxgROEmw2Nhjb9S+DQ4M6aVkAv7vafwb9q3UELS5:60c90K4svwHNh/YF64kADvafTLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763917, "uuid": "4f9faab5-69cd-4543-8fea-e625589d7138", "value": 48340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763917, "uuid": "c58ea02c-8626-4d72-9fe2-459f7f34fd7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763917, "uuid": "5481ec09-be19-47bf-ad6e-f680a47dc2e1", "value": "02f2d5b2a0cf4ecb500afefcb10aa558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6039be12-ba64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649770081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770081, "uuid": "842294e6-d014-4b90-abdc-e26982a4d35c", "comment": "Malware payload (Formbook)", "value": "080aa3660cba5bdd3a80c87755f7c6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770081, "uuid": "ed788f0d-5dd7-41b8-be71-624505077b0d", "comment": "Malware payload (Formbook)", "value": "472fce69055da6dee0ab8f9bfc0fd3979a766aec390cd6bd5bb01483e27cdce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770081, "uuid": "78a13da5-75b7-4604-860f-4197d3e67d8e", "comment": "Malware payload (Formbook)", "value": "3cfc6a93df82a0d9ef24594cce5ae956ea9016de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770081, "uuid": "b4ff1ab9-c895-458c-9004-33c6ac316846", "comment": "Malware payload (Formbook)", "value": "fd5c514306ed6983812e07c8c27bcfd9b92357bb3d93c783ab65a24a1e86252796c9510d0819323c03ae764c8e7ce3d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770081, "uuid": "c8404fd9-a735-4bbc-8eb6-3b74cc878111", "value": "T14E34123C16D654B7E9F064300963BB3AFB77E215322145CBAB346E3E2E1650396361AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770081, "uuid": "ef7f49e1-e66c-4b1e-86a7-80436792ac79", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770081, "uuid": "52b8c6d7-541f-45e7-bc27-f80770381a56", "value": "6144:8Qq+u56DuY4wYm6oK1f/W5fABo2w8fWOidklympVOwcCfHuhM1p0W:TnYmrefu5YBo2ABSNpgfCmy7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770081, "uuid": "a169072f-653e-4815-ab48-fd0bc2cfb288", "value": 241584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770081, "uuid": "c837818d-771c-4688-bdc9-1b8763bd7a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770081, "uuid": "8b8ab865-271d-48fd-8a15-957d5c37ec08", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c64726-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1649767102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767102, "uuid": "e2140197-c366-4775-9916-a94b1cb76d42", "comment": "Malware payload (AZORult)", "value": "263950977bac605cb152d88be7b3115f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767102, "uuid": "ffa88d53-478e-4e7a-8b36-2b8a6bb7bef6", "comment": "Malware payload (AZORult)", "value": "479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767102, "uuid": "2da71815-8f92-45d3-b3cf-e9abe21e189c", "comment": "Malware payload (AZORult)", "value": "c690bae8657278742c2ddf1144b1ecbbaaab7916", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767102, "uuid": "eff25382-690c-4cc9-a074-42110735b4c2", "comment": "Malware payload (AZORult)", "value": "f3818a925efa87448795371bd679569527b3ff1536a22919d8ae76a44568bc12d65705b03ffec35978dba8ee92ccb1ff", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767102, "uuid": "6027a659-088a-489e-bd30-e3f4cbd72e93", "value": "T12054548D3F3C640AC5F5A8BE1F5737A6EBBA4F1160A34E0099BDBF0DC1931E029A5951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767102, "uuid": "f2aabbfe-5255-42f9-9465-00a1f9289e56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767102, "uuid": "2b8b9340-3ebc-4802-9942-de0d761e3689", "value": "6144:23W333a333F333O333j333M333D333q333T333R333e333W333Z333D333y333Sa:23W333a333F333O333j333M333D333q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767102, "uuid": "f324f4aa-faf5-404e-b27a-f6e77c081dce", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767102, "uuid": "6ef9ed3e-b0e6-475d-aa93-3c2ca7b7f49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767102, "uuid": "9939f15a-bb8c-4657-b118-105db79aef6e", "value": "263950977bac605cb152d88be7b3115f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d3648e-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766014, "uuid": "691885d9-39bf-46cf-a5b0-798e73b883e1", "comment": "Malware payload (Formbook)", "value": "ebee326ac529c06b0c4f86362aa7af91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766014, "uuid": "3a9cc323-bc71-4815-acfe-77656253ed40", "comment": "Malware payload (Formbook)", "value": "47beadcc391c39dc4614d8afff3312f46d4c2666447a82bb8052cfcfb2c7e0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766014, "uuid": "34de07b3-f073-46c0-b62c-7809d6075c16", "comment": "Malware payload (Formbook)", "value": "87273a966d0ecde65bef882e6c92849a3673de93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766014, "uuid": "828393a8-608b-460e-ad88-18453e69d88b", "comment": "Malware payload (Formbook)", "value": "66a1cc32a9600d07b9aa11a34f4c893dd7bbdf2f51f5b20a2a14c85fe5499ffb35061e124ec579a54bb4c10cce979c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766014, "uuid": "b5f85bc0-c525-4778-a8fd-0de1af30e83f", "value": "T1A8E4AE22B2B14E32C93F1D7E9C16568D6A273E132E1CA6932BD42E4C7F752C1396D193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766014, "uuid": "e82c2489-552d-4962-bcfb-db74b94f7980", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766014, "uuid": "b35cb143-ca3d-4f11-8adc-db0a92dd14b9", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2RHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHU:wkKHuoE+/vI0icJskRHHHHHHHHHHHHHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766014, "uuid": "046e9d7a-4319-454e-ac97-2bc2cabc560b", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766014, "uuid": "2638a412-4f04-49d9-855a-59bd19093ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766014, "uuid": "e741b43e-216f-41ee-af8c-8f80f456cbd2", "value": "Eklenen yeni siparis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5152901c-ba99-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649792819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792819, "uuid": "b24d38d2-87c2-4ada-beb4-c5129f6be932", "comment": "Malware payload (AgentTesla)", "value": "e3baf82001850789a10339ab1149807a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792819, "uuid": "8bda9a13-22fe-43ee-827f-76282ef85077", "comment": "Malware payload (AgentTesla)", "value": "47ec77f598da09189ac1a2f8563bb791f73ae79ecbf43bb79de7d4b43b24e66b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792819, "uuid": "755c6355-1a62-48ca-9852-b352525cf4c1", "comment": "Malware payload (AgentTesla)", "value": "48d7cde967da51a554066d7d66a7e349598b7b9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792819, "uuid": "a7f699af-2f7d-4f21-8e5f-d25dbd664f42", "comment": "Malware payload (AgentTesla)", "value": "9aa4adf1eccb151567860186a365dcaacf0846730a5febc36e3593ae083a7d1c2192281904609eab4657862f39337edc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792819, "uuid": "051dc979-3ad1-44fa-8b42-c9d31ef46a64", "value": "T1C0159D3AF21A9D87ED01FBBD7FE250A6B14810568DACBDB36CC779C1CA48F146878521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792819, "uuid": "5c13fcb8-87ae-4e36-83d2-f20a3551e4d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792819, "uuid": "efe375e4-da89-4e06-a12a-4a17262caff2", "value": "12288:T76ZYskOEhGkEHIxZEfzWXKPvNneiUQssjrPjS4INnzVTknM8jzvbBZfu:TdgVOEqXKP1nefQssvMNnzVAnRDBZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649792819, "uuid": "c1386349-e826-402d-9e4a-7fadf5eddb54", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649792819, "uuid": "3856d13e-3205-4f35-8a84-750a3611ceb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792819, "uuid": "1fbd9529-4739-4e1e-8660-7f0455223916", "value": "SecuriteInfo.com.Variant.MSILHeracles.37221.14563.29320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f758738e-ba63-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649769905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769905, "uuid": "4acb6057-31c9-4fa5-bfdb-ebab6fb0dbf1", "comment": "Malware payload (AgentTesla)", "value": "251ba20a0d96d365d048a73d44b9ea71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769905, "uuid": "a7701e4d-3bf9-4865-9a7c-84ce444dd667", "comment": "Malware payload (AgentTesla)", "value": "47f66c434fd02690b1847b161ac20e46f5cb2ec9050a961cac72997a548e75d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769905, "uuid": "553edff0-dfd9-4935-adfc-cfe51402298c", "comment": "Malware payload (AgentTesla)", "value": "f14552d6fe2504dd8d6132b6a6461dba0842ad2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769905, "uuid": "24200151-1397-4b43-b412-104ced979ebe", "comment": "Malware payload (AgentTesla)", "value": "9ac5a798ad3c1d42adbe141449823cccea240c504232c2bc2ca6f31a81b27f51dbb8609250f69bff7c7ad70dad78cc35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769905, "uuid": "2427fae2-e6a9-44fd-8458-36963d82b6df", "value": "T16F159C05F9A9EC82E1660677C4FA481013B5EB47941EC65E36F2B29909733E77843E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769905, "uuid": "423bc00d-5e25-4b84-a552-155f749c834f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769905, "uuid": "728b4e29-5074-4c11-a7cc-6811b83ad615", "value": "12288:orJdXdzBK/Def24qIgCgVg2fVArc4VuMtBrxJHhyULHIvTsag6pT4scTM:w7qTVCnHZByULomwcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769905, "uuid": "28675200-2cf1-4304-b251-6216a46d6a18", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769905, "uuid": "6de5a0d2-88cb-4c6e-838c-4c6676bc5a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769905, "uuid": "d3ad181f-6ed4-4dc3-8eaa-83b959e8d3bf", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.GZQ.genEldorado.23944.13918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd962568-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649753541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753541, "uuid": "40637252-0b97-4e5c-a583-9fd272e3b437", "comment": "Malware payload (Quakbot)", "value": "bcbeac9dfa219a6cd1cbd92519d90e67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753541, "uuid": "66d0fa46-747e-4b4d-ac37-f8cb5d6d11a0", "comment": "Malware payload (Quakbot)", "value": "481ff2b9120dee6782a28f56cd2ece39feecd26ca31a16d81439a466b3260190", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753541, "uuid": "928d3470-1f0e-4fe7-a346-a4d6e8f9eedc", "comment": "Malware payload (Quakbot)", "value": "0887334fe416465cb78340789f518a21e89806ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753541, "uuid": "7d81e455-787e-40c8-8462-d028a7fa1083", "comment": "Malware payload (Quakbot)", "value": "4ac0a8b55b8a1a157a3a98838f04ce03553fed7cd8f341a2bea47259c8e9bfde529643a436202d1781cf62d46fe8b09c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753541, "uuid": "c50830e6-0515-4c35-b5f9-570356ba6121", "value": "T158A4CFB97A047DD6E52E467BDD96ACDD23B62362C9C7D4CC806477C309A3371EE0680A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753541, "uuid": "126263de-af1e-44d7-bf5f-e4c2041e6652", "value": "f6744608525b7965514333f98f8a4bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753541, "uuid": "1aab6c41-3b9f-47b3-b79f-561a9557758a", "value": "12288:7YJHTgEzFKItOMJC1XqlkcSjxOj5LLXvrxn22upJPN:0xEEz4ItOmC16CcYO1jA2upJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753541, "uuid": "59316d1a-3ad5-4d60-98e4-2fd238324838", "value": 487882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753541, "uuid": "5ce9a270-05e1-4c57-a8c0-591c8ad70ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753541, "uuid": "d98b3930-a9d2-4a2f-8f38-6e2edc1c8641", "value": "481ff2b9120dee6782a28f56cd2ece39feecd26ca31a16d81439a466b3260190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c2502b-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736371, "uuid": "482ad1f4-9410-4440-880f-2169b27b9a5c", "comment": "Malware payload (Mirai)", "value": "412c213a8019621bd06791c09e5ee04a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736371, "uuid": "257919c9-bc81-4ebd-9526-9d854e718afa", "comment": "Malware payload (Mirai)", "value": "48ce7e505f5876c709fed43de1946738c440b7a8f057383e2bce1f33b16bfe8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736371, "uuid": "5e06b105-bd46-4d54-a907-76fa57e4528c", "comment": "Malware payload (Mirai)", "value": "2049b2a919fd99ca1e0a0d4760b34fcf2952335c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736371, "uuid": "f23d8a36-0900-4b3f-bbde-71ef4563bbc6", "comment": "Malware payload (Mirai)", "value": "2538883f042233fd849348ad54644f6c851073da4183d7b1ad1d8a14f413fca6c54b1f85de67d0f70c4a3e6938be55f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736371, "uuid": "15c0177d-5cfd-45f5-85a8-63f1bcfc9af8", "value": "T1A2532B8D54022D5CEAE798FD90764F09CD541311A0A31B1FA7EAFDC33DB3269EE26648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736371, "uuid": "b7674835-72b0-4596-9373-646980862d32", "value": "1536:M/mcG1ksHFa4uWyg4w4qDWD7VoLg1pmfUB:Um1yg4wxYoepmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736371, "uuid": "f8eafa62-7e41-4249-a833-077e5957d1fd", "value": 63108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736371, "uuid": "745b5f62-3d10-45c1-9e61-e424b8df4ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736371, "uuid": "3765ac14-0a86-4cfb-944c-e7f9f58dd3cf", "value": "412c213a8019621bd06791c09e5ee04a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268571ef-bab5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649804773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649804773, "uuid": "2f36d3ed-3b74-4823-a5e7-b24ae29b3ce8", "comment": "Malware payload (RedLineStealer)", "value": "47144331aab84c297fd02e90988b07ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649804773, "uuid": "6006415f-8e1f-4fcd-b1f3-8619db8ed9f1", "comment": "Malware payload (RedLineStealer)", "value": "4908a123314e068f7823c102f4de7c4445b62a5ca191b1c495b782da75bd1627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649804773, "uuid": "cfe0f8a4-769d-4cb8-a45e-d8127f2f1542", "comment": "Malware payload (RedLineStealer)", "value": "67dcbaea8a0198f44c29be79cee165aec61884af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649804773, "uuid": "db73a03e-db71-48a7-aa32-4c463e0a614a", "comment": "Malware payload (RedLineStealer)", "value": "629bf5d6b2c250945f888b45bc844babead938b2b3d40a38aff4915e564b60f7f66e8b079aacd2700ffc42d93bc17fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649804773, "uuid": "921de792-08b5-4faa-abc9-1929f7cd9333", "value": "T12774CF11BBE0D035E1BB12F54A7A87A8793E7EB12B2050CF62D526EA56347E4DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649804773, "uuid": "acea8224-a8d0-46ff-98da-d9cc880cebd3", "value": "64cca9e1e2de2d3835f36bbdd76fe0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649804773, "uuid": "071339d0-f209-4cce-8eb2-dedd7047ec5e", "value": "6144:BdxQI8nHArNrLqqlTWbdDPNbnCXFhqXsY6SQvO8Q0UnPkUThr:zxOngrNrLOdDNbCXFhbY6SQGWIPkUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649804773, "uuid": "5e8b20bb-ab73-45fd-9822-f2f6ede30de7", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649804773, "uuid": "8f4b102a-9f7c-42e6-bd2f-bbc76ef69a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649804773, "uuid": "d7a5ea1c-882f-4608-982c-466dadf501ba", "value": "47144331aab84c297fd02e90988b07ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1adf2d-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746349, "uuid": "315e58d0-a069-4f85-aaef-2fd2527f7ea9", "comment": "Malware payload (Mirai)", "value": "78e7e1d0031512552d2bc9aec50a69a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746349, "uuid": "0809043d-9bad-440b-a1d1-46debb655aba", "comment": "Malware payload (Mirai)", "value": "4a46209e2a58eab5c677243e74ed89b825c1e14c8427ef3ea98fe945467372ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746349, "uuid": "a724fee8-3bea-4fed-8259-4a03d8087231", "comment": "Malware payload (Mirai)", "value": "59e03a83e690219e9b4b7b8462b978a5afc45f0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746349, "uuid": "d63df1aa-05d1-4969-a6de-69b24837b816", "comment": "Malware payload (Mirai)", "value": "461333334ce777dbb9d72e7b84c9e7f982b376645c5ca5e36a8631366c40fbfdc577b08ff8b5a1156d0806326a9edb04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746349, "uuid": "30579fbc-8291-4611-8fe1-cf312bd00753", "value": "T1D103F13A514675F0CC97C0B9D7B127215DB6D7AF118AAC0AE11886E98F4F2857CE3BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746349, "uuid": "7a5dc00c-86a9-4400-968d-45870e0f16e5", "value": "768:jtACyKg7qHSRWZehKXrEp5JpHnOhCNTP16ROXHpeOX81Cly61+3JgGlzDpxYsZ:uVOSlEEp5O0T68y6k1VrYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746349, "uuid": "6429a30b-8662-4718-b177-a820475f946c", "value": 38736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746349, "uuid": "8bfe358f-e4fa-44aa-925c-ebe5f672c28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746349, "uuid": "4f061802-d0f8-4ad3-a3bd-cbb7d9843be1", "value": "78e7e1d0031512552d2bc9aec50a69a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d178dad-ba61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Makop)", "timestamp": 1649768707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768707, "uuid": "116347cc-a41d-4e8f-9d76-0d009abe5c11", "comment": "Malware payload (Makop)", "value": "5a14e0ef81ea15e9afd4defdeaa840ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768707, "uuid": "565a8351-8d9a-4c71-83d8-e83dce1b54c1", "comment": "Malware payload (Makop)", "value": "4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768707, "uuid": "99027576-1834-4bb9-9e17-f0f7be72afda", "comment": "Malware payload (Makop)", "value": "a2a477a36236e38ca0140e3f751006a624f142ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768707, "uuid": "628d4b07-0c86-4e3d-91ce-f39af402580f", "comment": "Malware payload (Makop)", "value": "64e69908c3e0f7dfef37c276d37b786025560e11f21ab98484c81f660384af02851a45aec11e29b60d7ffc09485a13e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768707, "uuid": "5dcdda6c-6df8-4396-a354-b3da8904f493", "value": "T17104CF11BBE2C533C40594754476E6B1067EF8612F71D2133BA86A9E2E312D6C6BB38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768707, "uuid": "593d5c86-00e2-4bde-b37b-a7fb352bd4b4", "value": "54dc4fa00aed2dfea3bfa727027b942d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768707, "uuid": "a26c4d3b-53de-489d-ab6c-36b7dc59f58f", "value": "1536:s/lLWqbPoATxKPTPCl+X8KY9/JOed/ohT6NxAMQ854URociX4Q2jw/mb3rU9:s/lLW2PoAp/xZdd/vsXQ4URoQM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768707, "uuid": "c5b8dc1c-c0cc-484d-831f-c899cbf902e6", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768707, "uuid": "4be82daa-6e29-4b3e-a8e4-217ba4add4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768707, "uuid": "3ee9b723-7d5a-4555-8496-b13469965f94", "value": "4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49aca7e7-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649769184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769184, "uuid": "bfcdc95b-00b5-426c-9fe8-fb510639313b", "comment": "Malware payload (AgentTesla)", "value": "ccc7fbac8f7b3ee8856412bcf65137dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769184, "uuid": "df1ba987-0296-4c81-852c-dd3cc2d1ed2c", "comment": "Malware payload (AgentTesla)", "value": "4bb00b25dd60383b0ed0786a85f6301eebe9439e5b7a866cb81796ac739041ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769184, "uuid": "4e257ac4-92ca-4b17-9dac-9386fa47f2d1", "comment": "Malware payload (AgentTesla)", "value": "c52948f8eba3294c7a9467d6c0276755521e2fda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769184, "uuid": "d0258579-f051-4820-80ff-421bab0401a9", "comment": "Malware payload (AgentTesla)", "value": "0157b2fa6d9d19a128655179fd068392b95b118c2b5fba7a7643ff7d26ee6ebcc6c5691d71a8889b241144b4d739293f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769184, "uuid": "17bbf8df-1e06-4cd7-943b-9d2056df775d", "value": "T11144124037E0C07BD4D356326BFE6B2B5BAAA9311564C70B3374696E7E326C6AC1E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769184, "uuid": "d5792c5a-1264-4ad3-b2f6-5cf40f2102bc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769184, "uuid": "512a326f-ce70-45ed-9d2d-dcf62ec74e4e", "value": "6144:HNeZmP1jqRRt3CgzxdJ6ucHQHNkdj2P3G4V3p057CG5flC:HNlP1uRRsyJDVuYP3G4VP+flC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769184, "uuid": "a4562bba-5039-41db-82af-d5f6b17b60df", "value": 272542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769184, "uuid": "086d219a-6235-4d74-a1c8-6f815b4a1fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769184, "uuid": "ba29e3eb-c841-4509-bf53-db3fc54a2e7f", "value": "RB11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7b61f2-ba49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649758556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758556, "uuid": "d2d1fcc2-81d4-4877-bba1-56af4ca2baa3", "comment": "Malware payload (Heodo)", "value": "271c1bb659e5bed58d55aa99dad4a70b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758556, "uuid": "8e3b6c15-0465-4a01-b5fb-d48752268977", "comment": "Malware payload (Heodo)", "value": "4bedd3648315f1fec45a72c83684f13d9ab0427d14f0ca8af0c57fadb8627dd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758556, "uuid": "42f260f2-ce51-4dc2-83e0-8b68ef0c5340", "comment": "Malware payload (Heodo)", "value": "7b091ef79f8a626ddc48b8ea71d9b0fe7dc96534", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758556, "uuid": "13135323-8b7a-4201-8738-dae8e857a280", "comment": "Malware payload (Heodo)", "value": "50044d827935fac5a59293aa4dda4fcc466ab5ab2edb160fe33ab4abd57b1a04d365053b0099459043e349fb171bbde3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758556, "uuid": "20e7f1f3-8a1c-467f-a30d-f51ec365904d", "value": "T14494F5A36BC3C077E45B02B9C65A5118B257C632375AAADF37C1671ECA3C3A2B738151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758556, "uuid": "ba22e578-549e-4944-a930-09012a27ef0a", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOM:w5aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758556, "uuid": "4f237279-3a48-461f-86d0-2d2ecddfeb76", "value": 412832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758556, "uuid": "37c20d12-d376-4195-8777-46f5c98729f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758556, "uuid": "15dd4497-b8b6-496f-9829-2551a7089e9a", "value": "emotet_exe_e4_4bedd3648315f1fec45a72c83684f13d9ab0427d14f0ca8af0c57fadb8627dd7_2022-04-12__101551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53849cda-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649771348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771348, "uuid": "6d27c02d-ca3f-4ff2-9d6d-d38e47cdba5f", "comment": "Malware payload (AgentTesla)", "value": "cb229c55aacf97aec85fc29208684f72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771348, "uuid": "6a5e6480-67aa-4829-ac7c-ba9e76edf5c8", "comment": "Malware payload (AgentTesla)", "value": "4c3324a2170e14200851f50fb8a3cbaa81ee0f08732926de7ce656e5fcc4cad9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771348, "uuid": "d678aac7-2d30-4394-80d9-e1b2aed073ae", "comment": "Malware payload (AgentTesla)", "value": "1036b6a708667a4771ac0c1e41bcc127c765b7ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771348, "uuid": "05e3feac-f3c0-45bb-a85b-6e978ab3eaad", "comment": "Malware payload (AgentTesla)", "value": "6e846b10af0c8fd9476543ad6140c8538cd43b05b43762b4a18cee3881cbaea3d8543e2e6d38c2a984b7ddbf94239ea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771348, "uuid": "9ab904fd-4ac0-43fd-a408-3767e3cddef7", "value": "T1CA94F1593198E856D7D8BA388F76CAB69375AC8D6D09452723F43F8F36FD11B2104322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771348, "uuid": "95a200f1-86ba-4c53-abdb-2594af38912d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771348, "uuid": "e701265d-9f07-45ae-821a-70ba06136faf", "value": "6144:HQqHojJDxl7F88zVjHE5oZ8WMTaX8/yN1WVWEiwAVurniSax/sv:FeDxlN1ItaXOiMVPiwAVcnrax/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771348, "uuid": "74e81060-931a-4051-83ae-6c67a1c14bda", "value": 435471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771348, "uuid": "ae5c4ba4-8602-46fa-a7b5-f3f638507e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771348, "uuid": "959359de-0055-4a51-8d71-428e09c64ce5", "value": "RF-000091 CS.xlsx(87kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1f6f5c-ba63-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649769668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769668, "uuid": "aa0d10b6-8a6d-445b-8e72-cfe635e97705", "comment": "Malware payload (RedLineStealer)", "value": "9cf3483969457f0b6046eae0f281c43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769668, "uuid": "397666df-13f9-4c4b-b749-42e7217a7aea", "comment": "Malware payload (RedLineStealer)", "value": "4c3622798c473202ef6f648c098cb71d1bd6b35c98ce36ebe525299f6599124b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769668, "uuid": "2069444f-d674-4f98-bdc8-eca511216088", "comment": "Malware payload (RedLineStealer)", "value": "d647a4762c742799453dc40e2e2b81c350875e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769668, "uuid": "812adbe8-841e-4467-bf0d-cb2af07fb355", "comment": "Malware payload (RedLineStealer)", "value": "f247729f4f7b40d9543db550f86f9da2bbb69953a16f8419ae507372a969bc45d05d54ce55b243b0c6d091d4f5c0963e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769668, "uuid": "8b5dc93c-4ab7-45f7-83b8-ba0b78ce2c86", "value": "T10D84C000B6E0D039E1F322F4497693ACB92A7EE16B2455CB21D57BEE56346E4ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769668, "uuid": "7ecd1bcf-c080-482a-8bfb-7dc54fb94a24", "value": "abeb572091795033c85c3efeed8e2553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769668, "uuid": "de572b33-c11f-4608-b07d-1ac8a2ec026e", "value": "6144:w4gOuj2r99nj5t1i7EOgbIS/tGY22gSjptz1zk6pmtwZpRwOap0SfW:7gta9nj5tUHgbX/tGm7tM6ppZ/apU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769668, "uuid": "34346206-87c0-4b27-94db-145584d1badc", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769668, "uuid": "c7d174cc-d079-4b1f-acc0-0ead9dd44601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769668, "uuid": "d0b23371-eace-4815-8236-8dea39da8765", "value": "9cf3483969457f0b6046eae0f281c43c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41f50c9-ba98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649792609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792609, "uuid": "26671c70-d476-4b13-b182-aa167bdf5638", "comment": "Malware payload (Heodo)", "value": "20a39109704df069480671afb97443c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792609, "uuid": "4a3f2c4c-08fe-4246-bfd7-7fac08c07bdd", "comment": "Malware payload (Heodo)", "value": "4c62f5532e755d8c39893113c33ebefa42f7310046050b95ff457f2e2684a435", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792609, "uuid": "f03ed506-0bc3-4acc-b8df-c6563c8a803f", "comment": "Malware payload (Heodo)", "value": "1035e578985086b95dad65c7b62dea40dc180a1b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792609, "uuid": "705606b7-9dd4-41b4-8a23-df8413f4a48a", "comment": "Malware payload (Heodo)", "value": "f155e2536576cb2bb4a3863ed857981d49561aeb35a835cd75688dfb7d543daa67979af5972c347f21d21e92d45f8e58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792609, "uuid": "d22c1907-5e1b-4eba-a13d-6ad35a6bed16", "value": "T18594AE2176D1C076D8DF02351A07C7AA62F6BD708DE5C247FFD53F0EAE326418A29299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792609, "uuid": "14496cd5-aa02-4b8b-9644-6aef9b05d7b9", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792609, "uuid": "5a2d9ad2-a1b3-483d-bded-d740a02cec2f", "value": "6144:buZlJOFmzvtg1Eyid5GX5BVhthqnhdDpV+WWT8JKyTpoOvy2ufQd:bGptged525pthqnhB+RUKyTpoOvHuf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649792609, "uuid": "a78b1140-8145-4475-9d4c-2db1bd2863f7", "value": 448341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649792609, "uuid": "3b62c48a-86a5-4fb2-b5d9-87920f0c7934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792609, "uuid": "a938a9ca-b509-46ca-8fe0-079567f56a90", "value": "light32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec06e9ed-ba40-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1649754854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754854, "uuid": "e025ac5b-bb7b-4d70-9d94-4152c11fef84", "comment": "Malware payload (DBatLoader)", "value": "c2db02e1bd041371da87907ae31499fc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754854, "uuid": "4cbe10a9-90a3-4df1-bd97-5c684e258a2a", "comment": "Malware payload (DBatLoader)", "value": "4e3b7e84edc257cfc5c6d581272695e2ef520f47b6fa8e179960d52f0f0a3140", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754854, "uuid": "9620bf55-27a3-4c46-ac56-3a90b496f4a9", "comment": "Malware payload (DBatLoader)", "value": "3109885a7a51bc53c53cd6cc86b40c95c8ac39b3", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754854, "uuid": "3be8f150-5149-4b1e-95e2-d1cb84242ca4", "comment": "Malware payload (DBatLoader)", "value": "3c7bbaff9b510a69af3443c28e3ea4a329f68bff39087ea4471ddbbe9ddfebd8462a142e072c142844515779004ca012", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754854, "uuid": "9d207db9-aee1-41cc-8aea-594826a968ed", "value": "T197E49D61B2714E32D83F1ABD8C1B57A899237F536E1892973BD05E0C3F351C2796A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754854, "uuid": "ff9ea04e-44ea-4f93-9322-cb3be63d42ea", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754854, "uuid": "b838aafc-f67e-4aa3-b39b-e9d2ee693eeb", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh22Zec4qO:wkKHuoE+/vI0icJsk2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649754854, "uuid": "0505bdf6-26c5-44eb-880e-4a33a6bef412", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649754854, "uuid": "bf50243f-8d66-4f40-9fac-39a7de384152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754854, "uuid": "9fe41cd0-0d3a-4546-bd71-fb6a2536c57b", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a18a69-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649800504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800504, "uuid": "c6b7c1b5-b680-450f-9da7-3cd96c70034e", "comment": "Malware payload", "value": "5bf0e67f2a413ef44ff365a9f28ba4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800504, "uuid": "3a39211f-07d6-4024-8c59-8c38b93fccf9", "comment": "Malware payload", "value": "4ed66ad6e2ca374221ed660177521dc2c4db9492a048c52410931b86a66cc837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800504, "uuid": "074a3f06-c11a-48de-b190-b5cb77c1c96c", "comment": "Malware payload", "value": "6739fc00b013de378b79ebb759883f96da8c7b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800504, "uuid": "efb3aa9c-5564-40dc-b0cd-4a0cf7645a6d", "comment": "Malware payload", "value": "33319e3f610423f84d2628f92dc8769e65d94f02f063dbc321ff8d4335a6edf852b5827422316e4994c526b7e41e55a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800504, "uuid": "59b1bd00-cc6d-4451-8c44-b19ba7681066", "value": "T180C63952E384943ADC2707368C378EA15837BE381D35496F6BAC392C1F77742692AE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800504, "uuid": "f514bb4f-6e51-4180-ba99-3b1a2a48865c", "value": "b88830c772311172534a0269092f1b8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800504, "uuid": "65aee130-c46f-4b63-bf62-92f183d86e49", "value": "196608:rea0/lFiriNDXbSOTVf/xdamo3Qvo8YMzsihz+AtehKUzzFhWxvDbmOvpOM7i7BK:ri/lF+iFXbSOTVf/xdaL18TzsihaAtes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800504, "uuid": "d1970ef1-6868-45e9-af59-b2f0045e163f", "value": 12151888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800504, "uuid": "18a2a3a4-c4a2-40be-966f-a27a646426e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800504, "uuid": "31590c9e-02df-445f-ba98-e5037a87b531", "value": "Isname.name", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bb6b19-ba55-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649763832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763832, "uuid": "3e247b3d-2a37-48b7-8466-c18cef39dce6", "comment": "Malware payload (SnakeKeylogger)", "value": "375bd23bd866ba51952f4146071fbe39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763832, "uuid": "000bb6a7-417b-4014-9dfb-2b2687e4563a", "comment": "Malware payload (SnakeKeylogger)", "value": "4f796de093192ec7d9d5cc2e0dcf0e70a1e6ec99cbbaa71335b9a0fa1ffe75dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763832, "uuid": "4191a0e0-636c-454e-b3df-90b305e1a9bf", "comment": "Malware payload (SnakeKeylogger)", "value": "02d4117f3d247782c62d62ce2e3abf781cf18af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763832, "uuid": "cf34c19e-4f70-4df7-bf6a-8d1f2b4b3d0a", "comment": "Malware payload (SnakeKeylogger)", "value": "d9e2db7eb8fd45f01c667a4e361d6026d16f5d320fc74541e54e7e716588f7d0a2fb49521234b5784d30cd28c5f53109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763832, "uuid": "49f18445-8f67-4c41-b18f-7cc9bbc02b4d", "value": "T120153C91F590C896E96B06B3ECEB543012F3BE4D9465C20D6699B7162AB3353208FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763832, "uuid": "7019edd3-9418-4a4a-a353-8557dc052d78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763832, "uuid": "02bebdac-cedb-4fd1-b94e-de81d0fd3ad0", "value": "12288:i5Wotjau4q42dZCTK54eH1+GgmXnKZpNxqhninlg2g6:ijaFqbdgKmeHgmXCpNQhi2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763832, "uuid": "fdff3c46-b511-454a-8abe-a2b0eb5edde2", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763832, "uuid": "5b8b0069-c9a2-48a6-8775-0d79fd9a5089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763832, "uuid": "59cfbf80-e81a-401f-bf20-6f54b0d1bb88", "value": "SWIFT gelen mesaj bildirim- dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae0d57a-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "cca412c6-aee6-48b0-91bf-02ba9019604a", "comment": "Malware payload (SnakeKeylogger)", "value": "83e3b54aa695f12e482c6daf6af4d875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "e3289a64-8f0e-449c-b632-18bb7dac59f3", "comment": "Malware payload (SnakeKeylogger)", "value": "4f9be4b77f1bd13ab161bf6ec88309d466fd3dbc09bd92682d0af59d37e700df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "288b2760-767a-446b-8af8-b2374328bd27", "comment": "Malware payload (SnakeKeylogger)", "value": "7b33024f36c8ddcd130d17a5f486817d938fb24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764032, "uuid": "24953243-3449-4ccf-be03-6173fcc631a5", "comment": "Malware payload (SnakeKeylogger)", "value": "ba79decbfb0942e2dd4099c2777032e3f9c7a65fb6cd0bf428c5b065d5a4b563e9d549f1928cd90ab254ec235612f601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "a255e442-e96b-49e5-b64b-59f7f35d7070", "value": "T12184599ADB800954DC3A9774643A4E3017EBBEBAE4F5B34C5BDD71702BE72A3046350A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "9aadafa2-0f52-410f-a0bd-d760386fc72c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "4fb6c991-ce64-4abf-beef-e4697a5fff07", "value": "6144:354Yl/mb91MYICxnVpvBxUsnA5Eb5bA4nBMmEVkqvMlWs45jtlknV:354YlRYPxPvB2sAYVA4DQzlvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764032, "uuid": "efc312d1-414e-452c-bb79-8969d0214282", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764032, "uuid": "ab05767e-5ee8-4c30-be02-6e10ea1492fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764032, "uuid": "84ced19d-d1fa-4cb6-ad64-c2815a05654e", "value": "ZHOU0422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6111b22f-ba68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649771800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771800, "uuid": "d4ec6e7f-1fed-485f-9830-7537c0c5b9bd", "comment": "Malware payload (Quakbot)", "value": "e35ee74a5685b363465542890ce01899", "object_relation": "md5", "Tag": [ { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771800, "uuid": "57713f39-743b-4f1c-b6f9-76332e3f90a0", "comment": "Malware payload (Quakbot)", "value": "4ff32aa4d8dc8b9a7c8eb75300649a5078be769c5d1a96c31de1c91c0d76c22e", "object_relation": "sha256", "Tag": [ { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771800, "uuid": "bad2747b-16a4-4eb6-809a-631bff6ac96e", "comment": "Malware payload (Quakbot)", "value": "1f67bc793fdabc6e9a223cd8371ebe1c4ea56a92", "object_relation": "sha1", "Tag": [ { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771800, "uuid": "57c0086e-a363-434f-92a3-2c73a6624fde", "comment": "Malware payload (Quakbot)", "value": "d2a3bdadf1c3f61e69ac53c104607b0d07753416c9d00dcaaf3e6fc472db4a99c2a807663612cb3173f63a891c0ee8d7", "object_relation": "sha3-384", "Tag": [ { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771800, "uuid": "540086da-3507-4422-bd58-f0577bda5cb9", "value": "T17DE42360A5EC6F8D8BE9B50BC4664ADC3B65F17B6C291B8A9C19FBC781013D4331F069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771800, "uuid": "c8fc84ca-465c-4969-ac2c-df007a1fadcc", "value": "12288:0oK9LLPwdq1YQpV8FsmjRBBM1tYr8KDpCjzR5Mb28gD1/YetX1ZzzkriGeKR1F:P2LPw/QpRSWtYYKDpCvR+2jxt1ZIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771800, "uuid": "64b2937b-e068-49e3-ab0a-d7b93cdd46bd", "value": 720123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771800, "uuid": "8d670b78-ebbc-44bb-9319-08c795136b6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771800, "uuid": "9c52b589-48da-40bb-9567-aee01f5c4cc2", "value": "305.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee9954e-baa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649796332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796332, "uuid": "f1019fa8-73c6-4cb4-b1fd-363c78a2e353", "comment": "Malware payload", "value": "e8573f06d342ae05ece8d1be111669c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796332, "uuid": "4368cf8e-e837-426c-a105-072d8b061135", "comment": "Malware payload", "value": "509f0bcd1b06053ad2d05754f973de8754b942115cd3a5e6e38939f39e655e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796332, "uuid": "3d895bdd-0b48-40f3-82c4-d976bc5369f6", "comment": "Malware payload", "value": "00432202877deaccef426f7727ff57c4e3407394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796332, "uuid": "f8c01f78-d692-419c-9ef8-f0b52a195809", "comment": "Malware payload", "value": "c5a8a767feb2e63d4f4d0712c9b9c50c55dd449831758e32de3970e1c520b2a574e8f9c1c1fdd7bcc20a9ceaa0257962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796332, "uuid": "3b529731-f67b-49f1-9678-257a9393a425", "value": "T1E145335D7AB2F0A2D3A88776D96180B000FE07B1AC2AEBD175719B5C5A95FF83F4D810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796332, "uuid": "fd04a49b-5fe5-474b-b2ba-7eef971b1722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796332, "uuid": "40f38115-72f2-4415-bc27-4fba91c1c37a", "value": "24576:v6JbOn3eXn9LExGsKrjuEG95CzB8dpAvYi2kR:SJceXn9LEOrNGrCzaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649796332, "uuid": "827429f9-a520-4af4-ac6f-acf6abf1dd46", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649796332, "uuid": "7b45e060-2686-42d1-a88b-bd74907cdec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796332, "uuid": "316cf32d-9289-4cac-9893-1fd89ec25041", "value": "CONTRACT 1.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d651bcfe-ba6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649775004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775004, "uuid": "2777b9eb-20b4-47ce-a580-cb56dbd1edab", "comment": "Malware payload (Mirai)", "value": "47cea234e525c75f1f63e15e7ae6193a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775004, "uuid": "2fb67134-c408-49ec-a397-61b2313744ba", "comment": "Malware payload (Mirai)", "value": "50c16ef213a15cc9580c864d553bacfc31524e1b82ffbc2018cd712d3c2ff635", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775004, "uuid": "b70984a9-0daf-4e01-bbd0-7ad33e5f20d6", "comment": "Malware payload (Mirai)", "value": "9eb8e0a46f3afc3adc32f9647dc45323162ad3a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775004, "uuid": "b03e80a3-6c0c-4571-8f20-80b515849292", "comment": "Malware payload (Mirai)", "value": "835eca2b952d02692750449741ac1717d849adfe16b0efb31123733c4109b04d9758167ff9d3a18a0f98e53bfc387741", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775004, "uuid": "cbae4615-7a75-4c43-973c-223123ae2b2b", "value": "T1F4334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775004, "uuid": "addaa8f8-5354-49c8-8781-f48cf7449987", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhN66OQ6xpwhNbr/k:xZebkP/Ad39UMJRlhN7L6bIbDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775004, "uuid": "b60f204e-f04c-4609-b68d-58da13af31d3", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775004, "uuid": "41f72942-3e84-4440-9c21-202c57d97020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775004, "uuid": "f6eb8814-cc51-4674-9c22-a26ef8b8ec40", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f84e22b-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749974, "uuid": "2e66be4e-bbc6-4781-9e4d-0c6b0f8d3a80", "comment": "Malware payload (Mirai)", "value": "50013875246fb82e1ccd3f68f427a911", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749974, "uuid": "b8b5d15c-9b77-4f7a-b0ce-e67a8c6fb501", "comment": "Malware payload (Mirai)", "value": "511f002a4b6a04d66e5658df2f870daf19563ea7a7220fd93c6a9a0424a93380", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749974, "uuid": "4762d6d4-d1f5-4a5d-a3ff-3c33f2de16dc", "comment": "Malware payload (Mirai)", "value": "a27324873e9a3ea91633c4c52578108e3023d651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749974, "uuid": "636ad87e-d9a6-44e9-b145-a8649c1ee11d", "comment": "Malware payload (Mirai)", "value": "a5fb55f3ec5b56c5c79ef90aef9d6b44fe929a4fbf9aa998d922ed3c7ea2a637e1d18668a3844ec04d2f6b5d6453590c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749974, "uuid": "c6cf044a-f375-4f2f-817a-a0341bc36853", "value": "T121B2C0A42E46849DE5B1E0B543B30F021D725B6184036C43649EEE4FECBE9B8BDC2F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749974, "uuid": "8d96a7ce-63a8-412a-9226-8d265b0794be", "value": "384:0MmpnBBT3enW9Puy4Oh8WqBGe6udx5eunZUbqnHq+VKEAiLFY8xYJJgGlzDpH7uI:5mBunWkSqe4x57wqzLAYMJgGlzDpbuRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749974, "uuid": "32f350b4-3683-459c-8f7b-af8ff0e3c6d6", "value": 24044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749974, "uuid": "34eef62a-1d6b-47e4-b772-136329fcbc8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749974, "uuid": "b7b2cb69-f517-4cba-bf2a-d5d6e63d3df4", "value": "50013875246fb82e1ccd3f68f427a911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a330baf7-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649793386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793386, "uuid": "bb6a3384-fd17-429f-97ab-baa73d928640", "comment": "Malware payload (AgentTesla)", "value": "a802fff1f327f80c9e61c061a17e9e2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793386, "uuid": "778480ca-4f72-498f-9a19-fd2d47ceba3c", "comment": "Malware payload (AgentTesla)", "value": "52307f11c88c129e30670b72f9b76ba6749687e0d168188f884f7c1139a1b4f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793386, "uuid": "aff7ea56-b4e9-40d6-94d6-1b79c30d7f71", "comment": "Malware payload (AgentTesla)", "value": "0fe605b3ab0a878d5f2ca510ba4013100204436e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793386, "uuid": "46b5bf05-5225-4a1c-9270-53c07038082c", "comment": "Malware payload (AgentTesla)", "value": "f95cf9b23cc888f4d799c4a0a7d8f3fc43e01711067af1db3ad08f5c7432e669cb7eeb34164930e333ce76fb52cc8130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793386, "uuid": "b7354851-f248-4eb4-a31f-571bbd0b3907", "value": "T11D35F1615B669583F1F9263144AAEAF132F132894237F3ADBC88C2357FD1284D9417EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793386, "uuid": "d05a476e-d0f8-4354-b1c8-4f517f0e9357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793386, "uuid": "af859739-b286-4279-9936-7858f5dfaf26", "value": "12288:r/JEx2Jrx01UwBYXRC9wjZAafeugkVjxZK4VEZY0+/GOrKDn2NEU/Gl4lGZ0wr8b:GQgdBqCebfeuXVj6JYhnA2OnZTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793386, "uuid": "99d0dbb5-8145-4067-9340-f7f2d8b6a079", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793386, "uuid": "e9709edd-31ce-46fa-ba0d-2c64f03bc2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793386, "uuid": "ac216420-34ec-4e72-810b-cac3aec95651", "value": "T6Qm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585b00d9-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764055, "uuid": "4f04ad51-3076-4dff-9525-ee49856d5bb8", "comment": "Malware payload (SnakeKeylogger)", "value": "21ff6878643773131c5f54263ce335b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764055, "uuid": "cb107ddf-3cd5-4150-9e4a-304a839c1766", "comment": "Malware payload (SnakeKeylogger)", "value": "5238d71fc51769af80408cce0d20cbdf2f1c64dc0efc1094ad86b5692e04f91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764055, "uuid": "b6b854f8-ce53-42ca-b07a-e379a9a70977", "comment": "Malware payload (SnakeKeylogger)", "value": "db0fc2f1b8810fae3f320d5277cab14c45aacef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764055, "uuid": "7e8df89d-7e4f-46fa-8a35-8d4dff7de63c", "comment": "Malware payload (SnakeKeylogger)", "value": "26f598cf56816f763517b30feb11854ab8cde2c0e4c049f05087a236256f7caf84ac54ff0a2935379093657ed6c18b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764055, "uuid": "ae08c94b-7293-4ce6-87cd-72a7ae1b4e0f", "value": "T188546385EE81A5E0CC2993752977CC355727BDAEA5B4640C25CE3B332FB7AA30036587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764055, "uuid": "1b626ac5-a8ec-423f-bc29-fd74991e0f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764055, "uuid": "6f500d36-c999-4495-b00c-cb429c6b6a81", "value": "6144:VC+tRj6rnCUVHyppvppMkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk6:V5tRFuSppvppMkkkkkkkkkkkkkkkkkkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764055, "uuid": "8d2ce640-5bc8-405c-a04e-904f2164e07f", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764055, "uuid": "210c40eb-47c9-4058-9b82-60e7ce4f99ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764055, "uuid": "c26e0cb9-12ca-4c73-acbd-991a83fef62b", "value": "Bahon Ltd Inquiry#20220412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b254a63c-bab1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1649803290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649803290, "uuid": "2b2ec938-ba99-46f3-9e44-6b0cbc541b27", "comment": "Malware payload (Gh0stRAT)", "value": "66c09ebc84daade98d7f85f4f822b18d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649803290, "uuid": "416b6d7b-d1e3-4bf4-9cfb-6070ef10bbae", "comment": "Malware payload (Gh0stRAT)", "value": "523aff6c7b173c89a3cedee34c8077a608d14654846bae3c84c3ff74f4b39693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649803290, "uuid": "d49073e7-0dc5-4a1a-b90f-46e5354334f5", "comment": "Malware payload (Gh0stRAT)", "value": "99476403c2f843b2aa27a3962332fab828173bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649803290, "uuid": "65ffc4b2-62d1-4513-ba1e-5773d50901ed", "comment": "Malware payload (Gh0stRAT)", "value": "5e865f15118c49cdd8e23b2b6c944f0582c1e6b4ded4377b6758d61120051260a2163ee32c2aee9b08b291565b8c8277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649803290, "uuid": "0eaaae8e-3eca-4997-9138-e7e4d7733a31", "value": "T1C7449F21B9C644F7ED15143050EA2BF7A63FFA061B356A87A71CCF291F23191663239B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649803290, "uuid": "59b693a1-b6f8-4ff0-a455-26f13f1f9285", "value": "0533f8fc6d242682a6c09fa97fd55f21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649803290, "uuid": "2bd0b465-5305-400d-bfd8-803edd8bc08d", "value": "6144:i2Rnh5EsIm2E/7RNYQRZSXGQY09inGogjB:ieh5EsIY/dNPsWX090NiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649803290, "uuid": "ac8d639d-0a6e-47d5-afc3-f7e53e279638", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649803290, "uuid": "4afcaa92-1c27-4a59-b4e2-ae5f344d8d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649803290, "uuid": "0b2ab67d-a04d-4fdb-b601-fba31bbf9318", "value": "523AFF6C7B173C89A3CEDEE34C8077A608D14654846BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffafcd4-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764524, "uuid": "975609e5-7b26-4a8f-ac7c-085af5e89ba0", "comment": "Malware payload", "value": "38cb6b651071036e10256c826f9846da", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764524, "uuid": "8b21eb77-a7eb-4aec-9ebb-0f1ffea4b691", "comment": "Malware payload", "value": "523d1c52f64d48840dcef6b4d7653a1a6ff3daa6b78008f11769032ef76a5046", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764524, "uuid": "c23f97fd-b443-4650-b809-be738754bc52", "comment": "Malware payload", "value": "75cbc4d6c7c439cf9f8342b2277320613bffee01", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764524, "uuid": "c2447dad-9683-43b4-84c5-782b2561d007", "comment": "Malware payload", "value": "45d4d3bee58a8adec7a2e4ba3d2649301bb3facebfddfb399714253d9c82a03aa6df94d3b6f4010ebe2fefb094fcba85", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764524, "uuid": "da64e717-2b3b-4cb2-b0ed-a099892cbaa9", "value": "T10E464B26B284A53EC49F0A7A5977A65CD93F7A716922CC5B17F4088C8F364802B3F747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764524, "uuid": "ae70f0ce-c440-4759-8737-2dc27669ff04", "value": "49152:ft7OY1R9K03sHPrQs7tMB67ySXuWIbM20M7CFOnadMNg9zbr/AxmlQyix9c/hTVF:9OY79ADYRmKadM+r/Imyyix+hFmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764524, "uuid": "f0601532-3858-41d9-b329-f74bb2733ac4", "value": 5389824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764524, "uuid": "bcfcc935-f02b-4948-80b2-478507dee7fb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764524, "uuid": "24748c5b-b6c8-47a0-9b45-3034ca226850", "value": "Fact.EndesaNow.Archivo.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1230dd1-ba0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649732448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732448, "uuid": "b2781304-40f2-4edc-bcb8-c2d76b9ec75f", "comment": "Malware payload (AgentTesla)", "value": "9b5facf58577919799d7137317d13d02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732448, "uuid": "a1e9e13f-0bbc-40b2-8fcd-e4211e57d6ee", "comment": "Malware payload (AgentTesla)", "value": "5258b47989843d7dd2548de441187fa1e5541cf37e93857fb599479481502584", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732448, "uuid": "75574ff5-7497-4026-a9b6-d94f42fe6c01", "comment": "Malware payload (AgentTesla)", "value": "1fa7a066d4d41895f0e5f0786c01148a54601b7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732448, "uuid": "44f49a45-6863-4a5e-8694-6126cb2bbe51", "comment": "Malware payload (AgentTesla)", "value": "4751ab0c4a4525aa98d70ef767c0c6788a86ae1ee22f0bf7566cea3fdfbfc45f20b678ae6f4b779966778ff329ea4d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732448, "uuid": "00dc3eee-88fa-4718-b068-f8f059d7bcff", "value": "T17EE4E1257AE88619E5FE07FDE074018047FA771B6826E3BC6E0560DA3D633D0D606B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732448, "uuid": "e96c1bec-a876-46bc-a406-7a4c50f2fec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732448, "uuid": "d2e55f93-67c5-4157-b102-4f31cd7920c6", "value": "12288:YkKUk6idB4qec4PQ2FL/0XQpjh54n7YsKLslCDoC0gVgz:YkKX6ideq94vd/E/MsKLN5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732448, "uuid": "fd6d3945-2263-47dc-96e6-54b1b705f0b8", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732448, "uuid": "1613d5ce-6f0f-4b0e-b1cc-1aad4346fbaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732448, "uuid": "3f07853c-333d-4f61-b721-7ad376788f0c", "value": "SecuriteInfo.com.Scr.Malcodegdn30.19469.13587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7cdfef-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767474, "uuid": "ed07882e-faad-4d85-871b-a9a91f214b77", "comment": "Malware payload (Formbook)", "value": "e5ed5c8ab5839398dd87bdfd6b489726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767474, "uuid": "bbe6c418-52c4-451f-81c8-dd065a8c01e5", "comment": "Malware payload (Formbook)", "value": "52a948983c37f9056c1c2701179cb3698eb8c077faacd622ba26aef8055388ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767474, "uuid": "09a7d30b-cf4a-4538-aff0-40899846cead", "comment": "Malware payload (Formbook)", "value": "4f72008c13d0cc8b8c2ad3c961887513f1cf314e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767474, "uuid": "7b8fb544-7acb-4f0b-8a2f-2da684efa069", "comment": "Malware payload (Formbook)", "value": "bbb4860aeaaba38c7c5488c55aed6cb074813db60c497a4a1bad579fba8db0dc5842f5b2236cf409be50e09ea836be29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767474, "uuid": "77a843c0-8f08-4058-ab32-2757cb6f7f07", "value": "T191D4F1257BEC8616E5BE13BDE474008047F6732B6827E3BD5A0560DA3D633C0D647AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767474, "uuid": "5e82b87f-26e3-4919-b8d0-3fda07f26ed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767474, "uuid": "83688c2f-3dff-4a82-8516-09ad572971af", "value": "12288:PkKUk6/Eu4qBacz0eT3a6dtMIGpx6S5LPu21lwNujGagVgz:PkKX6/EFqBaep7aqHGpxn5LW2cN71m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767474, "uuid": "25ba8c46-86c7-4727-9caa-a8823267ed1b", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767474, "uuid": "cc292a72-6add-4461-8933-038bd1f7622a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767474, "uuid": "284d1928-41d9-4a13-8d92-e14a020176b3", "value": "e5ed5c8ab5839398dd87bdfd6b489726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2206d4-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800756, "uuid": "226933f2-96d6-42ed-b574-379d2e820368", "comment": "Malware payload (Mirai)", "value": "cfd5c7727092e1db4e0724563fdf0166", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800756, "uuid": "3c53c175-0194-42de-b50e-136de404e2aa", "comment": "Malware payload (Mirai)", "value": "52acb52062d09f899abcc5d444fc6dc435dc367fca588525249861e47770dba8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800756, "uuid": "e6d08858-934d-4fac-bf99-6893bd623a8d", "comment": "Malware payload (Mirai)", "value": "79c4ebf1a2ada93431093afc0916cdcdef2253f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800756, "uuid": "9c6f55c1-369e-4e27-a6df-2f146b13ee2c", "comment": "Malware payload (Mirai)", "value": "8cd09976b4228cc07f3ea652a8756ede49d9f62ddc499d0a31269f058bec57c60a25f72c2e22aaa599bf5327086f5680", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800756, "uuid": "8c386411-c1d7-48b6-b823-9c150a8ab2ad", "value": "T11923F260320914B9DD71D2380B87479527B0AFF2B60F4C127E5BEBA7AD48CA46A437D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800756, "uuid": "a5b45d1a-648a-4894-91fb-94f8591e0551", "value": "768:2a3IhEr1TB0tOkA2pKx9DB/O3r0c1rmDahQzmxhnDy1bmSKJgGlzDpbuR1JEuR+A:xIhwahpgAr0va6yDksVJufAaXDHLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800756, "uuid": "1cedba96-acc3-45ff-b632-82e87ba499d0", "value": 49704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800756, "uuid": "c89ab802-6793-4648-9e16-24f7fee89994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800756, "uuid": "f54cb400-653e-4727-b239-d9a1240d949c", "value": "BDK.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0803d44d-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649764350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764350, "uuid": "db3a74f6-26e2-49c7-9fd9-7e1f41746e29", "comment": "Malware payload (AgentTesla)", "value": "da86850c0d9908877ebdf4298b436136", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764350, "uuid": "c550bc1e-7c33-4275-8ec0-a4d0d5703428", "comment": "Malware payload (AgentTesla)", "value": "52deb0e202e78ce40bc763ce24dbff67de6aed56299e03dd5b108a2fdd285387", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764350, "uuid": "9a46c46f-1f26-4f87-bb8a-236ceba6fc6c", "comment": "Malware payload (AgentTesla)", "value": "70077a6a00fba98ad885c5b7cc11f0dde4af4230", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764350, "uuid": "82135021-02b7-4fc3-a8b8-448170b4aec2", "comment": "Malware payload (AgentTesla)", "value": "036c089a92397553caaab48d69dda0865af753f06d341c92bd73d62b39a536fefd3ac8da3644af37e2e3f7a04a0c0438", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764350, "uuid": "e22c5885-55b9-48fc-b7c1-d26cd73a7c92", "value": "T18E7423847BFDAA8AF257503BB9A117CA51E2DD16133F00832E44B7EE983878D1E941F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764350, "uuid": "9c043c4e-7bde-485e-99b4-fcb221127ea6", "value": "6144:xeG+216x8or7F3tcUUJqzPgqdF7f+8QEW3eNVPEBLVjclksRT+Athtb9:xeG2xFZuUUI9P7fqpuncBxjcmsRT+8f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764350, "uuid": "1acf8ca8-8504-4e11-942d-2865af9abd10", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764350, "uuid": "5e867c97-fc95-4317-a6ae-ed6bc8e5db45", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764350, "uuid": "88fbde51-4c4e-4d8b-a8a6-e824beb8ae65", "value": "Purchase order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b438c9-ba0b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "ce9e7ef7-912d-407b-b414-c3e3666c4b01", "comment": "Malware payload (Mirai)", "value": "64282ba3d998f8c5ee950a9fbfaf6fea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "672dce37-9534-4c4b-adf1-5133b35a3edb", "comment": "Malware payload (Mirai)", "value": "53940948445312a939014425580fc7676bad1775a68b1c7014547138dbcedcd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "1c565848-47fc-4bee-9f07-7114d4b781e9", "comment": "Malware payload (Mirai)", "value": "4e67c15e1cc428848824d2f2eb72c989ea970815", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "a0122d98-f00e-4d37-ae72-8a3b4e712d48", "comment": "Malware payload (Mirai)", "value": "5038d964989ffcb6152c37bd18db1f4456c5a2ef7903fcb6bb6f012fd60184d28a8d8c23f54f159f9ea71190bfac58ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731811, "uuid": "491e1004-0a13-490c-b592-81a8b7363935", "value": "T1AA635B55FC919A12C5D01277BA6E168C3B2563E4D2DF3203AE316F612BCA82F1D3BD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731811, "uuid": "92993dbe-d726-4f23-9a2a-2ec07af6bdca", "value": "1536:vVrmJZEP1snP2S+QVprIUUmb5M2fHm+6da10q:vVCJGgdJVprFzb5o+95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731811, "uuid": "f9b9b041-f7a6-489f-a971-fa5f8106fa6a", "value": 67980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731811, "uuid": "aaff4c74-e781-4b0d-b705-0ee8e3be00f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731811, "uuid": "ccb3c93c-e3d9-43c6-85a0-7b9a324ebe20", "value": "a1mb0t.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6981200-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649744939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744939, "uuid": "dc9db6e9-79a2-4ecc-9c3b-8becbd5e0d23", "comment": "Malware payload (AgentTesla)", "value": "08d1b9a7ee3553ae4342d19ae5756114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744939, "uuid": "f6f45209-d76d-40f4-bf99-d9cf0b6d5a7e", "comment": "Malware payload (AgentTesla)", "value": "5458d741122b50434fe500c657d857bd85afcb1cfedf8c077eb866e586682aa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744939, "uuid": "33e71627-7352-45f4-9f5a-cd24994ac36c", "comment": "Malware payload (AgentTesla)", "value": "450860a380cf835411ea6096aac1a057b01cdc16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744939, "uuid": "53a4e169-03e8-453d-ac02-3f28299494fa", "comment": "Malware payload (AgentTesla)", "value": "5d599d168903a80df5c489119ac9553a9c0dc85b4de3318575c1957f485ae25ac56eed7aea8c63c10a30b593fab31cf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744939, "uuid": "60867b43-7c63-461c-8657-4bb68a64b583", "value": "T1CD250273BB56CD97CEED977C0831BEC693E182225257D74EACCC91A9B7826E85B010C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744939, "uuid": "5ecd28e8-c8a7-4e8d-b2e1-3f5ae562d715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744939, "uuid": "fddbf389-f99d-4418-b22f-e7e6a7726d0b", "value": "12288:km9U1UwBYXRC9wjZAafeugkVgNEU/RCww9VdCJpmXRQg4j8crXYl4lGZ0wr85Gxp:udBqCebfeuXVgO4Xw9Vdem54jn6ZTgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744939, "uuid": "047c007e-b236-4c37-ace0-e80b82f15328", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744939, "uuid": "4d599023-7a0f-4be3-809c-00ebbdbefbaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744939, "uuid": "e253cbf3-7d1e-419a-abde-f837af071f5a", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e1e5cd-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767059, "uuid": "a00628af-6d57-47d9-9740-dce7fa320f22", "comment": "Malware payload (Formbook)", "value": "67cf1c655c2dc9f48cf024ada40c918f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767059, "uuid": "c9bac9df-21a8-4f48-965e-535bd61117ad", "comment": "Malware payload (Formbook)", "value": "54a2f208d30012237286d747e0f9c5e9d85fc5a101ad24900b569e0ec341e8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767059, "uuid": "66acad35-bf22-4cad-a459-8e0bec84f3b5", "comment": "Malware payload (Formbook)", "value": "b8f3398a21a859a556869b24095907dd22fd588d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767059, "uuid": "c671b2af-67b7-4143-af09-a5ef7587dc64", "comment": "Malware payload (Formbook)", "value": "227ddbc990081b7d5c0f6db6deee99de229832847ad5feae0ebb384038dffba2438048581b5dc907c6e79fb5317cb5ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767059, "uuid": "d06960f8-278d-4a0d-92fc-0a2a5dc4e183", "value": "T16534121E65E0089BD2A012712B269A57E7B6873223113A3B379C4F653E735C3DE3D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767059, "uuid": "9232544b-c7f3-49d8-9da8-6e5c9bd279d3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767059, "uuid": "082e7245-9b7c-48f2-a8c4-78a448aab021", "value": "6144:8Qq+gd/d6EQcd+UPNBY0Z/84my2EKQInpBVR:TgFH/PPNye/84+tQInXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767059, "uuid": "57e7ee15-2075-4b54-98fa-e47116d80bf6", "value": 245311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767059, "uuid": "212beeb9-6290-4471-b7cf-e032844f783f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767059, "uuid": "571e72aa-6d0b-423e-96f4-00fb0a2e00ae", "value": "67cf1c655c2dc9f48cf024ada40c918f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f82cc6-ba33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649748960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748960, "uuid": "c863261b-3fc6-484c-9a82-fbcb1080df70", "comment": "Malware payload (Loki)", "value": "4031a8662f0885fe516cf1f429922cb5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748960, "uuid": "e4c51c82-aa75-4f1f-9775-f9cee39c7e75", "comment": "Malware payload (Loki)", "value": "5529008cab7aef34a4fc18d500963f41c9357cc0978b50c1cce177d7973767fe", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748960, "uuid": "53886308-e4b6-48c3-950b-926534be3d3d", "comment": "Malware payload (Loki)", "value": "d54ac036ca76a6c6c1592fd335ab3b67059fdd53", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748960, "uuid": "f68e1376-ce07-4f46-a816-1b925c8d0545", "comment": "Malware payload (Loki)", "value": "04233f0fb8e23ee8d831c33fd4b0d378675f3a886a6f2919c287aba1e3fef0f0534bf107d0b263d004b56a252197c3e1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748960, "uuid": "156191f6-1a49-4fe2-8593-c294d4ebb56d", "value": "T170741294B1F4E75FF5B3E632349B9C870AA7FE164E2E0267CE1573085532B5B630821A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748960, "uuid": "2e16c610-6e43-479f-a5ea-5d0e10b052e0", "value": "6144:gYT74iH/uWqOPb/5ntOxl7XTo8sdXYsTT0L4oQH0K0C+TiLkxaKC9zmsBh:tnd20z5ntmV6IsfQfQj0JTiLkuxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649748960, "uuid": "cf119199-3401-4c15-92dd-dab973557015", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649748960, "uuid": "5a29f045-90a1-4381-bbab-eff2f9642498", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748960, "uuid": "71614ba5-60ac-4871-baa9-b316de21a83c", "value": "Quotation Req.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d802b66-ba2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649745461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745461, "uuid": "3e5024cf-6117-4e55-b532-c3b4cdfcb793", "comment": "Malware payload (AsyncRAT)", "value": "a39263133644b7563e4ce346ffa96a90", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745461, "uuid": "07dae52c-798e-4172-b4f7-1bbb02cb1a40", "comment": "Malware payload (AsyncRAT)", "value": "55e287e19b6c08d2555133320f79df24db4ef1f09649f014a5817f890faf7473", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745461, "uuid": "e67f69ec-c8bb-42a9-a683-d7f6cf427053", "comment": "Malware payload (AsyncRAT)", "value": "d324b2ecfc4c2ed012692182d7bfa8076577b55a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745461, "uuid": "331cbdd4-bec4-4326-95ed-7bb94c520809", "comment": "Malware payload (AsyncRAT)", "value": "18a3bceb0a713272f7656d64cd6418f0981cd8db3e1b93ef1b2d80ebfba9c7f67a38303c6ea957d09fdbd94691fbca24", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745461, "uuid": "e1b1f004-3fe2-4702-ae31-bbdb619ed2a8", "value": "T19E9328D66B540B22CDE9073648E253301B77ED45AAF3EB0B789C72551F73F404682BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745461, "uuid": "948ca53a-0b55-45b9-aed6-5909affcd5db", "value": "384:pni/7h7+loct/n7kXHwVJffffft+SnJyXnLHHJCU8rUUvYxqS/T+zRmhmq3jb344:p4UewcW0LHB8rUUGruTgDYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745461, "uuid": "4cb50769-29c2-4c47-8620-05a6b2818b4a", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745461, "uuid": "24236a4c-f519-4aaf-9d82-e4a004afc48d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745461, "uuid": "7bc97b5c-a10c-4767-97cf-4ec60436ca7a", "value": "Scan_00210.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0e7ece-ba43-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649755953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755953, "uuid": "c034cd01-b78e-470c-8a65-deae1ef06dac", "comment": "Malware payload (AgentTesla)", "value": "c18f902d2726bff6470ab8e1edb0c611", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755953, "uuid": "ed4592fc-ba0b-4f08-abe2-12d3ea52b947", "comment": "Malware payload (AgentTesla)", "value": "56c25da39ec4535ede623c435f0bd0d36ec27cc7d50745f5857fa43fbeb50df3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755953, "uuid": "4e530f32-9fcd-4c5c-a805-f81476fb542c", "comment": "Malware payload (AgentTesla)", "value": "444b8d3e863244b9572f1d7be4c8c66100dabf03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755953, "uuid": "e6820fe7-d2b0-4db9-b91f-7681546ca4b7", "comment": "Malware payload (AgentTesla)", "value": "55dcab95c5c41bd2737dc592e1907a07529efbc92285cf9639e84d7eefc8a8a88b68fd08fcd5d90959fbb79f9ac52db1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755953, "uuid": "1956ba5d-b5fa-4c63-83e5-920e1eaa4f8a", "value": "T15CF4DF09F6A6CD02EAE81737C0D6080407B0A767E51AD76F379162ED1E033EB9D4679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755953, "uuid": "5c2dfa9b-772b-4ff5-87c9-91d628caaac4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755953, "uuid": "c85aceea-f50a-427f-af0d-ff5dd8e90237", "value": "12288:ZWpIRhlH04qOgutlZIa76oJMCRnR88kiVwyGJRzNeQq2I75cGIF7YBX9QAuf0g6:ZWpIDVPqJ62e6YMWIGwyCzJW30YBX9Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755953, "uuid": "489af744-c53e-46f9-acf2-74990d1d70b6", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755953, "uuid": "28d6093d-a0bf-46e6-a2e9-840f07a0f293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755953, "uuid": "7eb25706-7060-4144-acaa-1ef89f95d92d", "value": "awb9664762752_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f5a1be-ba31-11ec-8e58-42010a9c0032", "comment": "Malware payload (OrcusRAT)", "timestamp": 1649748071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748071, "uuid": "47f89050-7c9e-4ec2-87c8-c1f679c6ff14", "comment": "Malware payload (OrcusRAT)", "value": "16db11fed1b92345cbc154a5fb7f1fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748071, "uuid": "c3ddad6a-7273-4236-9180-123aac9754c7", "comment": "Malware payload (OrcusRAT)", "value": "56eb3543f20a9a454e6ffeddd38cfed075a23bc1a99e66cfd71c3eb6111182aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748071, "uuid": "1e568b12-9e09-4be3-9989-64249dfb6d66", "comment": "Malware payload (OrcusRAT)", "value": "9a7633da75cbdda08d35de85fb687ab1d4d58677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748071, "uuid": "6995e64b-b044-48d1-84f3-fc33962915f4", "comment": "Malware payload (OrcusRAT)", "value": "81525edc3b4842b509d319a897ffde0ebb334a5c20a1ebd528d8a2a7305ad58d6a1935b351983373b564c63db8f15a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748071, "uuid": "5a162d96-ab0d-485b-954e-4110406e57ea", "value": "T19635C0017BACBD46C0BE2AB472732AD90B75EC066051FA4F095472AD1DFB702BD26367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748071, "uuid": "ae086176-d5ba-4fbe-b07d-5b4fc42a0c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748071, "uuid": "a87af972-1227-4824-be47-219830b33c56", "value": "24576:b2A4MROxnFH/iJLrZlI0AilFEvxHiODsEYYYYYYYYYYYRYYYYYYYYYYC:b2jMiRKtrZlI0AilFEvxHic/YYYYYYYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649748071, "uuid": "3e0c5544-603b-4bc8-9786-00c026273a6f", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649748071, "uuid": "46ed4b17-7e49-4340-bac5-b131ee16d6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748071, "uuid": "5d44f009-cac5-44d6-85b9-b6619734fccf", "value": "16db11fed1b92345cbc154a5fb7f1fd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1261d369-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649764367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764367, "uuid": "1e16d00c-d6cc-4b57-8f12-eda389a1783a", "comment": "Malware payload (RemcosRAT)", "value": "353e0d90df22aa7cf94b356de139e118", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764367, "uuid": "f5a79c61-fa94-4849-b7d8-4b06b47297c5", "comment": "Malware payload (RemcosRAT)", "value": "572008779f0d6a9efac4e1e879790a2da95964f189b66eed98f91dd0adaa860e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764367, "uuid": "00e7b696-b638-4c5b-a287-21493ae81f66", "comment": "Malware payload (RemcosRAT)", "value": "60f6d04c4a49ad8e1ced44b3803cbaf8bc4593b6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764367, "uuid": "8898cc10-f9c1-4271-8720-662857bb390e", "comment": "Malware payload (RemcosRAT)", "value": "7fee4523f7acc400c7098916db9e90a219c7445282afd3ecb56e7a1062303ff9140729f78245a94febf30bff52b51e08", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764367, "uuid": "a1fc8c72-ae15-44ff-b84c-a7b741423b3b", "value": "T1F27412ABB6C4A397DA633033AF1843F0BD16AC166F04A5B763E53D6409B2F113E36156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764367, "uuid": "4ae7808a-21fb-4cfa-9117-aba19a1fc1bc", "value": "6144:7qvpHhq/wZGstmBhMWlAiBYE7i0RdGn1sRPE0nSrGY4AczB0mNz9:opKwZGQiicBH7RGn9XGY4A4amR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764367, "uuid": "7fb0e089-5f1c-4036-819d-56ea4c24e380", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764367, "uuid": "947cb957-42c6-444e-9d51-bb840b7f042c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764367, "uuid": "6258516f-32e8-4a7b-a9f2-ff111503bde3", "value": "Transfer Details 04122022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494f9b64-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800537, "uuid": "26db2125-0b71-414e-b680-900334ef089e", "comment": "Malware payload (Mirai)", "value": "2f878b8e46bb372ca185e467eeec536c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800537, "uuid": "9e011e30-d868-47ef-b5f1-3e83fd3b9c31", "comment": "Malware payload (Mirai)", "value": "575c3c8dde75df295333fd978cd052ddde9f01e5d29fbc64eb882bfe7a251cc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800537, "uuid": "2f209d09-d1fe-4a22-8dfe-443e9346be52", "comment": "Malware payload (Mirai)", "value": "6c570c8ba31ade468a2fcad1eccbfadf1a0b8d9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800537, "uuid": "e92e94de-dd98-42c9-be2a-9d632f8be4dc", "comment": "Malware payload (Mirai)", "value": "3c3488a10a497abe50570bd1817a5097cf1fac9bddaf23f0c46ed633d696520be4778d0b7c3d9fea5729552ecef03e7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800537, "uuid": "ba3bccf1-0151-4e73-b3b1-2a1e827a75ec", "value": "T138438E71E0196DD0C19943B46834CF794F23D9C096A32EF79BA442B5944BEACF609FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800537, "uuid": "faa9216a-da3f-45d4-baed-e20027b46435", "value": "1536:aaYU4k8EZVJJwjezisUfweCGR6na10Nv:atRs5UfweJ3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800537, "uuid": "2e22f603-6dc2-4126-bbc2-e4143dcde95b", "value": 59932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800537, "uuid": "e70e0696-f63f-4307-a0ff-88eef5ba4613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800537, "uuid": "3823028a-9153-41f0-aaa8-a19b7442e5a2", "value": "2f878b8e46bb372ca185e467eeec536c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22608c1e-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649766541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766541, "uuid": "98ac96bd-77da-4fa0-b1d1-bb6be2834484", "comment": "Malware payload (Loki)", "value": "6297c0ce6eb4c84940282e2ca42279f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766541, "uuid": "94c4be56-8675-463b-9d8d-705ceae105f4", "comment": "Malware payload (Loki)", "value": "5833bb5b323155bc7055ccec5ce39e093901b609ccde004f104857abca656c3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766541, "uuid": "319a81b5-48dd-4105-aef8-8015e1f438fd", "comment": "Malware payload (Loki)", "value": "0123e64d8caabd94e6e8268fd5d3ec9ab2d29673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766541, "uuid": "c7eb452f-3c82-4e10-9c45-187f812acb3d", "comment": "Malware payload (Loki)", "value": "f4eb8c2a67814d6567c0a68ba42d68610ecf82d6464621fe21e75fec871e9d29f2aaf1518d0b105e169666f043cd04e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766541, "uuid": "b52940b2-8727-4151-956e-78dbdc7b08e4", "value": "T14ED4BF05FAAECD12D1A40777D0EF28240BB8A642D516FB6F378162995D033EB890779F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766541, "uuid": "16e67f74-d883-4e3d-88ff-310a695a0acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766541, "uuid": "36d3ccc2-ae05-4a6b-89fc-c426545eeb16", "value": "12288:r1XT3ql+G94qA2y1KjJHKv6XMWepnUq9qoj9D8f0W5MMg2g6:hqAxKjJHKMWnUUqS8fr5Mnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766541, "uuid": "ac33f9e2-279a-4e3e-98b3-649331e80ccf", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766541, "uuid": "8df9dc28-0134-4917-854f-d731e96d6310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766541, "uuid": "9a99834c-0102-46e1-8606-dc0d8834959f", "value": "6297c0ce6eb4c84940282e2ca42279f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13739c8-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649777948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777948, "uuid": "d1fca661-3182-44eb-97b8-728f2762eb31", "comment": "Malware payload (AgentTesla)", "value": "2ee52bd6c5b191049507703145dac548", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777948, "uuid": "0815712b-f713-43bf-a50d-4c8ac4a030bc", "comment": "Malware payload (AgentTesla)", "value": "58c7044897f1567accb87bcca24a5d5ba4a075011987baadf6801e41bcf2423f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777948, "uuid": "414f02f3-9f04-4bbf-accf-e6a68fa621f5", "comment": "Malware payload (AgentTesla)", "value": "e9f72c085d07156e59487d1668adbd756229a148", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777948, "uuid": "d68e692c-626f-475c-9f89-471242d76437", "comment": "Malware payload (AgentTesla)", "value": "6d9a6ebda4d28980c3f309ee1fe140126f49561105075d58b1507ceb793493d861da85cb626c86a4b9ed8754a9a4ab67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777948, "uuid": "8e9c625d-3902-406d-a961-977b13c39308", "value": "T19D058C1233C84F4BE1BFA63AA564020193F6B5D7D771DB8E2DD116D908E3B408B59B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777948, "uuid": "fc38b97c-c089-4f4a-980e-a34e0604b78a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777948, "uuid": "9018bea7-d3b2-45dc-a694-acb1f0e7f5b5", "value": "12288:fRlpdKpipS5nXDnmbIIDyzIeoTHeaXZfboJfK4gCHBBLHNQ9YCynIFXeArHnLRKF:Oq50fXHBBO9d4ydPoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777948, "uuid": "e075befb-3b53-4205-a3dd-22ec07ec9d71", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777948, "uuid": "3d20c4bf-4824-4f39-b6e5-bf5301312cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777948, "uuid": "0a4b5613-a521-43c6-9659-da68ce1cb2b9", "value": "2ee52bd6c5b191049507703145dac548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bddbce-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649769391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769391, "uuid": "9b4bb5fb-1ec2-4c9a-b38e-c928e0840218", "comment": "Malware payload (Mirai)", "value": "2af8c4bd2d5608e7a3b9858461b1d1f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769391, "uuid": "6d5bdf58-f0d2-48a2-a2af-1a4783401cd3", "comment": "Malware payload (Mirai)", "value": "5939256999aa4acf54b832d324c626886620f216a0ff64000a25e5d647da8732", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769391, "uuid": "29e55ef5-4e3f-4773-a286-147adabd24f8", "comment": "Malware payload (Mirai)", "value": "7c4b5c617b5f35c7a046431314c5b93857ce1293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769391, "uuid": "be898123-5fe2-4a8b-8dbe-ffa9e2365381", "comment": "Malware payload (Mirai)", "value": "69c1bc08a5ea82be24bc7026adae5b4aecd5406c993bc3cd255ae6215908c6815cc5d128f2684c2a8df67c64a298cfdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769391, "uuid": "579c2e53-3a90-4f26-b064-50500652d7bc", "value": "T1D4D2E1016240FEE1D5B00232E8678A9B72257D79D1D134F78A3D0DF8E6E9A1D47F8983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769391, "uuid": "56429eaf-dc09-41e5-a5c3-894654d2facc", "value": "768:tusHfRavjynNKnjFcZIhQzhKMXgV9q3UEL72:9RwynNIOQQ1KMwoLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769391, "uuid": "0404787a-bf2b-4cb9-963f-479c7c67cb09", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769391, "uuid": "8f4a1c56-6a21-4d16-964f-4d27bd6fedac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769391, "uuid": "dcbcf96c-256e-4865-aaae-4f40c4808281", "value": "2af8c4bd2d5608e7a3b9858461b1d1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e11bb1d-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649793351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793351, "uuid": "b3835cfd-f603-4bf9-82b9-5dbf152d191c", "comment": "Malware payload (AgentTesla)", "value": "daa0e714f9ffc6e3093dff4cd6564665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793351, "uuid": "d930499f-610e-49b5-b134-18961cb16721", "comment": "Malware payload (AgentTesla)", "value": "59947d21463f7ae0146f0f3969fbc3f675d5e910d7c19529631774f56af0b2ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793351, "uuid": "b6049a0b-0163-459a-87e2-c85270771e8a", "comment": "Malware payload (AgentTesla)", "value": "219869517fa9affba7ac961f59295d060717ee89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793351, "uuid": "99cc7381-cf3d-427f-b71f-f5e8c9f60331", "comment": "Malware payload (AgentTesla)", "value": "b0c5fb889651213bf64657ba62df98334ac2095c60e34eb15cb06189a6a7a7f4c1d82d84b91b74328ae5893c90114470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793351, "uuid": "c0ee45fc-aa9c-49f9-b675-8dc38042c9c2", "value": "T1B2150110F7B29A42D46C0DF399A64A9B4B70C406D421C2CB3FF9354AC922F9B397975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793351, "uuid": "c9f4f0f4-9229-4815-900e-bf2bbc8c9c58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793351, "uuid": "df74cf78-9ef7-44b0-9dd9-831b5fdeaf67", "value": "24576:2/5zWIpAVNGY6juOJoL34OgtS70bk+ia:2/8IuOfOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793351, "uuid": "ef8c7d41-e941-4e4a-8a3f-f74388960d1d", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793351, "uuid": "d56055f2-36dc-42d4-880b-32184d5336f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793351, "uuid": "09e7ffab-8a77-4d6d-ab36-fc22c322c724", "value": "Buf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07da7708-ba21-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649741157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741157, "uuid": "cad6c2a4-161c-40fb-8f7c-05eec23e5d77", "comment": "Malware payload (Formbook)", "value": "5c244c79d184132ea8c2e3ad9e1f506e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741157, "uuid": "19e5307e-e581-4c72-be35-4d549721af60", "comment": "Malware payload (Formbook)", "value": "59c27aa1cff155341b66f050ccec3306700fdfe161f7446b17ae8e956296d0a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741157, "uuid": "9b1aaa7e-169a-4ce9-a432-420ffbd0fd3e", "comment": "Malware payload (Formbook)", "value": "a9273be35cbe0d0451a5ad288bbfa9e682231e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741157, "uuid": "50fe0400-5a68-4e1f-a82b-0c8011d08d23", "comment": "Malware payload (Formbook)", "value": "9bc0205eb890a49345087004d6c10d4ef4995b4fef0fc997ee2778b4d54f3f64492861602c38095abe403b0d274f8162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741157, "uuid": "ea79d930-7807-4cd2-bcf3-8b3b7595fd03", "value": "T1ED458DAC366171DFC8A7D471DAA89CB4FA5135BB831B520BA01706ADEE4C887CF141F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741157, "uuid": "aefdc1ac-9e28-47c8-bfa1-d2fd92181794", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741157, "uuid": "7dab34e3-00d6-454b-9b54-7d707bf07129", "value": "24576:qWNwTHYBdBqCebfeuXVgOnZTgUkqHfBjUk27JwuG:KTHSdBqCafeEVVZTgUkq/BIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741157, "uuid": "a3ce8440-6394-40f6-ac4f-986d63fb1dc3", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741157, "uuid": "de4194cc-a3f6-4860-bb54-71bf69a0e3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741157, "uuid": "9103f244-2ad9-4ab8-873f-9a5142a96f4b", "value": "Payment_Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aef95d4-ba7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1649779924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779924, "uuid": "50a787ff-0d3c-47ae-8bc4-9ec52300b9a3", "comment": "Malware payload (BumbleBee)", "value": "8dbc3035b9bb7ba4e7cac241038d239a", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779924, "uuid": "d96b28d2-5f45-421d-939f-b09c903681bf", "comment": "Malware payload (BumbleBee)", "value": "5be0c2df3f2dbca7bfbe77a8eb96abc472bfc6a566aa26cccd8e9937f446dad3", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779924, "uuid": "4c8f1fb4-ba8f-42ac-ab89-e4f4a3df9fcb", "comment": "Malware payload (BumbleBee)", "value": "dd803a0e41bdaa2c2d6ee86bb0dfa288da788bce", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779924, "uuid": "1701e413-7210-44b6-8fbd-a113082c4df7", "comment": "Malware payload (BumbleBee)", "value": "951f83fbb4c597ecafcd82bde4c10f667622e0a82a75475267374053a028e123f1468f2dc0a93f7883eb0ca4d01111fd", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779924, "uuid": "d998772a-040b-4308-beb8-f6819ea73180", "value": "T170D5F18D89378859CD2126BC2C6F63913F9D26DED8C887770358ED357AA243F60CA974", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779924, "uuid": "64286051-3244-4bd9-92a0-eda3b94700af", "value": "708e5362b020437910496bc30e1d0517", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779924, "uuid": "d8045f81-d35b-4348-945f-32001cdf7f16", "value": "49152:Uahx4O5E8i+IPSliaD9N0Hq5R+jJaRzj4t8MzSRMpENkyk/priDTnJK:fxy8i9snaq5R+jJaRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649779924, "uuid": "cf4300ed-dd60-4b68-a933-1ca5c57ba348", "value": 2935808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649779924, "uuid": "7228b9c7-f620-478b-bae6-6b65d2d372dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779924, "uuid": "c3896573-6a1b-4791-9d50-c846f49fab55", "value": "autorun.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c77421a-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764518, "uuid": "38af7f50-43f4-4488-afd9-f5738b35eb45", "comment": "Malware payload", "value": "bdd7033b020dbfadfb27674a4328669e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764518, "uuid": "47baee1a-119f-42d9-a7d2-bf4a81af6428", "comment": "Malware payload", "value": "5c53bef858bbade5f97b8359ba6081574209802b5daedc8bf200cdbcb64c2aae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764518, "uuid": "b422605a-bebf-4251-a3df-7c5cd05b140e", "comment": "Malware payload", "value": "7e0a62465c8f0de741bdfe3848da6a29b930143c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764518, "uuid": "16c45489-014b-4097-851c-916bc9992f22", "comment": "Malware payload", "value": "0205a26a6b01f3e8c90e7d74cb35388b289e44b59c65fe67b9f6b98675d6cd2fdd0904484e29d4973f0b30c85e95fa2b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764518, "uuid": "c9c81e27-e364-4e4b-8d5f-2a76da761b32", "value": "T13B267D26B244613EC0AB1A3B593BE758993B7B7139268C5B5BF40C4C8F765403A3F687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764518, "uuid": "a6d12368-2942-423f-a72a-201c6ced6bba", "value": "98304:QCov1EL86Oatc7BH3rmMq6fm1fitvOY/A:Q3v145OaW53rlO1iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764518, "uuid": "020de3b5-aac9-479c-9026-810246d2b50c", "value": 4645376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764518, "uuid": "008ede36-c958-4206-9850-dc082f493c03", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764518, "uuid": "e183e175-67d3-4cac-9dcf-4cd78d5ed34d", "value": "Fact.EndesaES.Archivo.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94f38ba-baa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649796081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796081, "uuid": "a5f0039e-17da-463e-beda-11c6fa5df1dc", "comment": "Malware payload (RedLineStealer)", "value": "92fe1e18683b661e054b8cd6068e6633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796081, "uuid": "ad4ddf3b-9ca9-4d0d-891e-89eaf27149a8", "comment": "Malware payload (RedLineStealer)", "value": "5d3bfab0a36f78c6d14878a9a5dba9fd896a9d515aa5f7cd3b9dc5587bdd9a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796081, "uuid": "04b2679c-55ef-4938-a64f-fdf657887bdd", "comment": "Malware payload (RedLineStealer)", "value": "ac2d3e3c1097d015712e585bdb4f74bc1fb689d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796081, "uuid": "e18dd891-c488-4547-9e80-e7e678c1e387", "comment": "Malware payload (RedLineStealer)", "value": "e3c33cefea48765618915da2c4053430ed5c26c8745545dfb8a9919ad54cd26cd6252c81b3c6b51e7a152913ccba754a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796081, "uuid": "cd241db1-0638-4a0a-bd74-474e5fc96675", "value": "T17774CF10BA90C039E5B712F44979D7ACB93E7EB19B2454CB62D56BEA17342E0ED3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796081, "uuid": "cae7818b-2080-4df9-a663-4c9be178a74c", "value": "64cca9e1e2de2d3835f36bbdd76fe0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796081, "uuid": "5b1aac92-7b40-4d52-a106-bc2ac9162c9d", "value": "6144:4CUqyZUHKvqC9wq9lRU2+dbVWRSEMR1uiWJ7bTW/hVY4v7ELkb7BCo4j8:xU/Uqvd9wI+FsMfyiW1q5VoLQBij8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649796081, "uuid": "9edab9a4-ecaa-4e0c-91fb-5e6e7ed2ffec", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649796081, "uuid": "71949ccf-15fa-43dc-bb23-c3316b39a080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796081, "uuid": "75deef39-a0a1-4dc0-9501-1260964d3cd1", "value": "92fe1e18683b661e054b8cd6068e6633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81542021-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649766701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766701, "uuid": "fa88523f-2af0-4847-9613-e71929c8328d", "comment": "Malware payload (Loki)", "value": "266f741a728d3da63df6733396e4a1c1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766701, "uuid": "c38f1100-448a-4cfa-bb63-f0fb6907483d", "comment": "Malware payload (Loki)", "value": "5d49f41af791b10750d3e24b3e26ed0c525b6a01b21419c4c6a8ecfd6078a7d0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766701, "uuid": "416621d0-fe42-4091-840d-2909d093e2d7", "comment": "Malware payload (Loki)", "value": "6987b9941ff2be09d8da06703b5b23b7fcf2d173", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766701, "uuid": "3bed7cd7-d805-4d2d-8256-9a1a3fa88c2e", "comment": "Malware payload (Loki)", "value": "7d6147a2e854e00384f0bf61844fb5c17b2f1aeb1ae0c23ae91167f76b762eb38695083bdfda49c35b9e97e8611f9887", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766701, "uuid": "4b9cd8d3-9d92-4d95-93c6-ac1e8ed4f67b", "value": "T108942304C7D59F2EAD8440B7EF24C7C840A37193A18F2D892B7CB97960DBC5E51AE99C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766701, "uuid": "91e012fd-951e-4d65-a078-7e84cf2ff440", "value": "12288:z8XQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8UW:pwarmMSAGMID1R5OtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766701, "uuid": "b53406e9-3371-45b5-bb32-0c70297ec688", "value": 441474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766701, "uuid": "ff426078-2143-4808-b7f3-8b000e433357", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766701, "uuid": "b4dba60c-99d0-40ea-8235-28135893577d", "value": "PACKING LIST 7654374687.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c01ffa1-ba61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649768839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768839, "uuid": "d8a5bf22-d7c3-4376-ab98-fac0501ea8c0", "comment": "Malware payload (Formbook)", "value": "5ae2de3b4300cd54975d895226aba95e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768839, "uuid": "0e1e9afa-09d4-4fa6-85a8-8cb31e86c062", "comment": "Malware payload (Formbook)", "value": "5dc9070d1dc877f9e8ace969af0861dcd1eec7b8d942c7fa2f76e7d67d5bba88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768839, "uuid": "2db8a0ef-ceec-43e6-8c0f-da812d50847f", "comment": "Malware payload (Formbook)", "value": "f519531e8404cf26d04d3f1e7264167c69e72140", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768839, "uuid": "2feea27d-c807-4a13-a835-1f12df77bf1b", "comment": "Malware payload (Formbook)", "value": "798763f943f3f9e8a37a44b475ac19acf343bc17e4f6f52aaab16233f74551ff88fb7732a7f2d4196587affbe6a4e1ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768839, "uuid": "4f47fcc9-9142-4d4d-acc7-de4ecf518caf", "value": "T11DF39F32DA42C031E2A252F5F6791BBB883E0D34375560A6E3E619E16EE05E5F42D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768839, "uuid": "c8a2ac6b-9ef2-422c-adae-c9ebf6c8e25c", "value": "3072:qbspZpl2C3evJuBMG3D1NauZNHgm9ySEUbUzWx/j3:CippeyMGTTrZNHgQcE/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768839, "uuid": "9d4db45b-8ab3-4a06-b9f9-e25fd77b67c3", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768839, "uuid": "d2d3be59-060e-4f80-a35a-30edf37b1c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768839, "uuid": "6a310eca-ac14-4c53-b607-388bd3be4bb7", "value": "5ae2de3b4300cd54975d895226aba95e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0705d9c4-ba86-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649784534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784534, "uuid": "d9ca8e9d-404e-47f4-8a4b-80f4c4e53eff", "comment": "Malware payload (AgentTesla)", "value": "11f1c7d468b3e82c0074cdb4ea08b342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784534, "uuid": "9745c53a-8495-426d-81fe-d2b7f6e9cbb3", "comment": "Malware payload (AgentTesla)", "value": "5de977d82072d555bd3fb9fbb09d9e0db7218d88f4f1b63a322cc3ea982e64c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784534, "uuid": "45123fc3-4778-4898-872f-ed5079601db8", "comment": "Malware payload (AgentTesla)", "value": "592a4680801b9c159c0164f983837386ccf4cff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784534, "uuid": "54679e2d-35b0-49a8-9c19-573c78d31378", "comment": "Malware payload (AgentTesla)", "value": "4d1f70f9e3dd30b75b0f45f9029d2a3775a3986c304df3051ff3a446e8d9aba8c059a6c2a8872e808e097f4dae47d108", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784534, "uuid": "dd8a5174-6952-46d7-8a8c-413e8150f569", "value": "T139C4F120F2A96FA5D46643F40930B20517BAB75EB53DC6196CBA71CE58337C32622E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784534, "uuid": "b0e85606-dbde-4d53-a1cc-457c6eb900cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784534, "uuid": "f0026bec-3d18-4583-ba02-4c763d0b7fea", "value": "12288:uwgR4qiSxIi1cW1AmA9Fvhgp/VG/t/pVeJ06MYGJILW8fmdgS:uwvqidcEmAOlEPEK6MVJ4XS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649784534, "uuid": "17cdb3e0-414c-4216-844c-ffedfef406c8", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649784534, "uuid": "ffee53ca-e5b6-4d9c-9494-0541082e5a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784534, "uuid": "b22ea964-c5d8-48ba-99fb-31af651697ef", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d30a571-ba2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746051, "uuid": "400192d0-5ce8-4c0c-83f6-d4c5f123ac91", "comment": "Malware payload (AgentTesla)", "value": "f77fc14241ac3a34bc6ed4902428d3e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746051, "uuid": "49a446e3-0963-47b4-8785-fa038db3ca60", "comment": "Malware payload (AgentTesla)", "value": "5e4dce0ee64d9e4828b56c4d63ce1122b314f629b91fb534f63318f7cf3bde54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746051, "uuid": "a7247de2-fd95-4ce7-be00-cde13a73cafd", "comment": "Malware payload (AgentTesla)", "value": "a18735757df1ce582c53905a4cb7ccdec4579ed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746051, "uuid": "1fe9ffd8-1ad7-42be-b997-f27c013991c6", "comment": "Malware payload (AgentTesla)", "value": "00ffb62f940daef18b02f68f4e2db255f0bbeb3821d61b078d7b20dc317c10c893418357b1a80b7d902b060d2673ba7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746051, "uuid": "c20a2855-4c1b-4b37-bf97-623528cde1b7", "value": "T1874423EE90B3BADD3822854225C30F829F5D4B12E5CC50DE6DE3329D36A49EA70957DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746051, "uuid": "1ade1c03-9f9e-4736-a9c1-69f74cfa9bb6", "value": "6144:mr2c0iqZgG6jzihp87GwCh874mFyjcftHTCumeV:mrn0bp6qhdww874mzVHT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746051, "uuid": "cf5415cf-69f4-4b6d-b86d-121d36e9af6c", "value": 257506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746051, "uuid": "fcb902ee-338e-4b96-a2ee-19885e72e9ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746051, "uuid": "c84bc0dc-ff3f-4e57-9023-9345f3596850", "value": "Quotation.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3833afa3-ba88-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649785476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785476, "uuid": "6cb1b41f-827b-4472-844b-905d536dbf2c", "comment": "Malware payload (AgentTesla)", "value": "b9b2cf7105a682c568fa5f9fdb9aef36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785476, "uuid": "58088f68-c4a4-4dc4-ab12-e817ce7c7616", "comment": "Malware payload (AgentTesla)", "value": "5ebe10d64ae62294380d7be2262bd27e2c404c10b3df579a58a07c5aa8ac42a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785476, "uuid": "3560dc33-c99a-4a1d-aab9-049b676ca0b4", "comment": "Malware payload (AgentTesla)", "value": "436d4c682419ce561da7d0bcab543370e967b6b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785476, "uuid": "8a8892a5-2dac-4841-b570-37597c1e2d7f", "comment": "Malware payload (AgentTesla)", "value": "8f29409d563b892ab588002f625b2a65878fb2b271a18af4f2ee7f221e6fa4e6e232c522c077ef0f7d663ca56e1515f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785476, "uuid": "767268f5-f553-42f6-a6aa-e3ecc2365c90", "value": "T11DB4CE91DA5066D3D0515BB4C8A2CCB037F5B39A812CF7997CB9BA452EB11C2E011FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785476, "uuid": "2701faf3-add1-428f-86b4-eb5c3dd20022", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785476, "uuid": "da0fa5e6-2d83-4f91-9236-f9f392109f3c", "value": "12288:G7+EJrxldZHU+K2CefuQ4K5vYm/tJKvZHCz:GjDU+K2CeWQ4mLKsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649785476, "uuid": "d548f27e-1c97-457a-8e63-2abb11e20db1", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649785476, "uuid": "610dbff8-893c-4a11-8efa-38f697afdcec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785476, "uuid": "0a16031a-07eb-4fe0-b04e-5608d800d0a6", "value": "BL-INVOICE SHIPPING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52207e5c-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764474, "uuid": "1549a592-9b84-42ba-8c05-3ca85ae9f73e", "comment": "Malware payload", "value": "7fdef95bf31a4cc174cfdcdd8f71bd3a", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764474, "uuid": "36ef5f09-a480-40a7-9cf3-c639599db84a", "comment": "Malware payload", "value": "5f1beab27690a8ea9b9be78c5d34dd852dd3af4f5128feace84d1b2e10d73b59", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764474, "uuid": "6acb8ce3-116d-4384-914d-28fb02c0154b", "comment": "Malware payload", "value": "4a7ca745cf7d3d4ca206d544afef1892efa5b0fd", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764474, "uuid": "3312ae1a-fe77-461d-ab37-ad641c60f2d8", "comment": "Malware payload", "value": "61b6a11cd82fefb3844edde8b390b1f8185d102b7a6203ec2c30e5a5335fc009df0661107ed06785d525e1d96c09f2aa", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764474, "uuid": "d5ecf554-e6f8-4147-b483-96e88c89b982", "value": "T167C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764474, "uuid": "4b279916-8605-4a7a-98be-5d0af133513f", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764474, "uuid": "af12f573-d07e-4afb-a866-c5ee802008d7", "value": "12288:Vn/zDvGHAykHSzLW/4+8bzbBSreMdzsgFK/UqW:ZzbGHAzHAjX1NcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764474, "uuid": "5e795378-0b16-4c83-9281-681b3173f682", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764474, "uuid": "fc6c2b63-8b4e-4602-8177-775fec9a47b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764474, "uuid": "26f64730-31c2-4bb8-9376-fb84b76084d7", "value": "PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278b6dbb-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649766550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766550, "uuid": "c516b780-0ddb-4167-9c11-de6c180afd74", "comment": "Malware payload (AgentTesla)", "value": "e910b3100b7625654adefa8b4ba3d4be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766550, "uuid": "54228e5b-a445-47c1-b65c-05fb0ff74cfd", "comment": "Malware payload (AgentTesla)", "value": "5fa21d45a8b8150fa278d16bfd918344bbd3c102318d0e35b53d10a412b9e21d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766550, "uuid": "04b1ec95-c6c6-48c7-b038-f4358864a6f8", "comment": "Malware payload (AgentTesla)", "value": "b62c421f830e5eb1e19837e658e7aebf78efe51d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766550, "uuid": "96650e62-8b4c-442d-ae58-e92046bb130f", "comment": "Malware payload (AgentTesla)", "value": "689672ad3e8ec6101ab9269ba4419d7395f209e7fcb28648be254808a9a457ca78aab37dab04a4b35d5eac928596699d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766550, "uuid": "5b74a0b5-be9f-4032-bb8e-a0b88442f902", "value": "T10515BE09B5A5C906D199273BC5E6C8340BB0AE43C516D72B36C1BE9B397B3EB8903357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766550, "uuid": "3e8f0e21-d9ec-497e-892c-62eee9bccdae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766550, "uuid": "2763ba96-add8-430d-80b0-c083223a2718", "value": "12288:q7BwT4qKg8P8n3uxS5Gaf7o7zrDYMsd3lZr99xklvc4mg6:oqlo8nexGHGDY1d3lj9xklvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766550, "uuid": "96e7da29-6012-4907-a771-60e04b920cbe", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766550, "uuid": "40384525-ebfa-43be-b534-5514ba799226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766550, "uuid": "a2f888aa-6c00-4139-a5fa-8936dd216a3d", "value": "e910b3100b7625654adefa8b4ba3d4be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9752e64-ba21-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649741481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741481, "uuid": "6deecb56-06a0-42a6-941f-e8db573a52ef", "comment": "Malware payload (AgentTesla)", "value": "dc8340c9875e763b90bb58d4654233b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741481, "uuid": "7808bb12-0b36-44a2-8172-47923f709f5e", "comment": "Malware payload (AgentTesla)", "value": "604883f675359fcfd0a2915294076c1a9db5e3d541a2183ee77680d5809da18e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741481, "uuid": "40fa5818-a980-4b89-957c-b66b57a84807", "comment": "Malware payload (AgentTesla)", "value": "12e3c4f70c520602d504b70452c27ce29ad74bfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741481, "uuid": "4195590f-ff57-46ca-96ee-203710f5d2ae", "comment": "Malware payload (AgentTesla)", "value": "0cfb34ea9722aaca561aeae15d2804bb3b3e7b39d69a6703f6d82c3bdaab8be1a435817f5fec97be542e04a12a375c99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741481, "uuid": "4c1a0e08-c8c2-4398-bbe0-a2684c6fb99a", "value": "T110E4E12165E88615D7BE17BDF831408087FA3E276816E3B85A85F2D52DB33C08E467B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741481, "uuid": "9ad943dd-1fc9-42c2-8aa6-fb58b5f0eb91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741481, "uuid": "bd30e7d1-0d42-499f-b6f4-7094a5b632d6", "value": "12288:JkKUk65WC4qfrHhs/zYy4KeNjknGg465IoAS+h8RJh/0jgVgz:JkKX65WZqDkmKeu+wdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741481, "uuid": "0dee1363-268f-499c-b3cc-5ea003440e4a", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741481, "uuid": "f10b0863-cea4-4241-9554-2c44eeed0819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741481, "uuid": "8e249dfb-87de-4c07-a80b-e52ee1d531b6", "value": "LPO-20257723_ Al Laith.doc..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7457c253-ba51-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649761954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761954, "uuid": "f6abc7a6-76bc-4a28-895a-5479cfa758d8", "comment": "Malware payload (AgentTesla)", "value": "15256edf673b94791d93beb6b0ba37a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761954, "uuid": "4c0ac1bd-d829-45ec-9edd-e3b422499d6b", "comment": "Malware payload (AgentTesla)", "value": "6089d7ba70f244a12ba0ffd4b4634c021af493c0a2a2b5da709814b1e3a6eae3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761954, "uuid": "917fc2ca-8adb-45f5-83cf-119b561b7db6", "comment": "Malware payload (AgentTesla)", "value": "7056d179b5968f986a7fd6c1a22fbee020469965", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761954, "uuid": "c6e68b39-74d0-4be8-ba0f-431000863970", "comment": "Malware payload (AgentTesla)", "value": "4599335a31c44719d6eb9e48f3b7953527b2a6f962ffb341ac72b8b34040e1a9df5ea5473ca8a2319c24a8a8c7c37c7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761954, "uuid": "776317ba-09cf-4afa-bfce-ede9cd72595e", "value": "T104741213F36F6257C46BC1B64F9A8F2AE758DC54F8BE6106906BB64B4C3EB5808C11B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761954, "uuid": "cdb1b3bc-627d-4c50-819b-e631a4eb3637", "value": "6144:v5ILCCHeRnhSUgOHT3RfJExc7IV784g1Nr/7GCELswOj:vkCgWhjg0+Oq7/g1Nj7GnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761954, "uuid": "9ee3db36-5c4d-40fa-ae71-a9a90eb264cf", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761954, "uuid": "768cc84c-a04b-4e0c-80db-26b76cc36a9d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761954, "uuid": "7a1246ec-36fe-4af2-b371-c912db9ba316", "value": "PO & Listed items.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d59588-ba88-11ec-8e58-42010a9c0032", "comment": "Malware payload (DanaBot)", "timestamp": 1649785572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785572, "uuid": "e2fb2c5b-3193-4c2d-bb35-0f10edc3519b", "comment": "Malware payload (DanaBot)", "value": "1323af5b087a2941e31817a98c035269", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785572, "uuid": "28a06693-fefd-4053-acf8-52d4cf1dfdf9", "comment": "Malware payload (DanaBot)", "value": "60db5de363585fce685056cde11796f4cadc79c861e39475ebd9bb2b9c6e8117", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785572, "uuid": "c83d481a-2829-406e-9cc6-e15c13a53cb0", "comment": "Malware payload (DanaBot)", "value": "65e101144578c32a03614039e2e6b3c04900c98a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649785572, "uuid": "a171e7a1-bba2-4836-966e-77d32e4dc07a", "comment": "Malware payload (DanaBot)", "value": "423252201e5a87df9d7e4c8c46530656b2e6d55270c397a899c9e33fc4c6c11e1886251b06a6f269ff3747f4189d287e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785572, "uuid": "5d0afc95-5182-4f2c-ae0d-fd2611449db6", "value": "T11C6523A771F0A033E8E2673449299231AF3BF9317975768E324B172D5C32197B869347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785572, "uuid": "6ae2143c-22f8-4d84-9f08-1a2797681309", "value": "26b26928261074d44e9adf8d0ef2ca63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785572, "uuid": "bf855afb-d318-4998-82f1-ee08c53482c7", "value": "24576:nh/zUcZvv7lYzZRWLH3FmOVn4aSbve5lKC45w0/+4wfbS921EELfBenM1PYDBaD3:h/zVlYzWr3FpQbWLKbr/+7u921EEN4MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649785572, "uuid": "66b7054f-c0d4-40cb-aaa2-2cfb4caec8d8", "value": 1451520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649785572, "uuid": "e4b9d377-5cf1-4192-92a8-d0c022be7a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649785572, "uuid": "51f181b4-4444-4bb8-bd5a-ca5aa3526b09", "value": "60DB5DE363585FCE685056CDE11796F4CADC79C861E39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beba40f4-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649769381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769381, "uuid": "b1c40815-635d-4a39-92b5-9c3553a1babf", "comment": "Malware payload (Formbook)", "value": "3ff6b7fd37c7eb05c8fcc004a4f67326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769381, "uuid": "e5bb7733-1f2e-43f0-b8f2-7d33380b55b0", "comment": "Malware payload (Formbook)", "value": "60eef6c0732cc31a3d6e8ed204fc38b7d0786cf9bd12f9d472bf09547d08150f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769381, "uuid": "832adbf0-a479-4679-87b1-84b8048bb2bf", "comment": "Malware payload (Formbook)", "value": "756b40e514c526cd62f9a3abe785c0038952d64c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769381, "uuid": "60b6bcf3-17ad-4109-8b58-a60903a0ecc6", "comment": "Malware payload (Formbook)", "value": "0f2bbad681cacc7811b80c9ae4655bd5e9cc2b83801b3e1559247d29a59df2eb2fcdaea514f791566e17e4d409a52b9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769381, "uuid": "64eedea1-c175-4cd6-8bb9-d4cd7e1c6478", "value": "T14074011962E0FAEAD40A8E315CEDFD1BB2F29D451220693FD7157EDA1633342C25263B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769381, "uuid": "8f3ee65b-7bd2-42f6-9585-20f77bfba077", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769381, "uuid": "8b7846ba-b7d9-43ae-8151-0124cc9e66e0", "value": "6144:HQqPk1nHxFByfHkjsKXu1XRVpBIrdjvafx4m2m14:wReEACIBdIrdjvafx49v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769381, "uuid": "378245b1-6f09-4142-ad20-9be70036764b", "value": 346718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769381, "uuid": "9c59877d-38c5-4673-a54e-6e41a619a74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769381, "uuid": "1b481ecd-5d00-4994-b0a3-988cc1fd0847", "value": "3ff6b7fd37c7eb05c8fcc004a4f67326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796626d3-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649744783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744783, "uuid": "07b2f397-9e51-4b31-be7f-03728b1d68dd", "comment": "Malware payload (Loki)", "value": "3a697f2d928b3e70f30d729a279a417d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744783, "uuid": "94a0c714-7d43-4825-bd17-a7c38f6d7c25", "comment": "Malware payload (Loki)", "value": "61193fe0f1c3304394123d448eb42efca1c2d7481c93c0b0633a6a85596e5d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744783, "uuid": "f7d5dafa-484f-4e0f-a963-930a103757cf", "comment": "Malware payload (Loki)", "value": "8cfec0d9ab3dca02fa45300682810f655b029666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744783, "uuid": "b5523b9c-5dc8-4a72-aca8-6e2e648a09a2", "comment": "Malware payload (Loki)", "value": "f02d5d48e795a425ee10af331250d27c5f83b7dfc4a6853cc9f9713f453b91f361c7438e6d35440ead10c30e94a51d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744783, "uuid": "d02102a3-aed6-4462-bf69-444de28b8cd7", "value": "T19CC4E03D518C4E6BE67956BDC0C4878047FADD2F164BEBB4A440B0F6AB63371A91B087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744783, "uuid": "a51f394c-20d5-42c7-b299-efd9e7b7f4b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744783, "uuid": "61c0775c-a03d-4ceb-9afb-6b8736a62614", "value": "12288:d5qn74q6+lgQnUvESbNNC7ErJr8yQAYnLRmwIgVgzr3y:dDqblbU1NC7Em60NTm/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744783, "uuid": "74975ea6-4cf4-44e0-a1e5-f15526155a8a", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744783, "uuid": "3d0fdd47-c094-443f-836c-8ff6cc624df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744783, "uuid": "39942f0e-8562-45ca-aa72-0d4cc90ee892", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e72b626-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649766562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766562, "uuid": "47869824-8a6e-4dae-ad5a-e5ae6e0d2a60", "comment": "Malware payload (Loki)", "value": "3ee0c8dbb2f6f45fcb5c1a8aff011050", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766562, "uuid": "9487c6e4-9e2d-418d-a1fd-3b5c03f0f415", "comment": "Malware payload (Loki)", "value": "61a5cfaef59b713038cff49e78e1fcc93f65502f1006b030503804642351e96e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766562, "uuid": "2b1f9ae6-f0d2-48a3-ba70-9a3da5898e40", "comment": "Malware payload (Loki)", "value": "71d1b29c8310c640a6843fa85491d08cdaec18b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766562, "uuid": "c66e558d-89a5-4d43-9384-0efe7b0ac297", "comment": "Malware payload (Loki)", "value": "3873c66ec860eb408efc1572b13c51db4389f1230beeed2a4d0a0e5a96b16bd4969ddf32bf594cedd003aacfeb33678c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766562, "uuid": "b8c4c9c3-04b9-46d0-97e2-726d1d9248b1", "value": "T11F34120A32E148FFD9160570953EEB7BF7BA73042E63215F17A54E3E1C51AC316366A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766562, "uuid": "6331fce6-2986-44a6-b947-c8d84a4a90b2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766562, "uuid": "48201a58-25f2-49d2-8a0d-6e1f15c213dd", "value": "6144:8Qq+nXhhmkW90RtW/ewQuhXLxry8EjatsIFPOl0l:TnRhmkW90vWxLxOvjatJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766562, "uuid": "4839334b-875d-4316-b2fb-72d63fda4574", "value": 236050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766562, "uuid": "824ec35b-5ad5-494a-b739-1386df7fc2b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766562, "uuid": "75a2ffa5-5389-44af-a0f3-56e6cd634069", "value": "3ee0c8dbb2f6f45fcb5c1a8aff011050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fb9e1d-ba2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649745178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745178, "uuid": "fc29bade-f268-45f3-8bb8-b4b0a9e1f47e", "comment": "Malware payload (Formbook)", "value": "a96cb7fbbede0a670c50d9ae2691d585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745178, "uuid": "29ff7828-3bdf-43b6-b92c-b296642d9201", "comment": "Malware payload (Formbook)", "value": "61adbf6dd879e1f04ae94ef4bd432b45a72be4f77e702af4014fb57f1bebd2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745178, "uuid": "71e72c5a-ec45-4d3d-a180-78b190b9b6f8", "comment": "Malware payload (Formbook)", "value": "bc6d6ad349caf19f39911b6762748b54c0bb3c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745178, "uuid": "38a75f52-4094-4ae7-8a71-d461c9c02298", "comment": "Malware payload (Formbook)", "value": "4d7dfd0166c8deeb8811554f940d1502bd0fb6f9a2f579e49314b7aeedbe2aab9348a6e550e811eeaf08c351ed36d5f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745178, "uuid": "14171e52-ee71-427a-a9f1-d668c5ba272d", "value": "T14A75398DA282484BEE81D376DDB36B30A75896755C594B0793B4323FE4AF3685F40B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745178, "uuid": "5cbf1a9c-1bd3-43f1-ac0b-0f00bda50e73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745178, "uuid": "e494a1b7-27e1-49e0-92c2-0aecbb3256e2", "value": "24576:KOumSAXsoZUuKGQ83HZLzxRZ9G0Z2I5zbKr51Atj76Eh:KOrhLZUuKGnZLTZ9FZfbKr51Atb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745178, "uuid": "3b91bb9d-0d96-4eab-9ccb-d05abc9e2e28", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745178, "uuid": "124cdfe7-a95f-4ea2-9bef-4f04c531a91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745178, "uuid": "5b482912-a354-42f2-afb2-aaeef7eb51c3", "value": "PO1707693ADXVB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495a3aa1-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764030, "uuid": "b07b5786-cfae-4d07-bf6c-257eb56dc39c", "comment": "Malware payload (SnakeKeylogger)", "value": "fb9e52df6e91ba95f6df958edd2bb145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764030, "uuid": "ce68c022-2897-4eeb-8cd7-6c7b1def8b23", "comment": "Malware payload (SnakeKeylogger)", "value": "61fb1c02c279034e3c816ec46d9c06364db7ae68f98f535ad7f200cdd6e74365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764030, "uuid": "259d7162-ce33-4064-bc5d-64d691c80d43", "comment": "Malware payload (SnakeKeylogger)", "value": "477b599e8fa9c33dd808a6dc8f8f5dad8409a4be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764030, "uuid": "421eaaf5-70d9-4444-a932-059a3040b3f0", "comment": "Malware payload (SnakeKeylogger)", "value": "5886c99831470c50bea45387b1fbb9c1b8d2f48750ed8864bcee41ab3b8dc74fb2f73c76d2c91c19dbec0f867aea73d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764030, "uuid": "ffa686e7-9ec7-4b63-8b1c-0d3dac3d204d", "value": "T1F7F47C2233C84F5BE1BBB679A660460103F6BCD7D622DB9E2DD136D948F2F408B15726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764030, "uuid": "7972bffd-0dab-4450-b240-b189f9c7a715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764030, "uuid": "fefd1989-98b0-438e-96cb-b3f7c36a54ac", "value": "12288:ZcoYKvg3FHKUjMPQ1bAJPfC9B+3yTsdWtOMTsmfv0+wz90dealboJfK4gCHBFzaW:jy0fXHBdal2k1oYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764030, "uuid": "565ac06b-fec4-4034-8e1d-c63f07bf8c89", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764030, "uuid": "df9aa482-79ce-4a08-92f7-e8029bcbf929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764030, "uuid": "fa8cdbfa-fd5d-42a2-8a2d-fba16ee00731", "value": "PO-EP70002DL-APR12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb624f2-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "ee0e10b3-d089-4137-9e29-de9ab70a8703", "comment": "Malware payload (Mirai)", "value": "3052af4b7dc2e4dfea69b162e14c34b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "39351005-93b5-4ce9-b088-8ac61019ae0f", "comment": "Malware payload (Mirai)", "value": "627143d4765bd3e52364c5882388c64d6c363b95d13b5f73d58a11cbdd67f303", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "bacff635-97e4-4fc7-b7ab-05b1e1d1bf75", "comment": "Malware payload (Mirai)", "value": "df3d27a59bee2c8cf0339dba9d731c8c85271f81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "1cad6e0f-24ad-40dc-b0bc-2139d22a4c58", "comment": "Malware payload (Mirai)", "value": "cb7debd4ec3c2d638fe24242fa53b4b122d99651de801ae75af7a98cd89a5d2e9bfb07b709306664634828379235d002", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "e4b5f522-31f1-41c7-a7b8-d2eb141c360b", "value": "T179A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "25c5cb2e-e965-4dda-bbae-8c81dcea653f", "value": "3072:wW8FUmgujld6Mkxm6AJ+4f9HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f9HmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753404, "uuid": "b9dd9393-f771-456e-a6d6-05c1f830b338", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753404, "uuid": "66328465-75a1-468f-ba0a-602a863c442a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "14982e5e-9f20-4b0b-8154-55717fe4cd0e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d6df40-ba37-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1649750629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750629, "uuid": "6184cb2e-e587-44ad-abcd-aa73006d3e16", "comment": "Malware payload (NetWire)", "value": "dc0cef93b21ec7ff964a380ad44c8ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750629, "uuid": "e171826c-c442-4036-9166-bdfe9d50665b", "comment": "Malware payload (NetWire)", "value": "62ac5c039f7f5a46dc32172a5782f8d785efbd2eb5a1762abe5e3d05f0cbdf04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750629, "uuid": "7ae46e54-07cc-4cea-834d-684499a3f276", "comment": "Malware payload (NetWire)", "value": "8f974f956866640000371994a070d93f17752ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750629, "uuid": "f5ed3688-8d35-4139-a54e-939af9729d86", "comment": "Malware payload (NetWire)", "value": "0d773b769e6a07a3808b291f4daecd55434a825d0cf36827ed375df48b3f6f77c464d09405cb25a3b819a7f7a8a4474f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750629, "uuid": "d259f4c4-9221-4c97-be66-84caf87da131", "value": "T1CDD4E12576EC8616E4BD07B9E47800D047FAB6276826E37D5B05A0D63E633C0C647BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750629, "uuid": "d73eb81d-7105-4def-846d-e95217f252af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750629, "uuid": "05287f1c-61a3-49ca-b8d3-10abf2ceea9f", "value": "12288:1kKUk6cRl4qFhZ6pc7Ksm7U2Jqr5EcBtkRbDKPFoIGbiCvgVgzL:1kKX6cRCq/ZEsufsr5EOChDKPSBiCYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649750629, "uuid": "72c16e02-574d-48c6-b4c8-3d7b71878a18", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649750629, "uuid": "af08d5a3-14f0-4023-99f3-660b58a1c3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750629, "uuid": "7a657e21-2571-457b-8d9e-dfa11a0e787d", "value": "PO-068697975-9798-Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aff3df3-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749805, "uuid": "01c8a2a6-3562-4467-96a4-b174371fdb78", "comment": "Malware payload (Mirai)", "value": "9bb03439f858e04c40769eac8a713aac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749805, "uuid": "e3694830-fcce-473e-a65f-b0e754729677", "comment": "Malware payload (Mirai)", "value": "634c7c99b2e476be5e47bcaa5f3600b7668483bf0975da437f78225220f5b839", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749805, "uuid": "3a67dd7c-a7d7-4934-b4f0-0c935866b098", "comment": "Malware payload (Mirai)", "value": "a8d8745750c977948d30ebfb1555888fc73e88ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749805, "uuid": "d9a69e00-c3c0-47aa-aa8c-ea5a53420d00", "comment": "Malware payload (Mirai)", "value": "64f851e30dc1d48b9f2db2f718953dcd773011308463272b5f5961fa9f43032e6c0ee71d5dbd1c1781e868164bcaa971", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749805, "uuid": "1894ff21-f6c0-41c3-91f2-88aedc045f55", "value": "T15323F2124794F451D33AD9F6D068140BBF6D6D3DC2BE34A962AD83996810F5321F718F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749805, "uuid": "53ad10c5-ba11-478e-aba9-54d9f7f2be78", "value": "768:AHq8Y4Ip76Ny2zK3gjMYa6s1ui19q3UEL7yBZUXBxSf+Q:AHq8QJKyp3gwYuu3L7zxM+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749805, "uuid": "4e2308b2-dc37-45f7-a0a2-4f15fc5a8ee7", "value": 46840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749805, "uuid": "6f4bca4d-c292-44a9-b3c7-b18b63d191f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749805, "uuid": "6ada3792-a4e7-4023-af55-d38c8417c3ab", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6160b182-ba44-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649756339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756339, "uuid": "fbc32d1a-51e3-4efa-a97a-31f48fa4f72a", "comment": "Malware payload", "value": "ca882e8e236ac2cc20e84ad05bf750af", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756339, "uuid": "8ed959eb-9841-4002-bb5d-d58689d3a7f1", "comment": "Malware payload", "value": "6454fcd514024503c3c857a4d55de0de56a02f722d5ba1c741aeb6af409d8277", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756339, "uuid": "e54c6ad7-81ed-43c3-8e60-6dcf5c78d734", "comment": "Malware payload", "value": "22ad7d65327ade261a6708c74f281e90d91a7ab3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756339, "uuid": "b4d50be2-f7bc-4a21-8b60-b5c961d250d5", "comment": "Malware payload", "value": "6fb9799d0b02efb556765c8667bed7f74fcf1738bbdcb3cb29e344178c8d088c3ce1837ac0ba73e2628e0aec8eada81f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756339, "uuid": "e9c7e6b7-d982-4759-ac03-b5b153e1731c", "value": "T14F51C01016E10B08F3F29F7ABC7BA721493BBC56FE228B8D0180514448B2615D975FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756339, "uuid": "60e8a79a-6b3f-4ca8-bc84-01837a7ff458", "value": "24:8W0FF6VkWjNxHKR99WHdFUW5+/CWGeS+rZS+68SiZSXddNXuHY8CI5KDxm:8W0X63jY9QHkXqdLXuH+I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649756339, "uuid": "698912e4-4509-47d0-873d-8e46a9d37bdc", "value": 2485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649756339, "uuid": "d9b7e715-e988-4a4c-b77c-24b548a9addb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756339, "uuid": "398d89c4-7e72-4c45-813e-31f94fcc124f", "value": "6454fcd514024503c3c857a4d55de0de56a02f722d5ba1c741aeb6af409d8277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07fdf3d-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649741976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741976, "uuid": "b058d389-c783-4471-b4e7-6d687dda82b1", "comment": "Malware payload (Formbook)", "value": "46f5401e05e03fa1f59a6b89fcae7e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741976, "uuid": "1ca52997-35ec-424c-b529-c78e31429607", "comment": "Malware payload (Formbook)", "value": "65af000633f7295c3fe288dafd34d42045a99caeef78568ecf0aab2a07036ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741976, "uuid": "1f5e06b3-1dc9-419d-b557-5c10cc4e167f", "comment": "Malware payload (Formbook)", "value": "4bf9cfbb9d10f277014cc0a9711da9f0849146ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741976, "uuid": "c0fbcf18-bbdc-4834-9f46-a95ef0466b06", "comment": "Malware payload (Formbook)", "value": "b8a6efb82621223085d733863520258f9bd4099bfcfb2b7119aabb3e0850f7a016fcb7a69d86dae4189e06836a906965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741976, "uuid": "6902a2b2-8390-40ff-b411-b09ff9acb8eb", "value": "T14435F177A756CEA7CEEC867C0431BFD2A2F182139253D74EACCC91A9B3826D857051C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741976, "uuid": "dba84e7f-53f0-43c0-8d8a-de7b7f0d86ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741976, "uuid": "2ab3c7ce-eb57-4e12-ab9d-a7ebb72594b2", "value": "24576:ddBqCebfeuXVgOnZTgx4LeiMakNREZbmR6Ao:ddBqCafeEVVZTgx4a2kNREtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741976, "uuid": "66f2fd1f-095e-4adf-b168-20d7963a133d", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741976, "uuid": "14b23e1b-cda7-4db7-b685-acc6e5e04999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741976, "uuid": "8a6733c8-5f7e-4916-868d-e31b9a71d3ae", "value": "Request for Quatation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbdb91e-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649744628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744628, "uuid": "e9ffe72a-3b5f-46b4-b974-407c1af234a9", "comment": "Malware payload (AgentTesla)", "value": "f685cc98cbedead0c76cf0c96aa91e4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744628, "uuid": "7a80b28a-0f43-41b7-9e57-339e3179981d", "comment": "Malware payload (AgentTesla)", "value": "65c94ac106bfbfe35255ccfe7e4eec4c2a886215e399b06cc479317d485b9a5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744628, "uuid": "e207e5a3-e6b3-4991-83a8-a4a59ce0a5e8", "comment": "Malware payload (AgentTesla)", "value": "078b96f92e23cdd2fc37b7774707143034a41715", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744628, "uuid": "f602f405-9db6-455e-a2b3-fe05f235f7af", "comment": "Malware payload (AgentTesla)", "value": "63f654b539d515e1e2edbf1236bd7e05035c521b4ad7d25fb60721f65a25c467435120444834d73d8c7fb4804f150adc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744628, "uuid": "d8c18594-6b56-458e-973d-c1e1b73700c4", "value": "T106353301194B184E31F8F70CEB916E6118890F663736B929324FD91A7FF4E952E899BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744628, "uuid": "4bf65cae-aa90-4d57-bf2f-723c85cff942", "value": "24576:OzY6+fg0djZPfeJ2JJx1dCuZStIIq/rs1UORfXpLOO:e7+fndj9feGJDfZeq/rs1Vd1OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744628, "uuid": "bcd0321d-3c74-43b7-8dac-a81aa0c5154d", "value": 1071091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744628, "uuid": "dadd4997-b70d-4f72-9659-240c72d23a62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744628, "uuid": "9c5b18b0-e36e-4712-86a7-87d55b6f47c9", "value": "Order#-01172320202505.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0931adc4-ba3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649751896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751896, "uuid": "39c5234b-fdb7-441d-b26f-a02f4916ba05", "comment": "Malware payload (AsyncRAT)", "value": "f15d2f674b920601af6154ee5d4172c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751896, "uuid": "757e31d0-955e-43f7-95ae-299710978b87", "comment": "Malware payload (AsyncRAT)", "value": "65cec0c5f24c6be7fc9ead8e5b1e232ddd06036bdfe9902ccd7884341ceaeb94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751896, "uuid": "7bcdcee9-eb39-4b54-b95e-35cf7605daae", "comment": "Malware payload (AsyncRAT)", "value": "7ca0086e01ea66eb4cfcdcc7edd7e67589173c1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751896, "uuid": "aceff58f-d8e3-4cbd-bd4d-e25271e7c7ac", "comment": "Malware payload (AsyncRAT)", "value": "f87abef87a648d8335b49ec7e35d3c12417e7496ba6d4f4f49c75bfdf11208b94a34374772514dead4dca7dd4d25fafb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751896, "uuid": "0b53a85c-2f22-49a2-8d9a-f4a07493f1a0", "value": "T133D4F1DD751072EEC85BC532DA985CB4BA607877834B9213906B1AEDDE5CC8BCF210B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751896, "uuid": "eea06874-9b08-4ce5-8204-e878f622c311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751896, "uuid": "2b6600c4-62b9-4098-97d1-4617d2cc86a6", "value": "12288:fihQpZpeNFn0nq9XGE0ZQQOcDTbkhaUGualg/3tszZEzoJhzrEPrT1ry3:ldE7q5ualg/4ScdAPvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751896, "uuid": "f814d5e9-eb7b-40d6-acd4-c69a90495020", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751896, "uuid": "61dff69b-3319-4bf4-841e-a8bef536b01d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751896, "uuid": "7a616b28-7312-42e6-959c-e8e777868c9f", "value": "f15d2f674b920601af6154ee5d4172c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7ab739-ba5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649766369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766369, "uuid": "17c9aedf-9ec7-4622-90a1-1657c3b42186", "comment": "Malware payload (RedLineStealer)", "value": "f6c01d882a004b44dac33cdab3c86eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766369, "uuid": "1280c313-f5ad-489d-b361-80a96d84e562", "comment": "Malware payload (RedLineStealer)", "value": "65ef6adfb666a45e55ba073a32dac18f67a74ae4f3c7f68ac967df5c88d8da43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766369, "uuid": "a20a1454-1b58-4dbb-883a-da4ab2397fdf", "comment": "Malware payload (RedLineStealer)", "value": "d5efe57d03b882b95362288211ffb48c0fa47935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766369, "uuid": "a107c6f4-6eb2-429c-813f-893fa7ffaa4d", "comment": "Malware payload (RedLineStealer)", "value": "f67dec80ba7d5ff911501243dc3e493b53308aab93d96e32ddc648828f5cb18749f94789b1da7b8f3eaf03c0a6573220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766369, "uuid": "c20fe98e-2c89-4ce0-88e7-caa85be30cb1", "value": "T14384CF10BAA0D035F5B722F449B993ACB93E7EE06B2454CB62D56AEE47346E5DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766369, "uuid": "ac7b70a1-3403-4e56-8b7e-8eb6f2cfce32", "value": "b2491f91b932b5e67844520efb025825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766369, "uuid": "0026c30e-84c9-4308-bd08-75b9515e221d", "value": "6144:SU2/mZHBD/6ZVAoUEyl2u3i/RDcls3ClkPNa5Dye3txvrC+F7tl:x22hD/6ZVunl2Ki/lXCke9RrC6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766369, "uuid": "d930acf3-2142-46d6-a3e5-54098b3ce855", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766369, "uuid": "22dde616-7bc5-47a9-a8e1-704be986262a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766369, "uuid": "617b6ff0-0efb-4024-807c-e046c9cab361", "value": "f6c01d882a004b44dac33cdab3c86eaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebdc2ed-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764039, "uuid": "a6701ee3-32cf-40c1-86fe-2893e9314d87", "comment": "Malware payload (SnakeKeylogger)", "value": "9fe8405e54a22f83ce23fdb8e5b77665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764039, "uuid": "f796b8cb-0947-4f5d-a190-27def32a150c", "comment": "Malware payload (SnakeKeylogger)", "value": "662c1e809df32ff6b0192ccc0b4b7d699f7d909a3b96639bccdec62b7a3414c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764039, "uuid": "a07b5be0-fd37-4a6a-b4bf-36bd980b17f5", "comment": "Malware payload (SnakeKeylogger)", "value": "354342d0464bd217695a76506c6d058f6250e3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764039, "uuid": "ebef3435-5ebf-4f14-9e5e-09dab61eb340", "comment": "Malware payload (SnakeKeylogger)", "value": "749cd7ef65a53424a5b8f0cdee010b2adb120595dc1c2e8ef7202cce36d8ba52a87535126bbe1465464399f0aa50454f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764039, "uuid": "94cd5a9e-b662-4772-9a49-06eab0d6f5aa", "value": "T108C4F11276F88625E5FE0BBEA03441804BF6721B6817D3BC6A05A0D66D333D0D757BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764039, "uuid": "02cc0b66-d9f5-42d1-91f3-b4536cd6b98b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764039, "uuid": "ceeb101f-5696-4ffe-a173-fab01b465476", "value": "12288:tkKUk6JM4qf8eUEVbOnKCrq6GY1G1OKI8eK1Qs2BsgVgz:tkKX6JXqEE91saTIRs+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764039, "uuid": "e58af88b-a683-4fa6-a306-3fb4a8f2fd5d", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764039, "uuid": "1657cd04-081c-4e10-917b-313532a97ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764039, "uuid": "f1b6b46f-8cc5-4581-8f5b-21a77b12d31d", "value": "KW05200000032220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a91d886-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649744597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744597, "uuid": "de1a3608-3229-4c1f-96b9-9140eb34c5f6", "comment": "Malware payload (Formbook)", "value": "685ae832c25a89cfee7f7065f04cc156", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744597, "uuid": "4c703a23-b47a-4f0a-aed2-14e42f15a27c", "comment": "Malware payload (Formbook)", "value": "6662354a5b587a741b664cbe2bf97b72861cff3711cd4f576cdaa33cfe6ae960", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744597, "uuid": "915ddcbf-fff7-4a9b-a3b8-065fa0fbff62", "comment": "Malware payload (Formbook)", "value": "92296a2f9087f1cf5c8702e1ddb0131014ed3f1a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744597, "uuid": "82b79724-217c-4be4-93c6-f2e603cf2eb6", "comment": "Malware payload (Formbook)", "value": "2bd4bc346902e41f9ab702df71a33ecaaea7b63c4bd388d486f5d8cdc2496d9f45e86430ac9c2710456570cebbbbf7b6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744597, "uuid": "dacb9d10-116d-4719-b49c-87377dd98254", "value": "T1AB2533683B6E35257D6163D2A735483C40A219ACC4947688F8DF6BBE97E330C63F2853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744597, "uuid": "db8c03b8-cc4c-4f0b-9e93-04a52bd5d158", "value": "24576:sxluEX/VmhnW1Xmh0DvQoFQ9vV8InFu6RVhr:shvAkTvQPnFHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744597, "uuid": "d967fc17-6cf6-45b7-951b-fb9bf26ca5c9", "value": 1038914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744597, "uuid": "d0cbab34-14ec-4b62-821a-51e48788547a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744597, "uuid": "97375bf7-ef57-4565-8cf6-90932d1e703f", "value": "Order pdf.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0d991c-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649747933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747933, "uuid": "c2f06b8c-ec18-4e20-b862-79aaaeea70bd", "comment": "Malware payload (RedLineStealer)", "value": "3398f5a056893f76f7f469c1b3c7d6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747933, "uuid": "e64258be-25df-4b8c-a128-f2ea5be988f3", "comment": "Malware payload (RedLineStealer)", "value": "669b6267d544cfcc209644981ec0467488b92bc3c678b8ec8ba81b23ac53eb1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747933, "uuid": "4d6d535b-5a4c-4d3b-a2c6-6b0def455c2f", "comment": "Malware payload (RedLineStealer)", "value": "659026f15e61227f1fece89202782dea7582a6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747933, "uuid": "f7db943b-1d53-4a33-8018-5d66ed0e12b5", "comment": "Malware payload (RedLineStealer)", "value": "7155a59f326742acc8034468cbbb3cf11cc7baded27df1bcb3335214b4e7e744d5996f468da26f057cb3182ee54c9f50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747933, "uuid": "c0975703-fc78-472c-b2bb-a4a10ae83e3d", "value": "T1B315BD1BA7ACD816D476D4B5D86BCBFC7620BE05E923C56B06E43E0FB9F0118E461E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747933, "uuid": "0778c9b6-3fb2-41ba-923a-69ed573a2d21", "value": "d04ed91a8a9530e367695a96c2b2aaba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747933, "uuid": "4c9e3b05-3302-4fcc-813a-6c97c5c32872", "value": "12288:rFKaAhBQdQd2Ghk12PLQb0g+nb+Pp7d0UWAQjo5oKTEwm6tCmKDZhj:BPAhBXz5PL+076T0kO6CmK7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747933, "uuid": "4a4a03ae-2320-4f24-a691-9d629eb7b089", "value": 961384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747933, "uuid": "8ca9be87-f69f-42e7-a2be-504f3d245fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747933, "uuid": "c6e71073-e33f-4545-a3ba-60af50810587", "value": "SAFlashPlayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736d5828-ba3b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649752504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752504, "uuid": "0171c068-0ac8-4c72-9966-76c11cce06e3", "comment": "Malware payload", "value": "960c329c14af06cdfd51daee9b718939", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752504, "uuid": "4615ffe4-330d-4451-a9a1-ba49c4d0df11", "comment": "Malware payload", "value": "66da64babfb374c75775916da4280dc95c8570841c2a292f9102e8a193f92270", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752504, "uuid": "250d137f-f2fe-4ba8-bd23-3c5af73013ed", "comment": "Malware payload", "value": "61f9356483444a77ef5e191b9b8bf5df5b4e287c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752504, "uuid": "b995821a-9420-48af-b0c0-647e5defbcb1", "comment": "Malware payload", "value": "aacd3e858a89d5dd1a87a18d2180bd554d239094c2e877725d916b9491a5fcdbfe49df8051914b45f3cd8ab2256cd006", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752504, "uuid": "9f4a6612-8c1f-4fe4-bdb0-6866bb763752", "value": "T1E1834B0348058B8EE01592D5BE171E986B1E7738F4C279FA2C1E4EDB7E50A61DC9F12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752504, "uuid": "3789648b-70fe-4955-816e-08e842d5a130", "value": "1536:hV0LSsoA6ZY8kgqszklf7l1bezr+mJUXHLAXpexkt/awROO:hVqS6OFkgqsOpIr+mOookth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752504, "uuid": "04239791-9638-4133-9145-28436d989b5f", "value": 82164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752504, "uuid": "e4ff4e05-7dfe-465a-82bc-988a54ad9713", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752504, "uuid": "f7abc915-9849-44e8-8652-9316fe9caa0c", "value": "66da64babfb374c75775916da4280dc95c8570841c2a292f9102e8a193f92270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e838148b-ba64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649770309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770309, "uuid": "06cf4baa-79ea-4ae2-9a7d-1598799cdb08", "comment": "Malware payload (Quakbot)", "value": "80413378373701da3e295c2448f679f0", "object_relation": "md5", "Tag": [ { "name": "biden58", "colour": "#00699C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770309, "uuid": "67d12837-8926-496a-96af-9e9179d6edae", "comment": "Malware payload (Quakbot)", "value": "66ea4e853b7f209bbbbf31698ef5198d6be99a117389873e9b81cd7c7eb8573c", "object_relation": "sha256", "Tag": [ { "name": "biden58", "colour": "#00699C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770309, "uuid": "438157a6-8a1b-42b7-8f9e-fb28af76ab48", "comment": "Malware payload (Quakbot)", "value": "048965d229624bab424603df107902b7a5fec638", "object_relation": "sha1", "Tag": [ { "name": "biden58", "colour": "#00699C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770309, "uuid": "7ab1b53f-4bc4-4b07-b29b-eec1aba553b9", "comment": "Malware payload (Quakbot)", "value": "cdc60f6eead6ca519ffa4ea015cc3a10cc4cda7b883dfd3014ac5c64ad0c4add2c999c8551dbb2a8ee21bebef8fa4f1b", "object_relation": "sha3-384", "Tag": [ { "name": "biden58", "colour": "#00699C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770309, "uuid": "732b0742-6c37-4ea2-ba4c-6166abec6af5", "value": "T10B45C061A2C365BAE0733678AC1B71A0AC18BF506C17DCCC67DC0A5E4F6A762372525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770309, "uuid": "932feae6-863e-4647-91f9-98eff33ccafd", "value": "6ac6a43e4db55fe73c9f1e5d528a87f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770309, "uuid": "7f65645c-c196-41fb-a51f-df4b085c36a8", "value": "24576:qiBx2cd+JhzPQKnvOrn+xVsCeeDDVhE6mNTld+90bY9:qiviQKnvOabsZEDjhmdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770309, "uuid": "330861a2-d0ac-42a3-b87b-a28ce25f42e1", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770309, "uuid": "465e407c-274c-49a0-b3fa-89e157d457e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770309, "uuid": "b9d0947a-b1f5-4957-a951-04bec88c173a", "value": "66ea4e853b7f209bbbbf31698ef5198d6be99a117389873e9b81cd7c7eb8573c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3776af8-ba6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649774167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649774167, "uuid": "15c868f6-ccea-46b6-945e-8eedf7207bac", "comment": "Malware payload (AgentTesla)", "value": "0d8d924f2c1cc96aeadc449f3a3abd12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649774167, "uuid": "ab8b5cf0-9c89-4a5c-a6ae-46b95cdbbe2c", "comment": "Malware payload (AgentTesla)", "value": "67678900448a09a054f19537f6b290247d506ef97b6636bbc3c5141ee1b198f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649774167, "uuid": "518ae8cd-7030-46a5-9d10-61b8099a529a", "comment": "Malware payload (AgentTesla)", "value": "4b262e0c97d0304ae70916363f38454bccfefb3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649774167, "uuid": "c60646f0-1713-483f-8b9e-674937e06431", "comment": "Malware payload (AgentTesla)", "value": "db4e7a6a2b2c623e068301bad6da52c9debb05cbbccc5a27b68bd20aca67c2e0837c5a368b659b42272ecf68351e4395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649774167, "uuid": "b674f0bf-1f61-47f3-9bcb-2abf4a4eb6b4", "value": "T10C350273AB56CE93DDEC9A780871BFD2A2E192229247D74FACCCD175B7822D847011C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649774167, "uuid": "35ddc97e-4ebf-40fe-9fa6-8707b34b0020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649774167, "uuid": "d5caac04-3809-4cc2-8e50-205442b3b038", "value": "24576:QdBqCebfeuXVgOnZTg390FtWWEye3qt5e:QdBqCafeEVVZTg3eFgWEN3qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649774167, "uuid": "570e824f-bb49-49c6-bb74-5f4163bf4313", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649774167, "uuid": "d5bab86e-e8ec-457d-92b1-13090d8d6784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649774167, "uuid": "7cddabd4-23cb-437d-9239-3ac210f3ef8f", "value": "Due payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cceddb-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649767406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767406, "uuid": "cbe726d4-30be-40f6-bb77-2fd0f1ad5452", "comment": "Malware payload (RedLineStealer)", "value": "15414b57adcee133749861b2e9eece99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767406, "uuid": "597b520e-abb2-4e74-9f07-abddb36c887a", "comment": "Malware payload (RedLineStealer)", "value": "679992075a6091645499fbb2164d8537b3973a73f9f72019d8cc4fe6e4a1eb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767406, "uuid": "e8960167-d179-4966-bdc4-e034ddeab546", "comment": "Malware payload (RedLineStealer)", "value": "177a9b2093355281ae89fe62ffc58dc5e0961d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767406, "uuid": "872ca7d9-0c2a-40ad-aae1-b83fe79016c9", "comment": "Malware payload (RedLineStealer)", "value": "a539a9bb1bda7dbbefff929aab5572a6bf8ab618076328bd4fb7d7483f913951d7b79842aad6b6bb168131db8db66dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767406, "uuid": "7b025c10-af72-42fb-90af-0143d080569a", "value": "T1D484CF10BA90D034F5F752F44ABA83A8B92E7EE19B3451CB62D56AEE17345E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767406, "uuid": "6a471bd9-110e-4427-a23e-d27f6d3af530", "value": "da226befdbef45462493cbd252b0858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767406, "uuid": "9093bfc5-9da2-4cc6-8d47-f9bcca441c5e", "value": "6144:cUlOqWAohUrYc4cT21fUChf9JJUwJ2Yfb1iOeJyKz96viuESN:jlrUUrx4cTi/hf9A3eb1IoK5uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767406, "uuid": "d453b09f-74ae-43d9-8064-0a5c530a95b3", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767406, "uuid": "ca510306-0aa5-418b-9bed-4dc195189789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767406, "uuid": "ba4c72d1-2c5e-4f2a-8961-da70d96e00c0", "value": "15414b57adcee133749861b2e9eece99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a4ea64-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vobfus)", "timestamp": 1649747615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747615, "uuid": "6b36dc0a-4c0f-44c4-a8a2-94e7d8abbf09", "comment": "Malware payload (Vobfus)", "value": "822eaa4933acd3e589d667c20c75e0e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747615, "uuid": "eed1572e-6165-45f6-9a86-3c4f352cb634", "comment": "Malware payload (Vobfus)", "value": "679b59833167989d593dac6d7b8db3020d1d254f1695e74c31bb1b522c958171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747615, "uuid": "15a69358-7545-434e-97a3-bad14e367c50", "comment": "Malware payload (Vobfus)", "value": "4e33ad76cfbaccd19d7aeaf297540d5780e15a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747615, "uuid": "6a971a73-8e1d-45fb-b398-eb123358f490", "comment": "Malware payload (Vobfus)", "value": "0662e52abc98975f29641f4b585c8394ee32a2c28a395fd9a339982a6229079cd673cc2aac1873c2989d1f70f5fc9912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747615, "uuid": "6255a2f5-faae-428e-b8ab-5f50f0e2acc7", "value": "T1B8A3902777040468E978663463B786E73AF7A89D4A0B66437B3436381C7FE421D61BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747615, "uuid": "da97ebb5-dc6b-4614-9e59-5eb17032d5ee", "value": "8971d7ab98c65dd07386e484ab036050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747615, "uuid": "1b3245d2-e0d8-4c38-bb34-0697e1f935d9", "value": "1536:iYPtGE82NTzw4MGAc4ohrPXo+73Rez8b0Sy1NIjnZr7:iuwnurPX7C1Cnt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747615, "uuid": "1ab9d3c9-2d00-4752-aed0-d36716a6d8ad", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747615, "uuid": "67328e4b-90c5-4254-89f6-03e741c085ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747615, "uuid": "bba85625-413f-42ca-9ccb-a553d44cd61a", "value": "human.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25188283-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746360, "uuid": "7890441d-505f-4ee5-b14c-e77212860fe3", "comment": "Malware payload (Mirai)", "value": "c0c6cace421bfef99ed9a535133ce8e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746360, "uuid": "9b4dcbd2-8936-4711-8685-66a8f3186861", "comment": "Malware payload (Mirai)", "value": "67d4c405bece887f184e5068a9f0d4777cc8825ddb7a8195687b8a638363f341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746360, "uuid": "324612b8-3b5d-4ab5-aeff-88ba30e26b54", "comment": "Malware payload (Mirai)", "value": "c27fac581ed84b3e8c464f67577d07ad39b12b4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746360, "uuid": "5516b225-7d00-4616-980e-bcf319fd9ad6", "comment": "Malware payload (Mirai)", "value": "de8ff8f22dc24789bcb2471a706c53c3fd93f0eb7128034bad09845678344e76d15bdf3fbe3966cb476387bed296a711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746360, "uuid": "490abe68-cf35-483a-aa5f-1e085a12f44d", "value": "T1C2833997F800DDBEF849D73B4453090AB230A2A00A921B3777277D67FE761A45927F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746360, "uuid": "bb96a136-6cf1-4505-bfc0-4be3337666e8", "value": "1536:7xG3Dy6UZqkAnBAXqRJOUkAE98CxSL8tGj2wqyO981O3oT7QdRWl7:FG326WAnBAXyxVC0Tj2wqyO981OYPl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746360, "uuid": "eadf128d-7f70-429a-8c9a-27bba0433b8e", "value": 82016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746360, "uuid": "10b662f2-b01b-4512-9246-19923df51526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746360, "uuid": "a25cccac-1c06-40a5-a223-9425b198fbcd", "value": "c0c6cace421bfef99ed9a535133ce8e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19035b73-ba2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649745051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745051, "uuid": "bfe6be65-30f5-4c25-a76d-965c74fc4d63", "comment": "Malware payload (RedLineStealer)", "value": "612af231aa504ce984c8849a1a8c3dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745051, "uuid": "0f34d839-9ec6-4d08-bdd7-074572f922eb", "comment": "Malware payload (RedLineStealer)", "value": "68058955215cc890b90cdefc3fb88129a2b6b4f49a0adb5b1e3b31d72dc2c97c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745051, "uuid": "1077cea6-f367-4b2e-82d2-2daf0df95e18", "comment": "Malware payload (RedLineStealer)", "value": "a226e86d52a39b4895da2f8e763420ead30d87a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745051, "uuid": "5835f100-d853-4e03-ac65-fb48c52c61ce", "comment": "Malware payload (RedLineStealer)", "value": "779679ade1a365a5fd2ae2f99485784e12ad3c1c69d33f2dc3f7f769e80094b9b7f8e1e79eb63d862010ad013ad41f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745051, "uuid": "25aeb52b-b4d1-4585-bfa3-6a410c476fc0", "value": "T1CB84CF00BAA0D035E6F752F85ABAD398763E7EE1572490CB62D536EE46386E1DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745051, "uuid": "7b81120c-9259-4a5d-90c4-165d5600b15b", "value": "c05c69e25e4cfe454ad2fbd0d1a9d1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745051, "uuid": "57d6b193-0f5a-49ef-bf51-1fb52e75fb2a", "value": "6144:yHZ3ompw3XABXL6kYrh2EC2Gyw+MqIePbuWHA9QBCkdxg5qS3di6o0+2nRJWSV:aZ3oz3wBXGkYYr2Grhub3HA9QMkYdlog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745051, "uuid": "de47ae8e-590a-4a07-848c-baafccae390d", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745051, "uuid": "4eb0fa6a-a658-4c70-8a0e-bdf9f7e01519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745051, "uuid": "10d2e155-2a88-46f3-b82d-3be8ca2ced7f", "value": "612af231aa504ce984c8849a1a8c3dcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81187c6-baa6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649798548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798548, "uuid": "0f9466d0-af21-43a7-ac1c-ba78053a301a", "comment": "Malware payload", "value": "223f5e5e8490e3af56eb7ba814c3edcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798548, "uuid": "7f58090c-f6d1-4208-a620-6f8ef422a10b", "comment": "Malware payload", "value": "68522902bb669d0bc25e84ee92e4ed4700fcb01056061815ed1660ac7429cc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798548, "uuid": "5adb3c23-6ccd-4f09-a811-bed18a0e32c2", "comment": "Malware payload", "value": "7cb08f9677ea3286b171d20b7483a843aee0c0fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798548, "uuid": "708363b5-ef1e-49d6-8878-f8a35bf134ed", "comment": "Malware payload", "value": "9901807c4563c0f9c80424342dce2dbfc222d266d5acbd1137562b1908a19ad5e1ca90942f2f86027223a35c786c5e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798548, "uuid": "9ab06066-6c74-4b6f-b7ff-a9d94ed2cf47", "value": "T17133090977DCA620C6E8957D88F2147C43B7FDA76911E61BD9C0FF1C3A32AE16A01B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798548, "uuid": "dab77f32-d044-47ee-b0d8-a13a09574b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798548, "uuid": "57557117-8233-4040-a307-acc3609b4c29", "value": "768:OKTSNZXG/KXvT4uYQB2lY7ixYehX3E1kaXCo6l8SI+gBnzn:OcMZXnb4uJ4PphX3k7h1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649798548, "uuid": "4c92f735-8585-49d4-b575-3cb316ed6456", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649798548, "uuid": "6f5255af-2fda-4115-be7c-a4d08dad6939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798548, "uuid": "f89eaaf7-a568-4e42-b5c9-5f32c1745766", "value": "68522902bb669d0bc25e84ee92e4ed4700fcb01056061815ed1660ac7429cc17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684f18a7-ba8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649788133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649788133, "uuid": "90f6258c-2d47-4010-ad35-36c6836d3a89", "comment": "Malware payload (AgentTesla)", "value": "1111497996b105d652911833854713d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649788133, "uuid": "e7b2d21c-b642-4c23-9ccb-b579fa02d9be", "comment": "Malware payload (AgentTesla)", "value": "69326e62ce529d7c227307835533eb7cbfbee6e5e0911609d47ea9460ce943b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649788133, "uuid": "032f4a9a-342d-4a54-8601-cd6ae3d2a8b2", "comment": "Malware payload (AgentTesla)", "value": "9ae5f1d2d039fcf68b8ef0ed9691433a903af008", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649788133, "uuid": "bbc8abd0-5db8-4efd-bd26-52a7d8e6648b", "comment": "Malware payload (AgentTesla)", "value": "d57db2a1aa0307871d41ac47f1048b82efd6966e3465d0c3eb6787b0cf616cc356dbe92988fc409aa91f3eafa5994a77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649788133, "uuid": "29d0b95b-e89b-48ad-856f-f5a799a3cca3", "value": "T1A1B4CFA0CA056AD3D0554BB4C8A2CCB036F4B39A911CFB997CB5FA552EB11C6D011FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649788133, "uuid": "f1b467eb-3275-41d9-b2d6-3f0ad019a4f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649788133, "uuid": "935a53bf-9836-4fff-8143-881c4cfbc05e", "value": "6144:6zU6HKwGniXZrPZ0FbdeCaMbZoqj/30jXPE4OqFRSTRFwA+S7B/l2jm:6LBJrxweCXxr0j85qFRHA+Ot5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649788133, "uuid": "a1c004e7-db16-4d02-aa51-9033b34b705a", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649788133, "uuid": "3ebae11e-aa49-41bd-a017-22c5b7bcb6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649788133, "uuid": "8328d410-90f3-4453-8682-47b8649f6960", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd39d8c6-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746642, "uuid": "aacf46c9-1745-4be3-94ce-117841dd6dfb", "comment": "Malware payload (AgentTesla)", "value": "a3e51c2341e0151a1b193927974719db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746642, "uuid": "3a3d391d-12f9-4210-b7d9-890c72cb82b6", "comment": "Malware payload (AgentTesla)", "value": "69650a86e16aded81359a0a1fe6b73e9014848b835c52cfe60f9d000609d0f4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746642, "uuid": "a52365f9-887c-4a3a-a1bd-91ea2058b202", "comment": "Malware payload (AgentTesla)", "value": "3743df12a3a3899336ad40a5b7b2a4aa6e31693f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746642, "uuid": "4f9367b6-a768-4feb-8e79-df59ef7ede21", "comment": "Malware payload (AgentTesla)", "value": "5fd276c69a5917a7e1a9ff748215d2030e5d93bcc726ef31a30f7d50948a0a94bad5e1c2d44fba0a111e8f1eb39325b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746642, "uuid": "37b29fb4-7ad1-4257-94cf-46684e8ea5a5", "value": "T1BD153344A036565E007DD8D30985937A68DF4920B19143BF4EA987BDFF63EF02E78A2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746642, "uuid": "fd96c3f3-66a3-4c8a-8c9e-f4638da9bf21", "value": "24576:zf4H8s0AHfeVPcGyHBv4VDLcg+RPt1UcU:zgcLAHfeVUGyF4VDLcg+ve1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746642, "uuid": "c1ae6866-8161-4c8d-ae04-a59115c3d74a", "value": 930593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746642, "uuid": "3336b62a-4eaa-4343-8319-be4b71b81f4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746642, "uuid": "002ba06d-0e7f-462b-8dac-34d0619cd026", "value": "Order#-01172320202505 (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a8aa3d-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746921, "uuid": "b9ea7bc5-79cd-478b-b5a5-9f55e83387f6", "comment": "Malware payload (AgentTesla)", "value": "13c55fbd4c17ba99c4d90730d8db8062", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746921, "uuid": "df1be471-757b-4c09-8780-86d0c8ccf3b9", "comment": "Malware payload (AgentTesla)", "value": "69874a051a5fe28f7b7c9bc614cd06320fe3acf7d03642580d06ac660053b617", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746921, "uuid": "3c858941-bcf4-47c4-a897-c68ecf821d0f", "comment": "Malware payload (AgentTesla)", "value": "f2bc841e928f568153d9a68eb9d071b6b542c4dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746921, "uuid": "861444b1-fa93-4be7-b7d1-c8cd5889e7b5", "comment": "Malware payload (AgentTesla)", "value": "e3bdc95936e0e0408ded2dc1fe0f6c021c26883c921fe121f2749b706fc3b2270ee28ee46e4064c16d1d810e8f1a2455", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746921, "uuid": "3eae35f8-97a4-4e33-91c0-8c81f407ff43", "value": "T1E7A2BF30AE1F984DD1A9D576109F3170EEA06087DB779E0F586C604D8E6296A4307F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746921, "uuid": "5c35ccac-fb35-4f2f-94a5-abca1d13bd73", "value": "384:zXSKgETbqb0HHHHHBHlDYIBSjyxIl+N/K5w70wsKKWhaKSKiJgkuZVsqxfWXhXhm:zbZ2b0HHHHHBHHSjyPNy5iLOKe6VsqxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746921, "uuid": "d517d50b-9f6d-441d-b765-a5b25b853724", "value": 21867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746921, "uuid": "2730ca3b-31c0-4370-9f18-728f26c399ef", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746921, "uuid": "afc8a8a2-7007-45c6-9256-fa61a117ea5a", "value": "OPOLTRANS 112022.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ad99f7-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649775892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775892, "uuid": "9314ba0f-b701-45f6-aa9d-9b66f35313e3", "comment": "Malware payload (Formbook)", "value": "dbeea9190937ee7295a07b3d94dd5787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775892, "uuid": "de06df8e-d760-4f30-a542-7b4f8f61db07", "comment": "Malware payload (Formbook)", "value": "69cdb8718955325126a19a236de13ef83b27941b518dd43987d8fbed3ffe9d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775892, "uuid": "ecd1df54-493e-46e3-a59a-f0d6745e0b49", "comment": "Malware payload (Formbook)", "value": "3a8268d39a69e838687f3b9b549a362805dd8b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775892, "uuid": "dee32b92-b384-4bc6-8a20-28cfad110f19", "comment": "Malware payload (Formbook)", "value": "29112d6ee87398502e5fada9712ba029579285c51e077a40d020b799c34df69ba8b7c6b9f9141aa5f53a4ae1c54fdc90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775892, "uuid": "54fa7109-d9f6-4049-b19a-499b873cb935", "value": "T1E894F01A3184C8A6E7E476785FA2CAB48370AE9C2D14054773F83F8F37FC2A79506265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775892, "uuid": "0b373543-b023-4889-b0b2-b31f81bbfa75", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775892, "uuid": "686ab1e8-3ee4-4aa7-b37b-b39aa2b9dc7a", "value": "6144:fQqb1vP3bFdnX7Na3B5+S8aVBEc6TdntNWBU9N:PvPpdnrQ3BEShhAtNDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775892, "uuid": "94b6b7a0-bf67-4757-ad28-fab801a9a353", "value": 409618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775892, "uuid": "b48d8151-a456-40f9-94aa-d1a547e8eb48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775892, "uuid": "75009728-ec59-4105-ad17-270bfc20763a", "value": "dbeea9190937ee7295a07b3d94dd5787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50dab9b-ba6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649773686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773686, "uuid": "ef17dc73-8ca5-458b-a48b-bb29dee3bb47", "comment": "Malware payload (Formbook)", "value": "bf7397968a9ac1ada9326354f3e137b5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773686, "uuid": "8b972257-a661-49ff-89d3-5302e2e3295a", "comment": "Malware payload (Formbook)", "value": "69e388880ed986010bc0cb81b28a628b24b62e3904eee8aa9b722c431ef71065", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773686, "uuid": "76145ee1-fa4c-45dc-84de-5381972c1825", "comment": "Malware payload (Formbook)", "value": "59f3ba72bbe451d314a445df4fd71077c0cdae96", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773686, "uuid": "bc71b8df-7710-4d0f-881a-611579dad00f", "comment": "Malware payload (Formbook)", "value": "e02cb40edadb087a0a901e4d4a41a0297c7d294ab6768373405f131d5d07427e99b8183d7e74f14f1e1a5cae9b021eb4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773686, "uuid": "ea7c1020-de14-4078-b26a-4c4f18020d92", "value": "T13742197DC8E74658CF4D23E4AA35ED5826D8725DE3C4902732BC23B12B96F7D9206431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773686, "uuid": "115ec690-e912-4965-8188-d0f88991bc78", "value": "384:mQCzzc9n9YtCd1ndrKYdj/mwcijOSTEEvhOcr6J5Z7:wkN+C7nQYdrxPjOcEEv/GB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649773686, "uuid": "2f81ab5f-8302-4f65-9d47-78a1d686709e", "value": 12353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649773686, "uuid": "1755883f-9290-45c3-9ecb-84fe53743f7d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773686, "uuid": "7fa5bf28-d09f-442c-b6c1-c3af35fdf640", "value": "BLCOPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d132c714-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767694, "uuid": "ea45e29e-37a7-42a9-9a88-a0475f3400b2", "comment": "Malware payload", "value": "c426ef12576393844eeb18bf94b47d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767694, "uuid": "5c03b600-af19-4002-99a4-db773593e982", "comment": "Malware payload", "value": "6a3023f0d2ef9c85075ad9213c5cea6ef94c7ce7b07efc6977d6c36fabe5d786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767694, "uuid": "88f5fc3f-a6c0-40e5-9b3b-33ac5eb7e3a5", "comment": "Malware payload", "value": "521f5dd591ee7fd4ddf3a312680043e1a3b2da29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767694, "uuid": "8ce600b4-2110-4384-95e9-24b593b956d2", "comment": "Malware payload", "value": "bca79026a848792429c521c18cc6218c08df743798b60a6eee8c18c9364646abe7e7cbac0faad19871ff6e8faa1c9583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767694, "uuid": "dba108ee-634b-4f5a-be6c-cecb9a31e292", "value": "T12506238B5BBE1202F4A0CF26594B7E9434341A9B6D807E359E5D18CD2223C9B71B52FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767694, "uuid": "376e110e-c84f-4885-9caf-83a5c449951f", "value": "98304:kMX8iC3ZuiTwzNHpL+GK/6rRSlilvxM3oRmC2:58dJFTOwGKShfkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767694, "uuid": "0fb2e640-fce7-4c75-b0cd-360d1a53779d", "value": 3735203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767694, "uuid": "31beded4-86a9-4c27-b2f4-0e94acec6a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767694, "uuid": "94e1e8f1-73c0-4f34-b88a-97fd5e65bbb4", "value": "c426ef12576393844eeb18bf94b47d75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c1f501-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649775726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775726, "uuid": "b43d4792-494f-4e42-8cfd-7728930479f9", "comment": "Malware payload (RemcosRAT)", "value": "f51f21fc186c8520542904fc2eb83ac9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775726, "uuid": "d6de1203-a25f-4664-a081-2a2150ae5932", "comment": "Malware payload (RemcosRAT)", "value": "6a41331a44711da6d020c1909dafabdca5a68357d56f1a3b702ec39fd69afda7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775726, "uuid": "3a120310-4796-4f76-a960-cc08aa545347", "comment": "Malware payload (RemcosRAT)", "value": "252c96aaa362f600cff7c3b58e902d66b230f4b5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775726, "uuid": "b699510a-9438-4444-946a-62a4f7cc0e77", "comment": "Malware payload (RemcosRAT)", "value": "0f3b165ac6e513672e1ed561c4493d54a1ef833a554f8fc5b0dcd5ac9dc2fc5333d9e508453d31398bc83dc570877b40", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775726, "uuid": "4ed398be-10f5-4ee8-a878-80dc2afef340", "value": "T1BFD4F15973EA4FB5E7AB4B35D4B181045F787D08B89ED70F048278AA3CF2354E582A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775726, "uuid": "6e346918-756a-49b3-8209-b314342846c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775726, "uuid": "3551401b-8af4-4ef3-a622-b97ac845db1c", "value": "12288:igci2DXYQACwHYOoVZaATURO8U6p6A5xCXGpFn69bShteHdZWLy1:3cJYJoOhRO8U6ploXGpFnnhYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775726, "uuid": "45709942-8bcc-4ae1-bd5a-3b848a7291d3", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775726, "uuid": "8bfe9076-cafb-4001-ba1f-1153be2cd757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775726, "uuid": "7eb9d476-11d1-4104-8cfb-2123c07cf6bb", "value": "Documento de entrega de env\u00edo DHL227024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc93f020-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (ModiLoader)", "timestamp": 1649747151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "adf266fb-bf4b-4e42-a724-ad72a6cea826", "comment": "Malware payload (ModiLoader)", "value": "7f3e057e3be4e692d646596f16db2668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "7344398a-f779-4bad-be65-92d3651354ba", "comment": "Malware payload (ModiLoader)", "value": "6a52acf5de13a2c4d6fa927727fb868db6d97220c5eb837ca307d19c0b7cf128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "531161f9-5e62-48f9-a4b9-32065eb98b20", "comment": "Malware payload (ModiLoader)", "value": "e531536d6d5bbda967bdd80a9396824526e33fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "4fce11c2-1eb1-4b62-a52e-3288260b5100", "comment": "Malware payload (ModiLoader)", "value": "3a6b80b9702dd34dab23ac3a74bdeabdbb51d53aa66fc405b3597b0c8da451dc4342bc4ac50db71fbf9604cc2535e22a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "12b52614-e212-41ba-a90b-98c6aef28f58", "value": "T11AE49E52B2B18E33D93F1A3D4C07979868337E136E1892972ED06E4C7F7A141297E1A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "e578daff-be50-489e-a32f-8d200c6f4ea8", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "20a32723-41cf-4bdc-8585-26affea4b3ec", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh21Zec4qO:wkKHuoE+/vI0icJsk1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747151, "uuid": "4a7832e3-9af6-4074-b11b-0bd1f86eb8b9", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747151, "uuid": "8e77bb7d-2cae-4cde-8dcd-4aeb4ae22295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "f990982f-9502-4505-a9ab-efb56db81fae", "value": "Hngvotwwxqrrqpozdzjwcpzajkixghmqfz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85ad2c9-ba10-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649734205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649734205, "uuid": "7d89abee-5ca0-45f0-8381-120bb1f38ca8", "comment": "Malware payload (SnakeKeylogger)", "value": "aa3d845a3468bcdb9081dadfab126499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649734205, "uuid": "6721b0b1-624f-486a-9814-e99e3b9d8878", "comment": "Malware payload (SnakeKeylogger)", "value": "6a8fcf46462495a6ca31dabec1ec76366500dd93fc659415aeb0730a2e013a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649734205, "uuid": "ae47fa2e-b6d0-4160-8a97-dd370ab1b58b", "comment": "Malware payload (SnakeKeylogger)", "value": "ebcbe40d991e52ba54bc3a374ddb326ff6789166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649734205, "uuid": "08a17b94-e201-4584-8470-7bd1c6b242f2", "comment": "Malware payload (SnakeKeylogger)", "value": "27a056c62065c44baf74cd9bdc9b3d8c900802d33e753788acb1b814101dbd47b838ae62e8f6a1a15339c8e8f34c2ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649734205, "uuid": "b9857371-e997-4a24-964e-1387ec719eb2", "value": "T119C4E12176F88629E5FD07BEE075018147F5B62B6816E37DAA07A0D63D233C0C647B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649734205, "uuid": "4f1d50c5-1b5a-4262-b014-703d661dae62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649734205, "uuid": "3d2f54b1-ad99-4ff4-a678-f7b8b1d3a0a6", "value": "12288:dkKUk6hBJ4qZ92a2GjDkRLX6FP59a61n02oEzUbhG0gVgz:dkKX6hB2qbNw9sB9R0zEzUQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649734205, "uuid": "7ae45d81-1d5a-4f0b-bb05-2358bea34bf0", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649734205, "uuid": "d5fd38d5-6fc9-43f9-b11b-e5dbca613823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649734205, "uuid": "fa7a1252-7c03-4688-be14-5df756afbdee", "value": "Invoice Number.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed95e2b5-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736388, "uuid": "bec99319-0abc-4cd5-bee9-6338f8646849", "comment": "Malware payload (Mirai)", "value": "c4ec6872577431c7b50f5a963dd355b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736388, "uuid": "6b7ba825-455f-4842-8274-9b3e2b1b4113", "comment": "Malware payload (Mirai)", "value": "6aed43861d60ecee3c59b651b6d27e6d4629fd5eeb6ff25c501a285e14285058", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736388, "uuid": "cfd9c6b5-2124-4f9e-ba19-3920864de3bf", "comment": "Malware payload (Mirai)", "value": "4509fd628481e3c037bc529f50682b18f9a3ed18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736388, "uuid": "91568b15-2474-493e-8905-60937d845974", "comment": "Malware payload (Mirai)", "value": "a2d70dbbb897f6c994f857572f6a85e7b6f2ee526cd910b0191b888a5323a6d58d84fa69b3d4fdce92cecaefa0261435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736388, "uuid": "7bba458d-50f8-4276-aa87-661a03423d90", "value": "T184E2E07C31029ACEFDBA04BEE7E34B2A5F6307D4A4460C6766A5C563991C4C534A3ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736388, "uuid": "7c47cc92-18a7-423b-8206-b49d24e5be14", "value": "768:o1+D5be5PEG1R9CkEcLau2UYlE8TeYFzsUV/7JgGlzDpbuR1Jd:o1+DJe5LQkEcLaSYlNTeYFzfV/xVJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736388, "uuid": "83a54553-8be6-469d-9f1a-80220bce64bb", "value": 31292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736388, "uuid": "d94b94c2-a3ad-4e5d-bdc2-5c8f48835eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736388, "uuid": "64a4b13c-f1dc-4609-8e63-f555fa769add", "value": "c4ec6872577431c7b50f5a963dd355b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9b8a39-ba80-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649781967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781967, "uuid": "24362425-75a0-4c56-b94f-274856809d46", "comment": "Malware payload (AgentTesla)", "value": "1c463e77f93cbcec5eb7cb47631a71d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781967, "uuid": "3df8b653-2e91-4110-b7e5-09d189c4aea6", "comment": "Malware payload (AgentTesla)", "value": "6b026a21222509a4b16366cdeaa8a3bceece71219df84c948f9038d14a41b12c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781967, "uuid": "e82a68ad-b6ff-44c6-8ae8-9ccb8d3dd145", "comment": "Malware payload (AgentTesla)", "value": "84327edc989bb137a2f480a1adb3a2c3d951467b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781967, "uuid": "c375b733-9949-40a9-97f1-80447c3c2712", "comment": "Malware payload (AgentTesla)", "value": "fc2f590e1b44b664b4fa8a2f0ac5463d7e4b0f2dc71bf809ca77a6b3965b14fbc966579c69e33e49cc9b8cfd51515ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781967, "uuid": "04e3801f-0645-4ebb-8ae3-e9c73bbac5b0", "value": "T16DD4F120F5A93BA5D46607F50C24E24017BA7B4AA92DCA0D6DBB71CF95337C32621E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781967, "uuid": "82929461-8df5-40a1-b4c0-c3a2319ff018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781967, "uuid": "cbe8e996-c667-4cb4-a771-8e79445cd8ee", "value": "12288:vfR4qiHPj7YrM9g0hy6iE1hGeQ4muHFHD237XiU+j98:vmqiHPPYuENVFuU3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649781967, "uuid": "725ec4b3-a3c5-4805-a06c-d12a8e758f12", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649781967, "uuid": "d21feddf-9c5a-4789-b7da-f2436abae438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781967, "uuid": "02862bf3-827b-4fe6-bfb4-457d21908bfb", "value": "SecuriteInfo.com.Scr.Malcodegdn30.27736.19044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0655863-ba53-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649763021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763021, "uuid": "274ed079-54c4-4a46-aec3-c510490c0867", "comment": "Malware payload (Formbook)", "value": "61928013482997be99812747e1ebe3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763021, "uuid": "bc1b8ead-f4ce-4af2-93eb-6b28cf13e032", "comment": "Malware payload (Formbook)", "value": "6b55967f7016ed23e103ee4618651616d93bb9674497f910dd0cb26d6ebab7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763021, "uuid": "c00591d8-edf9-4eb2-84f8-becbcc5d5558", "comment": "Malware payload (Formbook)", "value": "8c59dacc90c21133ccd2b3596b2a01d0431a8e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763021, "uuid": "a2db3017-c2cb-42ed-9aad-533587515846", "comment": "Malware payload (Formbook)", "value": "0a45fb5fa1add19d1584d2077363ba3e9ffe765b008a345dcc1f68becab4b675d3d78d8b8df34410755b89c277d0f4d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763021, "uuid": "a544a9ee-883d-4f4d-be88-7fac85e90edc", "value": "T14BF49D1233C84F57E1BBA67AA575120143F7B5D7D671EB8E3DD102D908E2B809B29B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763021, "uuid": "27e68fc8-55cb-42bd-8eaf-fbe9129d0e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763021, "uuid": "b884e66a-1332-4f7e-886f-3a33575dd43d", "value": "12288:dfQTBoOvOzEQtL0JVbTwVj1WxOfvNqkl+jYna+1j1X4boJfK4gCHBzZL7KHfHxSY:O0fXHBdL7+fwGAdWqYnEoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763021, "uuid": "ead981a0-504d-4d76-ad54-dc85fd7770df", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763021, "uuid": "cc7541a0-d465-4323-9436-1e8630bdfb52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763021, "uuid": "1efd8042-92f6-4ea9-9e6c-7aed9b605055", "value": "PO #4579001DC5E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e11ab4c-ba77-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649778104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778104, "uuid": "9b5d4f31-45ea-4007-b4f2-1e06ff54514b", "comment": "Malware payload (Loki)", "value": "17d4dcce79df1e1f66e513961b50c681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778104, "uuid": "b01ee560-2bfe-42f6-acda-cef63ac92190", "comment": "Malware payload (Loki)", "value": "6b8b94a4e8c9cded045a50d2a63b432682455e596847b774ab35d6b744e5de9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778104, "uuid": "b3b5556c-2b4b-4b81-a868-847004c3dc7b", "comment": "Malware payload (Loki)", "value": "143066b2a6db064e8ccafe78788578d5c299c9c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778104, "uuid": "ec1d2e90-40c6-40a4-88c2-5f9bdd085636", "comment": "Malware payload (Loki)", "value": "52bb10b94b2308cdba9fa3815154da522f9162bed813cf4d45afa2e65b280eceb28e258ede3b892e315c0bb99653f320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778104, "uuid": "e8019ccc-f96c-46c4-9e12-035311fece58", "value": "T19CC4D0157AFC8625E5FE07BDA038019047FA76276816E37CAE05A0D63E233D0DA47B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778104, "uuid": "11be1f41-fff7-4007-ad51-64597184953a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778104, "uuid": "581043b5-653c-4113-be32-c1ae57f6986c", "value": "12288:GkKUk6to24qRTHag94LSZ3dk9DK/7IVhtuu/HggVgz:GkKX6todqRT6g9h9dY+zIVx/Hbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778104, "uuid": "0f248a67-8328-4e56-a38e-4fa6f6c6e0c7", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778104, "uuid": "895a6e6f-fe2f-4e43-9ec9-15bc1db1fed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778104, "uuid": "81f3a9f3-2581-4ecd-a903-20e847c4a763", "value": "PO306078910_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14e1f71-ba37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649750970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750970, "uuid": "38f64f22-90bc-40ce-a5a4-12700284ed00", "comment": "Malware payload (Formbook)", "value": "32de34867e1014babcd558526ac82537", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750970, "uuid": "151b1ba6-79dc-4115-b911-7bc347ebabd3", "comment": "Malware payload (Formbook)", "value": "6bc255ce6d990bdfa2cfcecd84ea6cead6c499c18426b943a8502b3f718dcf6b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750970, "uuid": "5e4d4a46-f6e8-43a9-b05b-95ae13533ae6", "comment": "Malware payload (Formbook)", "value": "9c65f151712cf25d07db6426f7302657e55eb291", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750970, "uuid": "e9a41f47-b776-40a7-b727-a25ffe68deb4", "comment": "Malware payload (Formbook)", "value": "c4d92f71905a12a6b12263d5d1242a8db6040ca4eba998f3830423535bd26538d3397f92bf3b33aae4f5d6e564fd89de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750970, "uuid": "51adee53-72bd-4ee0-9848-d91355ffe1b8", "value": "T1D03423D80673B0EE901AAFE831BC9D425EB22265445A3B65CA7310CE47473F64748EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750970, "uuid": "d89013a7-c36a-4d5e-bed0-4990ab364245", "value": "6144:5p2K1AaB836orzi6rvnyGzL3dAsb0GfgK:5p2K19uhrv/yGzpAwIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649750970, "uuid": "36393412-bbdc-4756-b81b-f5dff4190b66", "value": 230690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649750970, "uuid": "4bba9273-ddbc-4b79-a429-616308cd6243", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750970, "uuid": "71c8361b-c81e-403c-9185-f22d2518a38a", "value": "new item in 2022.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbd0dd5-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649744762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744762, "uuid": "dd4d9403-aebb-47dd-8187-8b1a727b642b", "comment": "Malware payload (RedLineStealer)", "value": "448a63b4429ea5497b3ff3f21d3922d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744762, "uuid": "4aef1734-4fac-4987-978a-729253854c57", "comment": "Malware payload (RedLineStealer)", "value": "6c052c5869d963acac5fbd2c0a80ac161347d33c7290e7095f0c5406245366f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744762, "uuid": "fb1d45aa-f862-4717-b493-3f11f4b4f81c", "comment": "Malware payload (RedLineStealer)", "value": "1de5d4d91ff3779fc0fc77ae993d2b1f7aa7064c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744762, "uuid": "7fd4de8d-24ad-49ff-a063-d4e2c7233e00", "comment": "Malware payload (RedLineStealer)", "value": "9f0be68a513e8d1187391a814c7099f5cc071fd5beada3b8600bb2219c8ec5a634c9a8f76f0b74cf3c08144ac8f128e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744762, "uuid": "0c136cf7-c91d-437a-b696-c9de0062e5da", "value": "T19D84C010BA90D035F5F766F859B992ACB92E7EE15B2450CF22D426EE17346E0ED3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744762, "uuid": "4f75fd71-c2a0-4356-9ac0-02082183a506", "value": "c05c69e25e4cfe454ad2fbd0d1a9d1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744762, "uuid": "98269d2d-41d3-4ad0-bef2-1e5449b10a59", "value": "6144:C9EUA4g6zO8zlZb6w3aY6EFEijVrbXienrcx0rJeXdVpA/eqL5hfeLkm:YEUAIi8zlZbYUEipTiercx0ragP5xev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744762, "uuid": "07f12a6a-6686-407d-8329-1eee6c5534b4", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744762, "uuid": "7650bf73-096b-43bb-9795-3566b98c4ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744762, "uuid": "ba6c81f6-7d75-464a-b5d7-8903ded77cc9", "value": "448a63b4429ea5497b3ff3f21d3922d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43adf157-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767456, "uuid": "e31015d1-fca3-4a4f-8ad5-aed2cc826382", "comment": "Malware payload", "value": "07d9d6b902ed9b60ed130afc71763431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767456, "uuid": "5152c0d2-4d51-4b8a-83a7-aeb7c7ee90e5", "comment": "Malware payload", "value": "6c3b5ca0f365f31d9b948f5999a08105894e882094911cc7cc4adde56d9252be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767456, "uuid": "653c25db-b54c-4447-81ca-08f039118d89", "comment": "Malware payload", "value": "9ea80b3a6e47ee5d4978cd1d7c4191ab6adbd3b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767456, "uuid": "b3569ceb-1ec8-425d-91c2-ef0a2ecbb4d3", "comment": "Malware payload", "value": "31000f08f878189b5f81fd318d84559a4a92a42be6a5ee8ea022a18ceadae0f912e9d1071e3592b60a8ec0d21d1cc931", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767456, "uuid": "494bb0f9-f996-4e22-a56e-687b1d1ac146", "value": "T16585336C124EA133E15DB47DD55BC64193E0DFA33990EC989FEF2E791B191CAB80708A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767456, "uuid": "c77e9c26-6ab0-4b67-aecf-88c00b80c636", "value": "49152:MHEQRyINNiMzKMI7114yxHM7eNSMBvAWeLn/q:MkQRLNkjxHMSNjvAW+/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767456, "uuid": "006a8752-05a2-4e66-890c-b84cbb6ab97f", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767456, "uuid": "a2bcdf00-0c10-4608-b6ce-1f75bea55dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767456, "uuid": "9f42dfa4-5cc8-47b4-8fde-76d75cab570d", "value": "07d9d6b902ed9b60ed130afc71763431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0348e95-ba99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649793005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "65ae49b0-7557-4faf-8a90-35f4876a3da4", "comment": "Malware payload (Mirai)", "value": "3fc57b4330528e2318369c18bc2251a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "d83852a2-f1b8-48bf-a6c5-751e9a007d12", "comment": "Malware payload (Mirai)", "value": "6d257ae623cf6ffb3a73c7dbf39538aa9219bc59669c5a5f13971b41a316f8f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "1a364360-a789-4efb-b865-fc78ca412d67", "comment": "Malware payload (Mirai)", "value": "4ebb29e2e2e2c932ca105dfc9d8f803c388e371e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "0c77a352-19db-4097-8a6f-3080b9003d37", "comment": "Malware payload (Mirai)", "value": "d304cfe9230a98f332ced812ec3c9a0c7daa3e6fb91932f850e3df3ac43f936d693ef40f4f8b3dbfbe55158c59ae6e0d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793005, "uuid": "b02b65a4-17e6-4115-946d-4d639ebceb7d", "value": "T157431A66BC81CB02C6D42377BA2E11ED37252398E1EE3217AD112F5177CB82F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793005, "uuid": "65585fe3-162d-4433-ad34-6fb82c07fe88", "value": "768:disXaO1w/LsDHU+wnYTb6ynvmIRalIB7Pl9ue3MkR9OJFBaHHJBNOpQHe9PN1:YsXnQLWHUArvmaayBb/u/9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793005, "uuid": "70ad051f-0bf3-4892-ae5f-af2a7a8f24f7", "value": 55376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793005, "uuid": "7ebeace0-20e7-468a-aabb-31f8a449c296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793005, "uuid": "97585de0-be55-464b-94fb-2ec9b28f3e76", "value": "apep.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0311c88-ba84-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649783986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783986, "uuid": "d0a7b608-35e8-4cc8-a672-22c04c7d52e4", "comment": "Malware payload (Quakbot)", "value": "726a41b2959768c5c3d2c7c213e6d0d8", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783986, "uuid": "38f0e39f-aebe-4c26-b6e4-b23c8cafbc10", "comment": "Malware payload (Quakbot)", "value": "6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783986, "uuid": "2c69b778-3012-4f45-85f9-9745221b7c24", "comment": "Malware payload (Quakbot)", "value": "e28186bc0d771d20527b5f80757f4ee3f0ce442e", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783986, "uuid": "80de7379-961a-475b-a972-be57809ac62b", "comment": "Malware payload (Quakbot)", "value": "1d94a510cb86d7eea067d39d883287a09f48c5ed56b355c0878aaded535c524575861d8cec705526f862962ab6f7c99a", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783986, "uuid": "e8b14134-0d82-41eb-b425-3c682a96fa82", "value": "T14FF4BFB875047CD6E1AF467BDE96ACDD13B6177289CB99CD80647BC309A3362EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783986, "uuid": "ca33c531-0d7b-45f2-840d-c419067bcb85", "value": "1d26835eb92a34541e9e0eeabdddd35f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783986, "uuid": "eb78aeb3-48f8-455d-aac6-42e81dd69b7d", "value": "12288:wwwqgbwISL17CL+cZjXA8vl3QloyPu1WE8zdDF26pOmXAjMqXQ9DSFyOwRS82B15:DQbfSL1+icZkYl3QZGAE8zdx26pOmXED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649783986, "uuid": "c00c3db6-3a03-4678-a962-816959afc913", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649783986, "uuid": "6367857b-97ea-43da-95c5-95ad62427b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783986, "uuid": "70d73f78-5e42-4f56-adbf-2358dd3d6e3b", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb102f0-ba53-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649763015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763015, "uuid": "c2bb0b53-03fd-4db9-84bc-4a96d3261bba", "comment": "Malware payload (AgentTesla)", "value": "b4dfeb164489d6dd7a8338d1dd08bcf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763015, "uuid": "a5fd3700-efa3-4a20-9612-3444a4cce886", "comment": "Malware payload (AgentTesla)", "value": "6dafa379cab8cf6a545e3e018c8afa2dd888f7e168bacf2a24de7ae8644aeef5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763015, "uuid": "7227b955-d0e0-44a1-acc7-8eae0d4fe9a4", "comment": "Malware payload (AgentTesla)", "value": "59e076b00876998453bc31b87c6e0cf4547d4957", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763015, "uuid": "649d5922-8160-4d1f-8c0f-6da0a08d1518", "comment": "Malware payload (AgentTesla)", "value": "18b5facf00952ad74b1599f4788cf94c07810d622b669a3e3f84d4c534a881846c1ad28eb443606bced1aa15296eb585", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763015, "uuid": "b8deacd3-306d-42cc-9d76-ccb259f4a4b8", "value": "T159059C1233C85F47E1BBB67AA564520143F6F4C7E731DA9E2DE106D908F2B808B69727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763015, "uuid": "2f0c9fda-a554-4450-a353-76219958cb77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763015, "uuid": "301474ad-d2c8-4aae-a1f1-5aedeb11c735", "value": "12288:o4IExWlgggf10PAasKoSvOhwP/kHuMlXdg4mV+jlnaG1jqEIboJfK4gCHBNtO3Og:ZJlPs0fXHB4iA/eoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763015, "uuid": "560c7f6b-19e9-4776-b590-bebed4f74445", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763015, "uuid": "a6d8d742-6565-4464-a29f-683ff44ed2c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763015, "uuid": "5bfef360-3d31-4bdd-b11b-407fa15ce347", "value": "2022-04-12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be50efe-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "c9536ca3-5173-4236-bc24-e2c48a1eebba", "comment": "Malware payload (Mirai)", "value": "e4a443f4fb609f937e50ce7e3a8f8d01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "9839b28d-8307-4cf1-a26a-c9f5ecca9698", "comment": "Malware payload (Mirai)", "value": "6de0bf9f7ae8b4afc7dbf122eb802ae6470c6d044dc9fc57bf7bb27d168b2371", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "5a9ad2e6-75ea-4abf-9c08-07e430ef9996", "comment": "Malware payload (Mirai)", "value": "526439a3fc9906e22e3c4d11956dff79109c7945", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "f2cbf52d-d9ff-4337-929d-79464b6b1acb", "comment": "Malware payload (Mirai)", "value": "ad71c2612a24bb69a31f7021135cd77b4a7ade0932557b8cf9242b3b2424db494c96d2adbaa3fcb2af40dd70ccbf1d6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "d3974816-2b86-4e9e-a4e2-7d17ef67eeba", "value": "T1FDE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "f69e4ba7-d4d9-4937-8e77-39c173f03496", "value": "3072:JW6dm9tS1aRGQdK76t/zCwI5mrThPaLEnvPrNb:c6IG+LClmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753404, "uuid": "00094972-c822-4855-8c46-ff02f26e65ae", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753404, "uuid": "d3779445-490e-4d44-82c7-890da963896d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "87f2346a-4bec-426d-b60e-8bdb6c3cc021", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da954085-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649767709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767709, "uuid": "b03bcc61-3b03-4a7b-8f29-364a13b7e445", "comment": "Malware payload (Smoke Loader)", "value": "581a84b899a7e45579283fbdfa321d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767709, "uuid": "569f5803-eaf7-4d5b-a68f-8ebddf49e195", "comment": "Malware payload (Smoke Loader)", "value": "6e23c1316c64fd1f4cb9d56f64adcdc29f18705a1c26c42e90cbdafa5cc731dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767709, "uuid": "288d9d62-29ac-4552-8ecb-9eefab2eb2dc", "comment": "Malware payload (Smoke Loader)", "value": "daa65d31c6032603048a7e1c5a00290e6e3e4779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767709, "uuid": "c6c3cb4b-ea72-4af7-9812-fc7b79f47594", "comment": "Malware payload (Smoke Loader)", "value": "e039262c7073a816739b708737391f08855c3f0b049fb7adf95d7b203e01feab002b646ed234258fe4276dc469ed926a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767709, "uuid": "95d5f73d-d616-4714-a66c-6657c6913923", "value": "T19F949D26B190D17DD89271BE7A14C29699A9FCF06E326047BFC92F6A8D701D9C630F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767709, "uuid": "e077687b-7aa5-473c-9eea-ec16198dd3c5", "value": "49261b0ebf129d18c3749b8f9d31291a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767709, "uuid": "bb9f3fe3-6042-4041-ac4a-7de590e4d157", "value": "6144:r/eOsMTLvp6u+YL4iCk5/kFYH3s38PC+63dOz8pyNY6EEAXEGiEadOR:SMt+YjJ3s3GC+IO8wDEbX7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767709, "uuid": "512443db-1ed3-4ecf-b08e-277c705ff538", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767709, "uuid": "8f0220ba-635c-4d14-ad3b-33a8de427371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767709, "uuid": "03b1aa92-8527-420d-98ed-75a72104d992", "value": "581a84b899a7e45579283fbdfa321d73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573f15a7-ba2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (QQPass)", "timestamp": 1649747303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747303, "uuid": "5f6f3dde-c3a2-496f-8239-e83e94450aa5", "comment": "Malware payload (QQPass)", "value": "6df45b5ecdbf943749f3bd2298a68d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747303, "uuid": "56da7bf2-2cf9-43e2-ad8d-c67b3778cd37", "comment": "Malware payload (QQPass)", "value": "7203f57b029e6942d06250400cfcfa58ab92afd76f51865848e1eeff89bbaee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747303, "uuid": "a74821d6-92c0-4bcd-be1a-5349948a7c3e", "comment": "Malware payload (QQPass)", "value": "918f3f7b81a4a2786172fef5133fb35da3ee675f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747303, "uuid": "5b785008-ead6-4cef-a839-aab671c049c5", "comment": "Malware payload (QQPass)", "value": "049fab064925bc8cc85f8d13af835439bdb43ddf1887b55f08588ea8e7359e8d4500446ae1accec8ff36213abadae182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747303, "uuid": "b775630c-83ae-43e1-bee8-535f177522d9", "value": "T157C3AA64265B12ADB720E42740629DC7ED5A0FC38CE0C08AD577BBAD8DA5FA34CBC574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747303, "uuid": "5acbd389-ff02-458e-8851-b1204ca00665", "value": "f9e8597c55008e10a8cdc8a0764d5341", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747303, "uuid": "273308e4-eab6-4d0e-a7fa-6c46c13ed67c", "value": "1536:ZGaq93mQy5PV4MSu4M3vfAlA89mWMMF4pzYU2qIUZ6kd+lcZ:Z5MaVVnLA0WLM0Uvh6kd+lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747303, "uuid": "e77c8aa1-e418-46ba-811a-ffc6e01f2737", "value": 120490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747303, "uuid": "92aa5b95-5be5-4480-8120-b3d665e5e9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747303, "uuid": "770f1e92-1025-4538-830b-836768b5250c", "value": "alpha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d36931-ba4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649760428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760428, "uuid": "f0938e75-dc55-4f30-be0b-ccdc9dc1bba3", "comment": "Malware payload (AgentTesla)", "value": "2dd7aca129fa913d9fc13b0b978d737f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760428, "uuid": "0a05798a-c0a3-426c-9b0c-a6df85201348", "comment": "Malware payload (AgentTesla)", "value": "72862a0c23ad5145f5c04e37447de7e743aa792a8a11143900c304f27b64b53f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760428, "uuid": "92370be2-1f10-4d22-b96b-8438c576874b", "comment": "Malware payload (AgentTesla)", "value": "6ce6c26b872aba7c7e4db614dbfc5559219d0bd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760428, "uuid": "c73788be-980e-4c72-b077-12ead6d4d611", "comment": "Malware payload (AgentTesla)", "value": "a53104b6d26099386dca87ecc27f311fe00d0e2dda10f051cdde7354f54d179d6aea9bafd3b71fa087382f70464e7cac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760428, "uuid": "93f3324b-f077-429a-ab53-79366915a47b", "value": "T19F3523DC67E84713C7BC5FFA5CAA428527B6306B7620EB2CDD8260C619673444A16F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760428, "uuid": "882e1360-463c-4444-b51c-11be60c09be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760428, "uuid": "119e761b-ec2e-4045-ad17-d89a995a7c82", "value": "24576:db0/TGc/q0XByynwJZnp7UskHz12zbB3VH:FSGcix5HpRkCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760428, "uuid": "4d506feb-eeab-4cc2-ae77-948628a5e076", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760428, "uuid": "16a6a1f0-8a2c-4f5c-b09c-b95297e144cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760428, "uuid": "3c6d6e55-a60d-4efb-a3fc-9f5e550d4721", "value": "SecuriteInfo.com.Trojan.Siggen17.27381.15813.17585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f44863a-baa2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649796708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796708, "uuid": "a6a0a68f-b3b4-4e77-8ae5-06e77cdcf0dc", "comment": "Malware payload", "value": "467d9b17c0ad622b958d6d102f5f355e", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796708, "uuid": "2943c297-2d20-4cd7-bace-bcaa61d09acc", "comment": "Malware payload", "value": "72a6853ece2d8ff0f891c56995e0c24431e256d6f81cb0741744f7961892ae46", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796708, "uuid": "ecc466ee-b28a-4a6f-874b-3023fb7995cf", "comment": "Malware payload", "value": "30f10bcdbc971e3be22f3f0786263866d2384546", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796708, "uuid": "06aea4be-ae29-4cf2-a6ca-cd4349feed72", "comment": "Malware payload", "value": "a1e5f1514cdf21fb08f485dce7c17981b0b9f9cc648e2cf9e363e20d39ac94a2b693e1f9896c13e5def57b653a7141ed", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796708, "uuid": "7d714e09-55f7-40cd-b75d-4bbf5cf61814", "value": "T113318446BE8EC85AC87FA8320579A2A0022830CD8045215D6E88A3397DE13980EA77B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796708, "uuid": "6ac16db3-a531-4f02-aa72-bd911a3df56d", "value": "24:9HznTm0DkzymRxq4vNHEPdNCuWCJQiJIdfR4kh9tNjnCDafO:9HzrDdvANH+dQiJc54A9bjKaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649796708, "uuid": "39264459-aa20-47c6-8d55-e7644f9ef4df", "value": 1474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649796708, "uuid": "58b0d7b2-7d26-4fc3-aa4c-db468c8477cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796708, "uuid": "31a54ebf-2e4c-4c45-bf54-d8ad689d52d2", "value": "OGBEYJQPLF-PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa20c3a-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731667, "uuid": "6b4c5cb3-c1b6-4926-8d61-56bc29429a01", "comment": "Malware payload (Mirai)", "value": "bcda7556f3de1cb7f45b1c194beb2603", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731667, "uuid": "0b4de6ac-6636-494c-8a39-d1c833e0ff12", "comment": "Malware payload (Mirai)", "value": "72ab5aa1c82b863b1b8aaa3c4a00659d5f87b069049957e67707564b87cbed21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731667, "uuid": "a8305697-0ef0-4e49-b759-20485b2d9ab0", "comment": "Malware payload (Mirai)", "value": "09e37ea9cc62252306192e3ac2e5edbcd0a34d25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731667, "uuid": "b9a4bd6b-fa16-4898-89c2-75cbb517bb69", "comment": "Malware payload (Mirai)", "value": "a7d59798c3e91481855439ce26e7ee85e13304be46c3649dd83ce534132446a28ffc7f0d89e177bec378a5d5167c1420", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731667, "uuid": "6511ebe3-35d6-4a8f-8ef1-a520fd9cd384", "value": "T128D33B46FA408B13C1D61BB6FA9F414A3322DB94D3DB7306991C9FF43F86A5E0E26605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731667, "uuid": "b4430dae-13c4-440e-a023-d64fb9617ea4", "value": "3072:hlGpxllmptZjbSy5IAQY8VehGlaBSrM/9EEzv:hlGrGjSy5IAtwe4aBeM/9Pzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731667, "uuid": "e3603851-4d48-462d-a39a-a4b8900b30d7", "value": 139640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731667, "uuid": "12a74fa2-48b1-40a6-a9d5-48cbabac96ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731667, "uuid": "2f4c86f4-ead1-4423-9329-a986f5fddbe2", "value": "arm7-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a84c82a-baac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649801103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801103, "uuid": "2fe7ed88-58ea-4090-b0f9-1882067a633c", "comment": "Malware payload (Mirai)", "value": "eece7f74e102438981e7563ca605343f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801103, "uuid": "6ffb2a66-16d9-4b43-8f22-13ad1588f0b3", "comment": "Malware payload (Mirai)", "value": "72f3e44d5fb60796b33207c702b0aec5973c2fd055db32121853c69f507f6eb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801103, "uuid": "d886f737-7602-4f65-a656-e434d43510d5", "comment": "Malware payload (Mirai)", "value": "b4cc77933b5af92fb24532816777750d5100b837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801103, "uuid": "53e451f4-2d48-4fa4-9922-fba96349aafc", "comment": "Malware payload (Mirai)", "value": "ae92451eaf3794ae66999d7112a999436a83acc8bcf1563fbace55b135b5ccf19e5cf006021e6bb74d20fd68b747d673", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801103, "uuid": "65184a76-5f99-492e-b4b8-eff06e5ee3e6", "value": "T1C5732C56B8918F11C5D512BAFE2E058D331767E8E3DF72139E205F602B8A92B0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801103, "uuid": "c7d1737c-7512-4333-9d67-3e3341a776fb", "value": "1536:VLnQ0TnXZjk1TeCGjwjMjJgGL9lKgY1hjyafGOWQyMSiGyWHa4KL6na10:Fhww0INgGx4gY3jyaO3yWHa4KL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649801103, "uuid": "83417787-16da-47ec-8182-a757c5f10b30", "value": 76480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649801103, "uuid": "12e57f24-c94d-419c-9126-30f9c0ad8207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801103, "uuid": "00f82e00-ad42-48e8-9398-5b0198f38b5b", "value": "eece7f74e102438981e7563ca605343f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01d65e5-ba81-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649782778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782778, "uuid": "d53e523d-04c4-4fa0-be19-02ed26e0f8cc", "comment": "Malware payload (RemcosRAT)", "value": "8de6701daa7856f10eee1a666c16bee5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782778, "uuid": "2d992e3f-1eb8-443c-b558-cdefa8c48eeb", "comment": "Malware payload (RemcosRAT)", "value": "72ff20d5a7671aba37e0f9760a041a142284d9bc392ed7e82fdd8165a637a371", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782778, "uuid": "0c09e175-6d89-48bc-98cf-6f4ccf7f80fd", "comment": "Malware payload (RemcosRAT)", "value": "5fa2d2dc7c5195c5453152dece6135dc6cc71736", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782778, "uuid": "15a4ae2d-8c8e-4254-957a-294fb32dba34", "comment": "Malware payload (RemcosRAT)", "value": "bd38d6b986b5fc3a406ccafd195271135f83ea1bfcc722db7027d99d435ef11928fbca1db7c301e25eac5e999b887e15", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782778, "uuid": "4c6f4e1c-6c48-48fb-8a8d-5e7a61fad65e", "value": "T1557412EE782581F5DAB3A2FB29CE4684510DCFD7D217C662B7D5380E223629045EFA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782778, "uuid": "173385a4-8a6f-49c2-be93-23bf2eafd211", "value": "6144:hHDElrzz7msJox5LJroEw/l9Yw7DLtkWuLRTwCknP5zQP1WoNCKYopuwHQy+P3m:NDSDX85l8EUY6NqZkPtQ9WnwHQbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782778, "uuid": "f8db50c5-3d36-4d77-9090-f141c2911680", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782778, "uuid": "bfb51105-14fd-46cd-931b-0360c202b085", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782778, "uuid": "4af07a4e-b442-48ee-b4b3-206183fd411d", "value": "MLS20220412_0223.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7066d425-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vobfus)", "timestamp": 1649747774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747774, "uuid": "769293c4-5a99-415e-b39c-2e08253b69b8", "comment": "Malware payload (Vobfus)", "value": "beb7945cde363c400e3cb2154ef39c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747774, "uuid": "407d54d4-376d-4e95-8d50-e378efc8e93f", "comment": "Malware payload (Vobfus)", "value": "73332d6d7234daaf2666c373f815f5057f4456b54943dc33ed68645cf21003ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747774, "uuid": "75408943-fa9c-4956-94a4-cd1ac5ac586b", "comment": "Malware payload (Vobfus)", "value": "b90ea4730fe90cc3c3bdd8fe75266b51ddf2c7eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747774, "uuid": "56066514-b5b4-4828-84a8-4d5a622898ad", "comment": "Malware payload (Vobfus)", "value": "4a2a7f3bf293462347809e4be9129defb6f510b6fa298f449c6abafefbdabe0840a466ad63004c4f6b4013a5938f1d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vobfus", "colour": "#ADFE0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747774, "uuid": "905cb729-8eba-4a91-ba2b-1832853403e3", "value": "T17D14D3933B71B444F86465315DF786FAB782FC8D4A1741072B20366E6EEBE722D20693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747774, "uuid": "fc777c45-dacc-4f4a-94f0-f345c68cd97a", "value": "67c6cea725dad28f2fc079da02446256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747774, "uuid": "69e8f917-8067-4063-9ee8-83be206aba84", "value": "3072:mRKTo/05WzU0tQ9nLHbB9WBJiBs2HWWEaPGJm90j:mRT64QxL7B9WBJi+yWWEaU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747774, "uuid": "9f7c7020-b3b3-48ef-ae15-13a31f74e801", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747774, "uuid": "3ba4b678-4944-443f-b3a6-df589519a4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747774, "uuid": "235691c1-b4c6-41a5-a94f-bfe5c998c506", "value": "oecmnboovi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a54297c-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649767467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767467, "uuid": "08eb6a5c-ffb5-4400-968e-72d7f25e0a3e", "comment": "Malware payload (Smoke Loader)", "value": "39e50abfbe53394397416303df0c99d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767467, "uuid": "6c0284fd-da44-4da5-b45e-b49acee76435", "comment": "Malware payload (Smoke Loader)", "value": "733aa27b3ca43c299f47ff800e1e2b99bfe58a09f4807ca6227047a2abd3f552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767467, "uuid": "6931dad9-bd7d-4489-9c72-b2983b654fee", "comment": "Malware payload (Smoke Loader)", "value": "ff7b47fe6f7a10b00ab539dece9d625364d8b5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767467, "uuid": "f040e795-c85d-4de6-bb4d-6888862ba109", "comment": "Malware payload (Smoke Loader)", "value": "4cecab02e41d42c66beadb3484e12cdb068d902fb20d30966ffd0676d91011ef2d68657f459f4140c6abd9ae06034f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767467, "uuid": "657379e4-4f2f-4658-be0b-4f5eaa20e4c1", "value": "T15D948D043590C07CD12215B66925E2A95969BAF26E78A1477FC63B3B6F71ACBC830F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767467, "uuid": "f54a1421-f629-4f5b-bed8-a01adc3e1f03", "value": "b6f092a730d6bd84f6a4dcfaed2abeb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767467, "uuid": "6d96e6f4-ff34-4145-8785-ac10d351c235", "value": "12288:iM/VTRa3s3GC+3cZaCzW5MFSTl6J/I+erZV:L/9RvBa8LFql6J/IlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767467, "uuid": "42495da6-c1a0-4542-9d13-494146791387", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767467, "uuid": "c58d5e15-00a9-4ad5-9955-7f69ef554b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767467, "uuid": "b9983df6-7e47-4373-83fd-3c51a2ca478e", "value": "39e50abfbe53394397416303df0c99d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1c403d-ba99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649793004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793004, "uuid": "513982ed-341b-4da4-aabf-573de0f661c1", "comment": "Malware payload (Mirai)", "value": "c933da27b6c02c1decd5636146c326f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793004, "uuid": "9cc18e91-116e-4705-b054-90c1d0b89a62", "comment": "Malware payload (Mirai)", "value": "7351ed9c902e1ac13e97dc6c45e1feded18ec02e84a037d6c22b153a010e92fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793004, "uuid": "001f688e-6199-4c2a-abc3-24905d94fcfc", "comment": "Malware payload (Mirai)", "value": "e05d0293790d3662cd3cc83534d0bfb20b568e3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793004, "uuid": "c84f6942-24b4-4a74-9224-54e6629b67f7", "comment": "Malware payload (Mirai)", "value": "328b38de6a9b2e3120c6a71fa5069cbb7438d0b5c39d90faf925d63c5cb1fecb7c007fb18a6da7a18001e5733eadfd0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793004, "uuid": "ce02e1b8-ff12-4640-9225-ebcd18616750", "value": "T1F8C33B46EA818F03C4D62776BADF42493323A755E3DB33069D18AFB43F8679A0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793004, "uuid": "061ed1fe-70c3-4ae9-ae82-1b57c855ade3", "value": "3072:S7i1G/sQQVXOJlQgGvsPJXkwe2DoEf4ILM/9uR2w:S7i1G/sQQV+TQJvsPJXkr2Jf4YM/9c2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793004, "uuid": "1a1f85e9-a0cd-48e1-8e1d-b6ede67dce02", "value": 128604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793004, "uuid": "5b7880c6-8587-468b-b040-c949ce07c9c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793004, "uuid": "69084822-ef8c-4c7c-9dd8-2d85560d2043", "value": "apep.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9aeddba-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649746689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746689, "uuid": "5954dc52-2d37-4c95-945a-a4cf0cdb9273", "comment": "Malware payload (NanoCore)", "value": "431f2496c105d421442cbc956762e5a5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746689, "uuid": "f794f1a6-e141-41d4-a654-0faa02dcb14d", "comment": "Malware payload (NanoCore)", "value": "7368462f90520880913718b564c4f45ee6e5ee05b0423013b25287e136f803ce", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746689, "uuid": "8e0c132e-c65f-44dc-be30-ad9f5a81ffc5", "comment": "Malware payload (NanoCore)", "value": "8aa17c7b374056781e696489ecd9d70de9e0deb3", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746689, "uuid": "6ec9508c-e2b3-4127-a8e2-194b656382c5", "comment": "Malware payload (NanoCore)", "value": "1a1dc82970477d84a8f305f82629f7eb8c0dea4bf3959ba40af4602f2fe7e67e5931809c5d335a8feb647a02efeb0f40", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746689, "uuid": "d578a0eb-b790-4e44-985c-348808709ec9", "value": "T1BBF4E1117AE8861AD5FD17FDA03400804BF6732B5826E3797D4DA0E62F233D0DA46BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746689, "uuid": "ac344833-c384-4aae-82e6-56549bed8acf", "value": "12288:8kKUk6mf4qGEdTJjMSrLNYT6/k6YpdEHmPjpx4qGxgVgz:8kKX6mAqGsjMStYXBmCSCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746689, "uuid": "db7a8b4a-d442-4d75-8758-f866d7611341", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746689, "uuid": "c8fcd5dc-b70a-469a-9918-259c242918b3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746689, "uuid": "36543e45-f78f-40fc-81fb-94d945194204", "value": "PURCHASE INQUIRY_PDF___________________________________.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576a4c4d-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1649767489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767489, "uuid": "38f7ba96-f705-413b-9881-76e6a12db0ad", "comment": "Malware payload (CoinMiner)", "value": "eac13756acd5fa4c7840ab0b8041e7da", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767489, "uuid": "586f869b-4890-4b15-ab8e-9507a9b5626a", "comment": "Malware payload (CoinMiner)", "value": "73ba7dd1dcb98341a4477ef2bcb93fcf12a3f1aee33ce155b103f1fa7612c6fd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767489, "uuid": "f2a034c7-b54e-499f-81bf-15194ded681c", "comment": "Malware payload (CoinMiner)", "value": "dc4672bfaee97793c63839f7336d081d9f6e16ae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767489, "uuid": "c04ead81-4ebe-4ab0-9764-a292d67f5736", "comment": "Malware payload (CoinMiner)", "value": "d932439d770ee930afe438c61ab64ee4b37c2aa66ed6832b98dd6129c8f490704a5f79700eab22b2d3c3b58daaac87ce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767489, "uuid": "62989f87-5759-4aa2-b959-f729842c7bfd", "value": "T14DE502BE62443708D01AC9345133AE4AB2F5152E4FFC95BEF5EBBAC07B9B8509502F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767489, "uuid": "902c870d-7b06-4aa6-85f9-954c7b54fa2a", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767489, "uuid": "01b46cc4-724f-4f42-bfd4-6867dcbe072c", "value": "98304:BcNFS82Y0SN0UIbzlEVaaN5yIHGHctOwz:BcNFS8H0SWbRaTzmsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767489, "uuid": "555dd7a6-9e89-465a-a8c1-c5583c8b84ad", "value": 3291080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767489, "uuid": "c8fd71ed-e297-4061-b911-a612f95046f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767489, "uuid": "dd25241b-1c2a-4f95-be3c-e3f7c31c29c7", "value": "eac13756acd5fa4c7840ab0b8041e7da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353fe650-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649766573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766573, "uuid": "cd90d490-d80c-4aec-b54e-8cbf0daa33a3", "comment": "Malware payload (AgentTesla)", "value": "2ed9e4b847d4798713e5c6f5e1efc6f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766573, "uuid": "685e2798-f5fa-49dc-bfed-87b2b9d4ffa0", "comment": "Malware payload (AgentTesla)", "value": "73c64cc8fcfb9a95a1a7a4caf2f42c48727ab4a557d34d1fde2801761878a794", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766573, "uuid": "2e25b6a3-4ab6-425b-980c-1bb468cd3063", "comment": "Malware payload (AgentTesla)", "value": "da5c8742498cad5fd118b0c3f48a76cbb1e6f784", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766573, "uuid": "5ae7f9fd-7275-46ca-892e-e4ee5ff8354a", "comment": "Malware payload (AgentTesla)", "value": "d39f92aa2900ac5679931b72c835fe09461a2b1c8521cc3385407d233e554d183d7048113703eaf0fcf0508090ebf75e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766573, "uuid": "37090546-d30d-496c-bd3a-72346488b668", "value": "T16444225128C480AFE960AAB11BB243A7A7B7FF011761062B939D5FFF9E710C7D109746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766573, "uuid": "c2aa752e-bbf7-4f80-930c-a9bbc9302651", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766573, "uuid": "a0c27fc9-7e3d-4c94-81bd-639f1ddd06fc", "value": "6144:8Qq+fuWK5qsgSyTVVErC+CLtY+hWr2CMMZMvCSPmCOci+:TGWK5ETVVpDkSCM0MvCSPBG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766573, "uuid": "e679bd4f-db53-423b-b894-64eae619e8dc", "value": 270070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766573, "uuid": "23295db0-c00b-4013-97ab-df0987003763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766573, "uuid": "3ce622e8-3063-4268-8ca8-26456d6c2ed4", "value": "2ed9e4b847d4798713e5c6f5e1efc6f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec4f104-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764012, "uuid": "760ebbd1-3047-40b0-8d05-6009b3a605c2", "comment": "Malware payload (SnakeKeylogger)", "value": "0da15373eabede8f52245ef830d312f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764012, "uuid": "f3cfec7f-cc25-4f81-a6fa-74ba62bc4340", "comment": "Malware payload (SnakeKeylogger)", "value": "73d38ad110eb78ec1d1c3510f2508c514ded9d52ffc5a01210310c5f789392b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764012, "uuid": "2db605a5-60f0-4605-8b11-87bc2d1046cb", "comment": "Malware payload (SnakeKeylogger)", "value": "c7781e33383a542bd029a0bda482a063cca4dd76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764012, "uuid": "f244d16d-7aa0-4814-a5e0-a324de50f26b", "comment": "Malware payload (SnakeKeylogger)", "value": "d01dd21259abc6fa32ea06b23fe7cc1857f6f64be2d50375b7cd7741aa1e73a8e18c7c7ba7ab7760a21abd346413da22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764012, "uuid": "b5111486-142e-4ffa-9491-739867ef7e01", "value": "T10BE29503FF6DA0ABF7642FB744125341BF65A10AB422E70B5E113265FEA13C37D92629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764012, "uuid": "9212dc54-4bad-4948-b38f-d3babd61cc30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764012, "uuid": "385241a0-4138-4963-abc9-1a8d4051a71e", "value": "384:l1wCqbyeffffffIAd02OP2HTeHfZMiZwj:l1XqDYAdOrMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764012, "uuid": "53564950-cae6-4274-939c-0f84dc19231e", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764012, "uuid": "3dd8e96d-5851-4c9c-81f4-dcc6aca28c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764012, "uuid": "097b13c2-2054-4199-b9d8-b2b9cce50588", "value": "order confirmation 46574 -QT-04-0022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fae729b-ba4a-11ec-8e58-42010a9c0032", "comment": "Malware payload (sLoad)", "timestamp": 1649758806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758806, "uuid": "66d09fc9-e094-40ab-9e3c-2b84d06f6006", "comment": "Malware payload (sLoad)", "value": "691b27c81af6bbc4949ce712849bf09e", "object_relation": "md5", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758806, "uuid": "aebf4d77-f01e-40ef-9f69-1bac7c5e0855", "comment": "Malware payload (sLoad)", "value": "740a740e3a639b23d922f5b41ba6f816f3e5c563fdb619632d7840d96b423b77", "object_relation": "sha256", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758806, "uuid": "e646149e-2e98-497a-bede-12679a8a7d09", "comment": "Malware payload (sLoad)", "value": "e9442ab034f00d05a9f8e0f3ce6413380eaf59a6", "object_relation": "sha1", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758806, "uuid": "cb88db97-9f00-47f5-9330-dd2b3ac81cc0", "comment": "Malware payload (sLoad)", "value": "f80b2097068d0aeeb64047819f8fbbfd136e4890787fe22a5da2058e844a20d0bddea0305dd53d29c5315b17c451b80d", "object_relation": "sha3-384", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758806, "uuid": "1c865913-addf-4307-957b-c34d352075b5", "value": "T1FE41130277F91548F6F32B825BBF68719E3BBD662819DA4E1084110E09F2E408CA1FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758806, "uuid": "bfc4aefa-e8be-4ea5-9bc2-40e58806b9eb", "value": "48:MOOAHrBjqlLPbfhixbHf096CG9ccY8cWt1dSnh6kpL7yUDAtelb:MOltjgL4x7fhCG9nY8J4h6kp6UMteJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758806, "uuid": "40804a63-c230-43bc-b221-f121d9270819", "value": 2236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758806, "uuid": "41c910ca-861f-454b-b58a-e1006a37c4b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758806, "uuid": "9cfef3e2-7f8d-48ca-a48f-4339aac8821a", "value": "EOKxBsVy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3368fb72-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746384, "uuid": "f2b16899-be64-4e0b-b8b1-3d476659a596", "comment": "Malware payload (Mirai)", "value": "e23d4464b67334a7a91e1f87b62d3b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746384, "uuid": "0dc568b2-065f-4502-9dab-4d3baf9e55f2", "comment": "Malware payload (Mirai)", "value": "74894a4c0f8dc04e3d58152b9dc336b09fe98c18570449b3a993529fee593a8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746384, "uuid": "4db162ba-9046-4140-b7ad-c28c86671a04", "comment": "Malware payload (Mirai)", "value": "4c7fbf5f92023e7646c8fc3393b7c5e082bb26e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746384, "uuid": "79b2ca2d-bbb5-40ba-8426-c7973dad53c2", "comment": "Malware payload (Mirai)", "value": "1e6ff026ebf00c858797fb9c9f180a42dc404808d055bee9f9856914f8d36135c68630a612675fa1637603e88ddeef35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746384, "uuid": "4469806c-6652-432e-9c77-bd7abc8ec797", "value": "T19CF2E13475460CC2924118F4656B611CB1D42F7DF1EA62AA6735537EEFCB423A2BEC1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746384, "uuid": "8c4efaf6-8d2a-4842-af89-12f356a752d4", "value": "768:QDfp/5rSu7p+8/dfG3Wt3tkufVaBVsn9njcQyjLGCisa73Uu:QDRR9dfG3QfVaD+nAHjLGCiLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746384, "uuid": "3de9167b-4f98-493f-b755-36fdb0c07d34", "value": 34856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746384, "uuid": "a89ff67c-31ae-424e-aa9c-d6ed011fa649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746384, "uuid": "675f69df-2426-4cf9-8b29-fc5818a45f10", "value": "e23d4464b67334a7a91e1f87b62d3b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d847b8-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736395, "uuid": "10a602c0-9382-4dde-b869-9f4f4d62ad2d", "comment": "Malware payload (Mirai)", "value": "17ae080ee619a6c9e1d3c6006d5cfd07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736395, "uuid": "0e081fc2-9a5d-4607-a385-c5c357ee43bc", "comment": "Malware payload (Mirai)", "value": "749f454ada7f0ace688c25ad34ac443db4eabc95c4097e5f8455bc83db2ffb11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736395, "uuid": "6a9f88c5-a485-43f7-bbf1-39e58cf01480", "comment": "Malware payload (Mirai)", "value": "c8569d8a7b1d6dd4ceb64bd3adcf2fd312e194f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736395, "uuid": "e605afa1-e330-4274-9852-a18772c25bf5", "comment": "Malware payload (Mirai)", "value": "ad372870a487189d7fd7ee247c3f1a6e85ef08b4ee571a967dc14042b3891c4d5bbf4825ff64cf040b870500d2b97706", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736395, "uuid": "57fba16d-cf92-4b9e-a79d-35d515451dc6", "value": "T1D373AF75C4ACEDA4C6154638F64199399B13A00DA5A33EFAEAC2C652505BBFCF1087F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736395, "uuid": "fafe4390-5e13-4980-bdde-740f7b0fba5c", "value": "1536:a/bMSvMJaalwtcbLDIPw9Ljrsqf26nHafs38u8TSxVWCIIvr:aTM14WRLDIPwBff266f+pBxVWqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736395, "uuid": "e5fca434-e642-4b93-ba08-94d4feb5840a", "value": 74828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736395, "uuid": "b8278b1e-6b3b-4571-88ed-b3c44564a79e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736395, "uuid": "700da97d-a714-45dc-bf22-48772d916d01", "value": "17ae080ee619a6c9e1d3c6006d5cfd07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a46efb5-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746341, "uuid": "4586c03e-9382-468a-a77d-600612ee88d2", "comment": "Malware payload (Mirai)", "value": "d0f22fa9030f43612986becd307d10d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746341, "uuid": "df2b161b-ec22-431d-85c3-9014ef21e35d", "comment": "Malware payload (Mirai)", "value": "74c0f3bc2b24a9c528b515a3e64c6489ea727098d0dd2db26161626e0b73bdda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746341, "uuid": "45593204-1fb9-4033-9415-118f590004c6", "comment": "Malware payload (Mirai)", "value": "7037954a929c2d66e85f2b2de00c0c2317924d56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746341, "uuid": "2ce6451b-8197-4d2c-8926-40408cf92174", "comment": "Malware payload (Mirai)", "value": "b302e05903955cc3f359c04bf2c0133793b3f2a80c5cfc2cd06dbe4932f44f39e4d2ff4121cdf85ad68a2e493a6b78e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746341, "uuid": "4b81c8d3-42c0-4066-a203-49fc6e39fdeb", "value": "T1B003E161BF39B475A6110A7AF1F5411373C85FB4F4F962722BAA84D04AC2C87ACDEC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746341, "uuid": "04a85a25-ed12-4a76-8dd8-9375cf4ebe58", "value": "768:4oUjl83vcXwXtFjlluOILF0i2wSC8uI6FuzonmS2gn6zq3U7oE:r3NX3j7ILFSwSC8uuc3hn6Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746341, "uuid": "99cb9bc5-db29-4276-aaeb-68f1a9c7208f", "value": 40264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746341, "uuid": "e913facc-e66c-4469-899c-f2971f5b02de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746341, "uuid": "b8a6bc62-9910-468e-b8fe-3745c8377b17", "value": "d0f22fa9030f43612986becd307d10d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae0b7f5-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766529, "uuid": "ff5fec75-1584-4c15-b304-d90c8c5968ff", "comment": "Malware payload (Formbook)", "value": "fcaf1de8fea0ac779b0abc17a1029969", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766529, "uuid": "346b4f29-aaa4-4a98-b6eb-293a251b060f", "comment": "Malware payload (Formbook)", "value": "75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766529, "uuid": "b9aa1688-5e95-40d4-8813-b6c5ffaa8be6", "comment": "Malware payload (Formbook)", "value": "f99793f1d32f992372abfbabb8c79e25a2753c3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766529, "uuid": "0749b319-b6f9-4516-8261-5d6336185a67", "comment": "Malware payload (Formbook)", "value": "bd864fc95198671fd4adb3806d5e2ef549040a3328cb82aae1e9487db03726ca697d65e7db514ff730be102d3afcd8f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766529, "uuid": "2fbbbbec-f140-430a-8229-3feb85f6ac1b", "value": "T179E48E11A2614F33D93F2A7A4C0B569E5933BE132D1CABD73BD0AE4C3E71581792A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766529, "uuid": "58f7559c-ccce-4eff-91a4-64cad8fe8275", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766529, "uuid": "d5a6cbbe-5ebf-43d3-888d-b27acf00f959", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2hZec4qO:wkKHuoE+/vI0icJskhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766529, "uuid": "8a7ffdef-7ba2-46fe-8d29-2efff8664dc1", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766529, "uuid": "888805ab-704f-43a0-8918-91177c22c383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766529, "uuid": "73ce348d-4de8-4f96-8d5e-19dd57016760", "value": "fcaf1de8fea0ac779b0abc17a1029969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d726c4a0-ba3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1649754389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754389, "uuid": "d11d8028-f8c8-4c9b-9de9-5d2a68dc6e29", "comment": "Malware payload (CoinMiner)", "value": "dfc3e56cc6384a5f49069a49d658a987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754389, "uuid": "ace885be-4b96-40af-a457-573dfc7beb6d", "comment": "Malware payload (CoinMiner)", "value": "7656ed477671645be99bd254dc2547709e6545b2fc40124cd2bc4fac38d18447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754389, "uuid": "dceaf1d8-8831-4e67-9163-4ec9003a6bdb", "comment": "Malware payload (CoinMiner)", "value": "75294fc109314949b1b5d00669d4b73a323e290c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754389, "uuid": "6164988e-86f8-48bb-9494-c1d9613bd405", "comment": "Malware payload (CoinMiner)", "value": "74d765281e5657092f0b3f53019406621aaa1f21d65f38892c2354f755e420e543de863a315ed2fb51d5c783d4892473", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754389, "uuid": "e69c2343-b306-41ba-b348-a099bf7f60ff", "value": "T16716AE12BBD58F2BC5564B388AE783647379DC904B43575BA34AB12D3DB23E02B871D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754389, "uuid": "98a8c853-bb83-4976-b8ec-48f4593c75a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754389, "uuid": "5de61bb5-2d8b-4935-af3e-d1eb798efe4e", "value": "49152:nNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:NzP88fBsnZTgOtqB3m1RC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649754389, "uuid": "0cbf4ee7-19a1-4277-b0ca-4e8fbfa99085", "value": 4164096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649754389, "uuid": "a1244485-8dc0-487b-b89d-df31f55b1463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754389, "uuid": "f8c26030-1c16-4804-b5cc-16d90d1ace01", "value": "dfc3e56cc6384a5f49069a49d658a987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e357f903-ba05-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1649729499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649729499, "uuid": "5c4a12c0-2fe6-4e9f-931f-6f4a4d1c252a", "comment": "Malware payload (CoinMiner)", "value": "c992b65aa7750258a6a6d1006ee7afa8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649729499, "uuid": "4af995a8-aad6-436c-a404-824070d67df5", "comment": "Malware payload (CoinMiner)", "value": "76c2553a6e64ced12440f7829df0a9a1db3476c93f136666413728f3fea8f2b7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649729499, "uuid": "6ea763e9-5459-43cc-a6b1-9df6827fd23e", "comment": "Malware payload (CoinMiner)", "value": "22d55853a57e041f887c1b1c455ccd60477d1c87", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649729499, "uuid": "2158bd65-20ff-4499-89e8-65a071c7dac8", "comment": "Malware payload (CoinMiner)", "value": "c151b40e241bc4560f13be441e8bd6a2b1ec405100c04d1f98da69d5da00fec5651458bd9f5fd4a749852d6aed233d22", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649729499, "uuid": "1d91bfe8-beda-46ac-a43e-5102c71bc4f6", "value": "T16DB633FD6144378CC41AC434C523EE88B271552E4BEAE5FAB1DB77A0BB9A435E602F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649729499, "uuid": "1c9c478f-42ac-46a0-859a-6b69a290dce7", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649729499, "uuid": "93cf6369-5a2a-4c26-b563-76aea9d0219b", "value": "196608:dls2j+LZYizGHERUMhKGpvNnzl8pt18ER8Ve3hve6OtfNf9RGD:82ilYUGHTmKGpvspj8S8kRW6KNbGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649729499, "uuid": "6d1e4c61-03bd-4b14-a2ad-a6fb744f9a6c", "value": 10782152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649729499, "uuid": "630a5452-7eee-4f84-ad31-ff6d6dc8bfe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649729499, "uuid": "eb489314-b345-4103-a705-0a95e2097606", "value": "c992b65aa7750258a6a6d1006ee7afa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825c12f1-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649765843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765843, "uuid": "170c38e1-27e7-491e-aca4-520b922974c8", "comment": "Malware payload (SnakeKeylogger)", "value": "c61f46ff55cea36c0937d998b9eecaac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765843, "uuid": "3ce596b5-28d2-4e9e-9fee-85e967e3951c", "comment": "Malware payload (SnakeKeylogger)", "value": "77a13762e95934321fdacf38c4ba9187d1b38dac2fb300d8354f6c4cf4859ba0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765843, "uuid": "3ca37ffa-f9be-4e8f-a0ae-0c17d90b7e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "70301b9c6d032d28857cd82e5db75769ca65d642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765843, "uuid": "4c206b2f-ee92-4cf7-abc2-5d3e9931c0aa", "comment": "Malware payload (SnakeKeylogger)", "value": "1e62bce827979db87416820b59817171bcee30423292eb3efcaa4f0e2d81b3ceff57017c2a5efe0aaf96105dee351969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765843, "uuid": "7b5ad929-16fe-4d15-9bf5-8a1837462925", "value": "T1D0E4CF19F6A6CD12D2A5177FC0E7080407B0AA46D616D76F3B99A2E51E133EB8D0339B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765843, "uuid": "d3a339e7-be82-4ea6-92a7-01bf11460977", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765843, "uuid": "185f2fea-8545-4dfc-9ed5-e4e8c750db57", "value": "12288:frB44jjUu44ekfPmE4qZg2g6+DaPh0HNohN0yuCzWnb+0OsLpsqqaCmMwsH:t/Ur9wufq6hkeAayGb6KqaCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765843, "uuid": "9a3559f2-6ad2-44bb-8c77-a136f209ffaa", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765843, "uuid": "e4a3bac9-5d16-42f7-b58a-ad315ea08301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765843, "uuid": "32b3ab19-59eb-4c60-8de9-9469f2840c73", "value": "Halkbank001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c05e416-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764356, "uuid": "85167650-b58d-4d5f-94ae-c06d37362c65", "comment": "Malware payload (Loki)", "value": "653645f0bbc3b1b4b81033a78ccd585b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764356, "uuid": "3d7d6b75-4c2a-4b4b-b009-20d895c8c884", "comment": "Malware payload (Loki)", "value": "77ab59cc7329c7ddd4252b39b1b4483862c82f0962d0d61df1c28351bd5efa3c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764356, "uuid": "13b9184e-f2c5-4038-8d1d-be1431f5c29f", "comment": "Malware payload (Loki)", "value": "c167b710c12ee7ed4d174466136d3fbc36ebae6c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764356, "uuid": "7bc69926-6218-4ce7-8153-4809d510369d", "comment": "Malware payload (Loki)", "value": "2da2aae4ee999d60fe0e6ef1746ed1b23bf3cd67204ce7ef0fc05a00425c2a9d30be4e456b91b08fea1237342d958f25", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764356, "uuid": "f0c4e4a0-0b37-45cc-a7ca-e023a6457600", "value": "T12A742320FD50630BE63355B8196F90B1129CCFBAC791B0C6F4127BAA19B2FB24C657D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764356, "uuid": "44e9276d-beec-4926-96b5-f86a1e0acd10", "value": "6144:FQLjrKxhe49IxfCikvWf/rveyZ6uDduFFk8JCA52eQtbJVivItLzEWl:erXhfCjieyZ6uD2nJCM2jbJAvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764356, "uuid": "b0fa8e4d-a5ab-4491-977e-98579887a80f", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764356, "uuid": "44c0e009-c71e-4c5d-ab5e-748153956e33", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764356, "uuid": "f2e6bfe4-c8b6-426d-b88c-208dcb763dc0", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501cd9e9-ba99-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649792817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792817, "uuid": "e5d5becf-bc80-40a1-b2de-352b1bfb5a36", "comment": "Malware payload (SnakeKeylogger)", "value": "30bed8890c39e983e2a6b4f4e04edd0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792817, "uuid": "95cf8fb9-c79a-45fe-9dad-9eade596e473", "comment": "Malware payload (SnakeKeylogger)", "value": "77cf402c8513d6df7dfd03896e08c6938fae41bf60d979e9bebf76d833f1b829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792817, "uuid": "76ea27b2-081c-46ce-bdc5-51af8bda4ba6", "comment": "Malware payload (SnakeKeylogger)", "value": "a293ee3cc2ce151f156127d466b802fdbbdd8f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792817, "uuid": "e0f8181d-53e0-46ac-a291-79a4bb61c8c7", "comment": "Malware payload (SnakeKeylogger)", "value": "14fd4a01d4043501cbbbad826e81915cc55705646c3fb8ea497d3a01ee6f3ae9ee7163608ff052898e5c575f4b14841b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792817, "uuid": "1d4ee57d-160d-44e2-b44b-8a2b0511515a", "value": "T19EF2B603FF9CA2ABF7642F7744215341BF65900AB022E70B5E503169FE623D37DA2669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792817, "uuid": "36d23169-9fe8-4d61-a964-a5b45f526edc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792817, "uuid": "9d0ca3e2-3142-4b13-9a40-4197162751c7", "value": "192:zTeVHnAzFWCDtaez1xOFmOnrzrYgWIQrX+eHBj74jDr6ffffffBw91qqR:+VHnAz5DQLM+XyIQrOeHa+ffffffBwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649792817, "uuid": "e809bea6-1ccd-419d-b2be-051b45bd4719", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649792817, "uuid": "b77beb66-58e1-4856-9273-6af567560db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792817, "uuid": "3ffac0bc-5a69-4e18-b635-1815bd7f5143", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.GXA.genEldorado.18172.24445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f059bc-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793277, "uuid": "dc139177-dc46-4b29-9ff6-9aa255d4591d", "comment": "Malware payload", "value": "bf172d271eef4b3ededb87dc2756b390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793277, "uuid": "0f23e648-7540-4638-b9f2-3e6acbd20251", "comment": "Malware payload", "value": "781274188451c5a4f684d7519a2260481a568c49ad670b1c69ff31c8dfd4ce7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793277, "uuid": "dc8a4081-2c5e-4534-a6c1-5749a71975fa", "comment": "Malware payload", "value": "e7fc207753a4e313cf955042fc71731f554aecf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793277, "uuid": "20f2008c-f234-44ad-b399-08ff7eb791eb", "comment": "Malware payload", "value": "26f4c2300199b83727a135e6dd83ee62f5087a680b5bb23a1acb2eea9e0b10cfa69eb6cd58f709a138a4d7d2139df743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793277, "uuid": "62cba04b-2653-4a53-8e26-f1405c9969e4", "value": "T1024423ECD983A4B73D3186BD71D936D940ACE1ED823E3A22E346A15BD25E053BC84D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793277, "uuid": "cbd1a452-113e-482d-9b1c-b0a449813ad0", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCPhhhR//mqYy:mZRgUY/fsJcO1KOiXOhhhBey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793277, "uuid": "fb1f12aa-56f4-483f-a0f8-03827c05ba1e", "value": 253364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793277, "uuid": "561bf731-04ca-46f1-ba74-cf6d45af83b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793277, "uuid": "ac79acaa-b809-4dc1-aebe-b23a276224b3", "value": "intelgeneric4.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870d66a7-ba84-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649783890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783890, "uuid": "26d1f94b-cabb-4912-9dc0-3212835aa066", "comment": "Malware payload", "value": "fefa2a7c28380b29687c3b6e3c27b3f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783890, "uuid": "539195d0-3c3b-4293-a745-3c1b13c72e49", "comment": "Malware payload", "value": "78440c8aaf49191ba9a5a13987c467f7f0dd192e500661543f0590eea20f1773", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783890, "uuid": "13fa3b5c-1ce7-41f9-a179-0098385c83b6", "comment": "Malware payload", "value": "843697cec2543d5f59c6fc4aca14456ac2b9d30e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783890, "uuid": "164dedea-7904-4ea0-b765-ea048c132db5", "comment": "Malware payload", "value": "290275fc57c9ca97f340317d78b5b96a2c1da73aca1b6cf6163b6016d9568c45d293ae5a2dd465ce36b6642184a6a6b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783890, "uuid": "e7f58198-664f-4949-b038-792a381463a8", "value": "T1A3B4CFA0DA4439D3D0555BB4C492CCB036E9B39A821CF789BCB5FA592EB11C2E111F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783890, "uuid": "15170f88-cd50-48e1-b31b-dbcbe868fe3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783890, "uuid": "99959d12-9f97-4525-9181-670f1c540eaa", "value": "12288:g/3JrxzYSL1z54fTQU97aXmgit1ltbKeOuQbeK5XCNXdjmqM:gRPl4bF9MmbxtbzlK5otjmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649783890, "uuid": "4c8ab1b7-9c5e-4334-b381-a750f0c2dc41", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649783890, "uuid": "ca6c70dd-4b17-400c-86fb-9fe14040c261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783890, "uuid": "8f2687c8-1238-4331-9622-40824538e6c6", "value": "Paid invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a54cf9b-ba01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649727605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727605, "uuid": "dcabd03d-25d8-4b11-9bd5-446628277840", "comment": "Malware payload (Formbook)", "value": "85e629089a26685855c717904a5b8611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727605, "uuid": "c5f6084f-94b9-4bb3-9ad6-5d8f542c72de", "comment": "Malware payload (Formbook)", "value": "7958c384ea86aee2409be9926ee79289ec9f35e56a64ad78d00a03b25a1fb528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727605, "uuid": "d0167401-ef74-4308-b333-fc4a501a40f9", "comment": "Malware payload (Formbook)", "value": "b8b50f075d3d40cdc985d9194e0a07ed02902430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727605, "uuid": "a7731830-b987-4650-9f29-60e8657e2945", "comment": "Malware payload (Formbook)", "value": "0b54cf3a686fb78591332db051e4b3e258bd7f9b59395036ce2e9606a65cd002610162ecca827fd83217e596d129b440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727605, "uuid": "bbf8d261-175d-47f4-8d3b-c5fd210d1fc6", "value": "T1F0051250E2EEECD5D81B4378A876A91816BBFF5E152CEA012DF674DEA0323C22455D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727605, "uuid": "8dc2d5a3-39a2-4e90-a4f2-237d43e898ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727605, "uuid": "9721c437-0ef1-4829-9623-570f28e94de9", "value": "12288:+80WVrVp+Yq9ztZas7nWqz7WDvmwWq9IaMqgRTs599Ho3Rxap0+TINJCkghDo/ti:8b73WK+Ia4AbIBWTFLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649727605, "uuid": "d05118a5-c977-48bf-8042-0350e6cb8dd9", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649727605, "uuid": "b2c03f2c-5c81-46ee-b726-d7742bf57a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727605, "uuid": "3d7278b9-8513-403a-a1c1-d06712f194d1", "value": "purchas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f65b38-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649744943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744943, "uuid": "0584d60d-9d44-4ac0-92d3-286ce15f7971", "comment": "Malware payload (AgentTesla)", "value": "214914d6143dce63b1bc0b67233fa978", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744943, "uuid": "8694f8de-2713-4481-b91b-8efdc65dcb0e", "comment": "Malware payload (AgentTesla)", "value": "79afc333fdba27044f3884f972fab026d73d7ffe8120a77cb267a26441bd6e61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744943, "uuid": "1c29b375-dd13-4eef-a1cf-f180683db92c", "comment": "Malware payload (AgentTesla)", "value": "8f9f615cc4da332f8aaca04e7d45bdbad8b466cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744943, "uuid": "b36d586f-d492-4397-b6ed-65c1dc062e18", "comment": "Malware payload (AgentTesla)", "value": "ef1786a005f345706d5a9ee3d4e0b90b078ffde158ac85a177bd46258e1d4f312fc35c8072c9669fa0f093c8ad5426e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744943, "uuid": "66e2fe24-84e2-48fc-ad37-ff84ddf8a05c", "value": "T10415332ED6A62844E4F714BE37874B0DCDB36508DBB4A80BDA1F133545A1FB9181B93B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744943, "uuid": "2cd978a1-76b2-4cad-923f-b0a81a78bca4", "value": "12288:xr6MyY5lzTP9safeFZ/eplfu34pQ2W0TDbFW2A6maYQjjPloIG1pkVnt74gwVR05:F6MyS1HfeD/eLj3pW0yg6pKpORbV/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744943, "uuid": "6a17f1d1-5848-4ced-8d6e-03949c811984", "value": 909746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744943, "uuid": "afbc3722-8d8b-48a2-9f7f-a26e0b094c0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744943, "uuid": "33a29ab5-b1e7-400a-bdea-0a5b393ba34b", "value": "SOA UPDATED.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56017481-ba9b-11ec-8e58-42010a9c0032", "comment": "Malware payload (XpertRAT)", "timestamp": 1649793686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793686, "uuid": "2d1af7d3-f2e9-49a8-9581-a08f0d0c69c4", "comment": "Malware payload (XpertRAT)", "value": "f6791118160f20fdabe7551a92d2273c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793686, "uuid": "2a6a636b-e6ed-47a5-8c22-7145391943c5", "comment": "Malware payload (XpertRAT)", "value": "79d55a99ff2f41da092fba879ab1858a9f68619c50eb9b65eebb1b45a500e3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793686, "uuid": "e17ee625-d764-4de3-8236-227ac3f120d9", "comment": "Malware payload (XpertRAT)", "value": "ca101b92d768d4884c9de4563921b0f4d9543b62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793686, "uuid": "09987a88-e9dc-4e8c-aeb0-fa6d613cd789", "comment": "Malware payload (XpertRAT)", "value": "902d58f4dfe8fd61b3c8de6548e461ad67914284fd32edbd408171f2cfe2cfbaf47eb89c3fe79a647411d255671727cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793686, "uuid": "280f8dd4-e176-414f-8c1f-20ca9a2753de", "value": "T1DEE4E2168D569423F8390FE52867549C56E7C38DFD7FBA3A1BA360902397A1C790E3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793686, "uuid": "94762977-a55e-44e7-a86a-a7a43df39aad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793686, "uuid": "22af5b40-0550-43d1-bd6a-d8ea230e0676", "value": "12288:meuKBxxxxxxxxxxxxxVxZjxPvtGDPrv2FDLOIzf+2gs8XMT2nH3vwXFfxBw8Yxxe:BBxxxxxxxxxxxxxVxZjxPvtGDPrv2FDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793686, "uuid": "57ba5017-76d0-4f70-b330-312afdeaa7b9", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793686, "uuid": "24c6c135-6899-42d3-ad08-399448d007e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793686, "uuid": "ea46e807-4dc2-4ad6-b4d8-4cab36bcc54a", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec1e305-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764066, "uuid": "ff2b5ec0-b87e-46dd-a296-0184f49c6cdb", "comment": "Malware payload (SnakeKeylogger)", "value": "24e7408a718002782daef352723e4ff0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764066, "uuid": "4f011f08-e722-4cb7-8285-eda447701cc2", "comment": "Malware payload (SnakeKeylogger)", "value": "7b2a36e3ed483d460acf214ce8c981b12f462e83264f110d43c6933f90c359b6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764066, "uuid": "21acb1b6-efa5-498c-915a-a3137bcf0ca4", "comment": "Malware payload (SnakeKeylogger)", "value": "ec9ce9ce8dc72e808698b71c41ddfc1a369d9865", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764066, "uuid": "fdd85be0-bb43-4ebb-9896-3b62f2cd715a", "comment": "Malware payload (SnakeKeylogger)", "value": "4cbeb92d8c97c7b732f01962c5813532090a209cfc3c93ad7cc6ffb8cca5184e47460eb0841be9d8b0841cb78bd77317", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764066, "uuid": "e1c50ddc-ba06-4845-b478-fb3fdff25ac5", "value": "T127F4011CE1AC6DE7D42E45F85821E00413F2E72A962EEB996CF6F4A760717C32426D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764066, "uuid": "80b833ec-58a3-487d-b683-69411cc73d68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764066, "uuid": "76c7af66-402b-4ce7-b64c-2033cff1f584", "value": "12288:gFZ6eziVIiGbT2jlfVn4bxtj7+tSdcGZSZlxoHiYEhjowT5FVgP9DpX5O:ylWVIiGbT2RfVn63v+tSvZi/oCVswT5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764066, "uuid": "235aff36-aaa0-41f1-98af-6b3eee5a5c85", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764066, "uuid": "5c512b1b-80b6-4070-ae9d-181cf4e8401f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764066, "uuid": "ec28d636-8c98-4e66-b320-8d7a66ae756f", "value": "Products Inquiries.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f085d959-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764310, "uuid": "ca6a38af-642a-48ce-8436-4003ece2a6a4", "comment": "Malware payload (Formbook)", "value": "6f4277ad432a80183237109c3abf15a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764310, "uuid": "e271d1de-88ef-484a-8790-dd4be12ad07a", "comment": "Malware payload (Formbook)", "value": "7b8928238db13aa8d6f049073f36bd027b4aed354be6f0ee4a0daef304364809", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764310, "uuid": "bf9bc53a-27b1-4c2c-a6e9-5d0d01b5dfa1", "comment": "Malware payload (Formbook)", "value": "fbc2ea6081adc22f8ccfb023dbe22f0a628277ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764310, "uuid": "8c87c1b7-bad2-456a-bee5-33f731af1956", "comment": "Malware payload (Formbook)", "value": "dd51dc6c2d7960c4ca9011c2c22c0bc75e44522e652491d54efc7dba49edff35af368a17bc6bbb5e67701a5ed940c186", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764310, "uuid": "c86c553c-7d15-42a3-8fcd-ef1dd59a1383", "value": "T1137412DE7F65A327DBC28DBBC513836A5D16DD22330894A606003ED24AB8676443BC7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764310, "uuid": "ed002b0b-1197-4485-9925-26e64374a481", "value": "6144:sJf7spXBONLMILs+kMB/h+UXkx//+AbhIBw0qVnJFmuplwtOx9A:K7MENXD7HXkxXzI+VHNwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764310, "uuid": "4dad09b9-d3ff-4b46-8d3b-0a224fe720f3", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764310, "uuid": "2cb245df-fac2-4522-a5b7-14f5beb400d2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764310, "uuid": "a559fd7d-8008-4dc5-82a6-5341f6aa365f", "value": "PROFORMA INV-98876374.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855d4c24-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649766707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766707, "uuid": "4cd17334-0127-4cfc-bcaa-4b6e920f6f1f", "comment": "Malware payload", "value": "ae4b46ae7dff6534843f0007f045dbd6", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766707, "uuid": "e7caaa16-78b0-4f21-b8d9-e439750bc1ec", "comment": "Malware payload", "value": "7b8a3db8ad89f6f0ef0415fbbd6befce941821f8afa58adecaa0d4f78676a689", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766707, "uuid": "37f1b9c7-b2be-4e78-b549-c0315490e590", "comment": "Malware payload", "value": "ac23f123045396b875746f8c6f110da06d9dcf2d", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766707, "uuid": "c610554b-f551-4c5e-b158-0f800aa9abfc", "comment": "Malware payload", "value": "2f95e4b2dbdaed80d67fbf5169dd25b277f111512bad80675e49346681c493005be4b098b9d728e3939a5329e88ce1db", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766707, "uuid": "ea0269db-eb0a-40ca-b1f8-191659581496", "value": "T14C942304C7D19E2AAD8450B7EF24C7C840E27193A18F2D492B78B97C64DBC6E51AEDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766707, "uuid": "103edc22-be96-4163-ab22-a1afb738f3ab", "value": "12288:SYXQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8UH:IwarmMSAGMID1R5OtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766707, "uuid": "659caa70-a9fd-4a82-99f1-24559a2a5cf6", "value": 441475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766707, "uuid": "0ae940c8-01d7-4309-aae9-3f5089c505e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766707, "uuid": "d7c1a0aa-c85a-45f0-a87b-de55f6a9e4d2", "value": "87452103309785412000.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec00ebe-ba91-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649789406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "5a61bab8-4c0e-4454-abac-bc6c4f0ba53c", "comment": "Malware payload (Mirai)", "value": "d6e5c0437eecbc8645ee8970a9be7623", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "26142977-72d6-4aa7-adeb-a986d8886f7a", "comment": "Malware payload (Mirai)", "value": "7b978800a93469bcb793668a1060f4f00defb9a19ac070a420332772ac36e791", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "9cadc5e1-27ab-4064-b09b-7a371da5c23d", "comment": "Malware payload (Mirai)", "value": "b96a9ea9ce108c823b1ca38f7dd06346ba356d7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789406, "uuid": "39941b13-538c-4868-9bef-0c67b05bb670", "comment": "Malware payload (Mirai)", "value": "47192f260437a41dde94d4d8f9eca22a03fa6ac13d2ce73b004f7f5a9829bf68b0d86d64f02214ac2496ae22eb48951a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789406, "uuid": "c1608cf8-a962-492d-8f0c-ccdd9ff0cd4e", "value": "T169D2F160BD9ECA79CA0D63B7719E9FAF810126C3178DA0A34885AC7F07831777A56C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789406, "uuid": "ae99ac02-7c1a-4c10-b666-a98eb5fddd90", "value": "768:g930DyeJXHXBJfmvZ0HDaIAm+WkhVLCyutovtnW:g93SyeZ3BJfSZ0HrAdWOCywqtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649789406, "uuid": "c1fb958f-1ac1-4e57-bc5b-afb3dcbaae78", "value": 30844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649789406, "uuid": "df15803c-f23b-427d-980f-897d96fc595e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789406, "uuid": "0881f302-7fbb-4b16-8cd4-8b3fa5d6bb2d", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5101188-ba37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649750977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750977, "uuid": "24759548-e815-44c8-b806-b8e7290170cf", "comment": "Malware payload (Formbook)", "value": "038c50303c651068987e5c3788426e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750977, "uuid": "aca8a623-8cac-487d-b625-eea9ba274b36", "comment": "Malware payload (Formbook)", "value": "7bafdf9104df0d8445c2478014a23e68200d48c2c438b4ad1820f8995936d129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750977, "uuid": "7c8b99fe-6a66-487c-ae8e-9d757889d781", "comment": "Malware payload (Formbook)", "value": "8a1723ca61e0885b215cef2b9d5381eefe30f9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649750977, "uuid": "f14ac253-9f2f-4997-ba6a-c3df9967b193", "comment": "Malware payload (Formbook)", "value": "c6ad19cb78f57225747731a8d570b3ca6cca1b3289c4bb5fd09cfefc5425c8d7f0e253f53866c5b2c69d68a14a2247aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750977, "uuid": "18d583db-0d0c-4898-a92a-ae8aafb3123e", "value": "T14934128736E1A4AFE5670F32245FEA32C77A9314179132137B004F5B587A2C7BE5A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750977, "uuid": "be8dcbfc-a0d1-4f74-8925-2d38928daa3d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750977, "uuid": "ac1bb71b-f536-4ec7-b9d2-a78466ccd4f3", "value": "6144:8Qq+RAMNFKrqWjVh2j8HZ8qscT7puY0wqgv/3GCwc:TyMLWj3v7hzv/3GCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649750977, "uuid": "d320add2-96da-45cd-9f21-39343022bfc9", "value": 243060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649750977, "uuid": "6a7d15c8-2097-4e95-b583-d46a10a44411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649750977, "uuid": "491657a2-eb39-4bd0-9058-05c3f64d4cbe", "value": "new item in 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d5a3f7-ba7f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649781638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781638, "uuid": "5c6f301a-6613-4299-b4e0-76ae27fd4ac2", "comment": "Malware payload", "value": "47ce1344cb52a0d180953e4f79df130a", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781638, "uuid": "c4d24e7c-9fe0-4cc7-9b49-89f6ff411df3", "comment": "Malware payload", "value": "7c07f4c7a30e0971370a8b9ad8a83daaf633d9c3eae775f9bb3043e92cb0898e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781638, "uuid": "70487c42-4138-400e-9da3-ba30279d3adb", "comment": "Malware payload", "value": "ac62c9896e776fa36b2ffe2185e76e52e5891ef7", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781638, "uuid": "fd4264f2-139a-49d0-8ddf-65ac62eb0aa8", "comment": "Malware payload", "value": "bc4f51d005ce5f28547595758d35039eabbd56078d389f16e14fee4d989f7528627640fd951a7e0e67930fc04e9858ff", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781638, "uuid": "cb995e4b-ea7c-485d-8978-d264caa57c8f", "value": "T12A16F08D89378859CD2126BC2C6B63913FAD26DED8C847770358DD397AA243F60CB974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781638, "uuid": "d084b320-a427-4495-bd42-18b626dbef66", "value": "49152:Xahx4O5E8i+IPSliaD9N0Hq5R+jJaRzj4t8MzSRMpENkyk/priDTnJK:oxy8i9snaq5R+jJaRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649781638, "uuid": "507b58b0-2426-432b-96dc-17d19e0bf460", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649781638, "uuid": "5f3c438f-f9bb-4da3-92ab-899fc5d132b8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781638, "uuid": "81000859-8f47-4090-adce-892078d8f283", "value": "Invoice-07223.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e74d97-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649744769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744769, "uuid": "7a9fb966-6c55-412b-a33d-d90086674042", "comment": "Malware payload (RedLineStealer)", "value": "29e7f86ba2b0e00dae6c28030dfe7608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744769, "uuid": "32e43596-b850-4c38-b993-6ca9b75a2a8f", "comment": "Malware payload (RedLineStealer)", "value": "7c221c6a44529cf6cb7ee65d706be2ec9fd4d1fe9bde5840b622e417908fd0bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744769, "uuid": "829c08c2-73cf-4abc-a9df-e5c323854d1c", "comment": "Malware payload (RedLineStealer)", "value": "8a0309b23144bf0e11ba4ea1562597b85aa83d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744769, "uuid": "4c778f8c-356d-4afc-949d-bc65e2b940ff", "comment": "Malware payload (RedLineStealer)", "value": "1295587f097041fe46c7c9ccfd4e23463f1543df83b30db24d5c00361f103c01b7acd3da733935414423e78ebab91753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744769, "uuid": "6e4405b3-641d-4a7e-b912-a7958ec30e97", "value": "T1E284CF10B690D035F1B726F44AB9D36CBA2E7EA19B2450CF62D536EE5A34AE0DC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744769, "uuid": "2d55e74e-dfa3-41af-a9c5-a0e884386d02", "value": "da226befdbef45462493cbd252b0858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744769, "uuid": "ced3ea05-534f-4f62-90c4-376f4592e8e0", "value": "6144:IYA15HGUfJHCqRvSxb5U0GG3fIuiNv5iKLAApFUegHmebrob0aFUQZJCl:7A2aJHBRvSrdGGvIxq23Uegm4aKRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744769, "uuid": "d20ee366-d237-4b51-ad42-47d7118b5ce2", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744769, "uuid": "3665ca18-ca6e-42fc-908b-cb91416bed72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744769, "uuid": "dcfa30c5-a5ea-4f7b-8f15-89515c37cc0f", "value": "29e7f86ba2b0e00dae6c28030dfe7608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356e9b05-ba26-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649743380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743380, "uuid": "93fc27ce-18db-49f0-81f0-12e8c5035b11", "comment": "Malware payload (AgentTesla)", "value": "be17480dcdc3a5fb098ad8b837d17101", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743380, "uuid": "7e9675cb-3460-4b06-9f50-59786b1c7b7c", "comment": "Malware payload (AgentTesla)", "value": "7c6d1d088641bc7291bd027bc98daf4a1745759326caed316fcfd0deb57d589f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743380, "uuid": "1d7f637f-1d31-4022-841a-30112f70ffff", "comment": "Malware payload (AgentTesla)", "value": "4a5c271e5f618cf3b81b55459d1c40ce4dbfff09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743380, "uuid": "1fdad514-8147-43bc-8127-aa0d2a2c1ecd", "comment": "Malware payload (AgentTesla)", "value": "bb7b77727403c5ebdc58504b4e3085026ec8cdf6ca1c108df0f5203e5104c28795dd36bedb4a08ea61339a23d9685565", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743380, "uuid": "dc199c41-d08c-410c-9fa7-690e166de815", "value": "T143350177BB56DD93CDEC967C0431BEC1A3F192129297E74EACCC91AAB3826D957001C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743380, "uuid": "0036c52d-b899-4b01-a97d-02b1f66438e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743380, "uuid": "fee8c02d-b795-4bf6-8640-246f1b6d61ad", "value": "24576:edBqCebfeuXVgOV07mrDxTwNNeZTgPSX:edBqCafeEVzpBmeZTgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649743380, "uuid": "f4319a94-ce70-46a5-bb4d-cdde439cfc49", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649743380, "uuid": "d284ae54-9956-4a2a-b953-4b3ac84c157b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743380, "uuid": "8ba012d9-1815-49f4-a079-b3c84510944d", "value": "NOTE FILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc825868-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736359, "uuid": "4499db11-5bb3-4fa7-8e03-442f03b8d51c", "comment": "Malware payload (Mirai)", "value": "e0d079a6426660a3e0eec02b80300c2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736359, "uuid": "7990abac-04ce-424f-9103-d13c85e1b6c9", "comment": "Malware payload (Mirai)", "value": "7c82c860b51e840f76a298cdcf4b6ac366bb125e287d50aabf00fa8a290c839f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736359, "uuid": "b3b20091-b98c-4c99-8a43-cdfae6119097", "comment": "Malware payload (Mirai)", "value": "3f499c3df2d137006d23507667237f50f363ad18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736359, "uuid": "7389623f-c8a5-40f5-bc80-1ebd0a663f8e", "comment": "Malware payload (Mirai)", "value": "4e739c29aceb66558bcd68ec4270fdbd5d87101a0317ddb7fdd3bec3ef076e585508dbb8bef0b887537fe94d4cdf9423", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736359, "uuid": "35cae7e5-8ae6-4725-b9bf-102f5098c7ae", "value": "T16AD2E16915492675C1BCCA31E97CCA13EBEFCE74CBED33A435455C949140247F5B074A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736359, "uuid": "2c28c6f5-fca2-4077-b48b-4e695a7ae181", "value": "384:wozXx1+/k+SPDy+o/FzrgQ6EHd/4+DOJTQZm6yddGhEwaaKrhPw3Bf+jVhymdGUx:w22/x/CLR+DOJVrG+CQhPV5s3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736359, "uuid": "f66c26c5-156b-41ec-92f4-a809001fd023", "value": 30292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736359, "uuid": "565ad415-955f-402d-b7b0-9948d8dfd239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736359, "uuid": "2825b314-a8b4-4859-afc8-f4583146dbc5", "value": "e0d079a6426660a3e0eec02b80300c2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a1338e-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649767532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767532, "uuid": "17f553cb-53c1-4576-9851-42f07cfb7172", "comment": "Malware payload (AveMariaRAT)", "value": "8da643db547799ea6fec5364eb81c836", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767532, "uuid": "597c756e-22b8-44cf-a7ca-f8ef0451f7d9", "comment": "Malware payload (AveMariaRAT)", "value": "7d2a4e16c011775917501db1eb9b4858898a360a16583037fe72916ec95bac8e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767532, "uuid": "d2e39b5a-396f-4a89-af8a-db312b886062", "comment": "Malware payload (AveMariaRAT)", "value": "21be0a066eee2dcd411904004bd6571a924ce12f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767532, "uuid": "434cd20d-a0e6-440d-a091-cbe6481d3cd1", "comment": "Malware payload (AveMariaRAT)", "value": "ac09f7ab8740d5201b57e08ee93baf20dbf9a36ae47f5fb3c60358519b8a2ceb17159b79a920bdae87c30ebab98cb0bb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767532, "uuid": "b505807f-7fc8-4ee6-b2fa-7a5cc919c9ae", "value": "T1B705F110F6729942C47D0DF3A9A2479B4BB1C9029021D2C73FE9318E9922FDB3D7961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767532, "uuid": "e72f4fce-13ff-45cc-9f90-6faef302eb53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767532, "uuid": "0a4ebe09-de1a-4997-af9a-640a00704ab5", "value": "24576:ZiAZzWIpybnyKKz26yKjc6iLkACVmEj5niuqK6:ZZebyhi6yVknVfEuqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767532, "uuid": "5e49e911-774c-4d63-bc71-c99a446f6f20", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767532, "uuid": "312d5e76-a7a1-4fa3-a916-9b3530cc4612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767532, "uuid": "adb207e9-1593-438b-ba9b-f208f52bc1b7", "value": "8da643db547799ea6fec5364eb81c836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca93945-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649747151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "c258eeca-36ec-471e-85d4-8f70092c036c", "comment": "Malware payload (DCRat)", "value": "a94efb30129364d3f2c655a587e7d4ee", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "e492716e-85b1-4718-a455-68907bd0dbd7", "comment": "Malware payload (DCRat)", "value": "7e308151d7a5560b539dae3c1d4a6832e39787d9338feefb64146056b9ab8f87", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "2b853e1b-92a0-49dd-bdb3-c8291981ad0c", "comment": "Malware payload (DCRat)", "value": "1737ea1956021e9ef4070d0fe9ea21ce049dbb77", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747151, "uuid": "dbc44d1a-3167-4914-bef7-06b4cbb63f40", "comment": "Malware payload (DCRat)", "value": "373c4b4e2951fb5f8f6acf98f3bb7649ffcc3aa5fdb8525d2b537effec0384908cd39a03f8f9f6f2520cbc887c436008", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "f8fa490a-bf7e-41a3-bf8a-713f6a5d1410", "value": "T192B4FA282AE94929F1BBAF7D95F13496DA3EB6633717D74D04A102860723B41DDC0B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "34daca27-f077-4fa6-9ffa-27aef9548149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "a4f70e1c-cd4c-4494-85cb-cad3fc28627b", "value": "12288:RQjQEMCYFzhC79lb3TS+E+gPa/10k1iV7:RpHCcNk3ptKs10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747151, "uuid": "26835f77-59d4-4fbf-a66e-dfbf7290295d", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747151, "uuid": "21ae80fd-c9ac-4289-977c-7528f7ec7d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747151, "uuid": "e6276669-6cdf-42a4-a9ab-6b5744d1bc40", "value": "3H5SxvnJwxcM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c858b99f-ba4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649760377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760377, "uuid": "a48fc21e-78f9-4073-b264-e48dcab8cade", "comment": "Malware payload (RedLineStealer)", "value": "009392f68d5ffc4dd56b074561794a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760377, "uuid": "6427f38b-6785-44e7-89e4-797680ad749b", "comment": "Malware payload (RedLineStealer)", "value": "7e39c87e3069a73b48eefc436be6fc22f6ef5dbced5a97ad931118ea9c31b0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760377, "uuid": "f224bd84-9959-472e-93e0-f269ee0b1682", "comment": "Malware payload (RedLineStealer)", "value": "4a0d4ae9dac7bfc9b1812150be26b7cb4a215897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760377, "uuid": "eb39e5fd-e064-4220-8a78-d4b0406eb3d4", "comment": "Malware payload (RedLineStealer)", "value": "4050d84fa18ee9cc09d29fd7f287e4b789ec5a9c1ddca6792b08abd00db79be920822c3f215a3459f47bd618c0a7550f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760377, "uuid": "38238290-e0a5-401b-a912-42b4f5c8b92e", "value": "T1967622343DFF8029F1B3BE669AD4B9D29AAFB7633A07645E105003464713A42EDD1A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760377, "uuid": "8d1515a4-079f-4bf5-bf49-cf5bb407862d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760377, "uuid": "e76e3d05-ef39-4b97-8053-90faff645871", "value": "196608:WfSD0oWQoKaG2wIsxDJncixhnYP3LzlizSHt3SB:SStNaG2wIeD6ix23LzgOHt3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760377, "uuid": "7e6bd342-5b4c-44d2-8c0a-f070d6155bf7", "value": 7279104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760377, "uuid": "2eb1c9ec-adf1-4eed-8ea0-7993b7ec2108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760377, "uuid": "ac4394d8-ecc7-4b6e-ad18-f0917feb93ea", "value": "009392f68d5ffc4dd56b074561794a72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07be6b82-ba45-11ec-8e58-42010a9c0032", "comment": "Malware payload (sLoad)", "timestamp": 1649756618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756618, "uuid": "8f7e340b-ffac-4477-bdf4-0f1ad4d34e4e", "comment": "Malware payload (sLoad)", "value": "5f8c5317f76e07bd426ff2b97c7d9bd3", "object_relation": "md5", "Tag": [ { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756618, "uuid": "2e45d660-7219-471c-a6c8-ffecdb6e1f27", "comment": "Malware payload (sLoad)", "value": "7e6cde27cc8016c9c837957a9cf203b3e4918bee8cd00112e905a797383e4a7f", "object_relation": "sha256", "Tag": [ { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756618, "uuid": "93257616-281e-492f-acd9-53fddcfec93d", "comment": "Malware payload (sLoad)", "value": "017199553cac1ea54576e8cfc226ce2faa7aee5c", "object_relation": "sha1", "Tag": [ { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756618, "uuid": "7ea9bd3f-748c-41b9-9b8a-e26253382cc3", "comment": "Malware payload (sLoad)", "value": "fdcb06d971585f128c3b1556239e4f4f71f6d4b3e9117555785b362d4815b8de7c998ce7b0f34f558f2b417dc4051f3f", "object_relation": "sha3-384", "Tag": [ { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756618, "uuid": "564296a5-cb19-4543-b863-00747af18211", "value": "T143D33AF7C624EC47567C3B590A7BFBE134D07067CF81C2869A2028DD7A478B9BA548C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756618, "uuid": "09661177-308b-4de6-8a39-11775a10d085", "value": "3072:vxnoaOXLWbcHpE9EXRqZ+meCuYwFO0WrKbv9yhL0yaVBSxYm1WTfQg7s:3OXLWgH+qXRqZteCFwFO0WrSv9yhL0yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649756618, "uuid": "ad81011d-2a7a-4201-9de9-3e75b1ebcc26", "value": 130968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649756618, "uuid": "2b16cda1-404c-4a92-b19b-60870f1fa213", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756618, "uuid": "a61078cb-b088-4350-aa32-49d8c2f1027f", "value": "7e6cde27cc8016c9c837957a9cf203b3e4918bee8cd00112e905a797383e4a7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8e5892-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764307, "uuid": "251769c2-3926-47ed-abb3-c358934d296e", "comment": "Malware payload", "value": "50ae810998dad5047e60b426afcb7db6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764307, "uuid": "b1804d15-4ff0-4036-8a8d-f6e4ae3007f4", "comment": "Malware payload", "value": "7ef3cda5e36690ad7131f38e5d74c3c99229d2ee93f723f7cd89e15a28b5b58b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764307, "uuid": "49c4cde8-967e-4e43-9dc8-11f00a766787", "comment": "Malware payload", "value": "27c9f3e79f8f2dc977af885a4f86ad71e2c16a03", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764307, "uuid": "73680b19-c72c-40cd-ae5b-1dde00c5f509", "comment": "Malware payload", "value": "211bebffb5a4975eaec890b475d9bb837dad32f83416e2cbea0fb7dbe06201391d0cd768d1cba8334ce6159c3b71b5d1", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764307, "uuid": "397670d0-b204-485b-86e9-b002fae7ba11", "value": "T189741245B7404F3FE68F877116096F09BA48CD40DA0099B78BF6FC01AA74BF92A40D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764307, "uuid": "a71f29c3-dbea-47c9-95e0-a19a4621d614", "value": "6144:caPD7nrDWg/UAbuk0W8aNylHH2bUpTjWWDTG5mIcE4sFS0LBbr7xEW:nmgAHH2bCCWDTGEsF/Bbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764307, "uuid": "7c113dca-a038-41cd-ba6f-9822f64bc99e", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764307, "uuid": "fbcf6cb2-0502-4836-88d7-6f1face50d50", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764307, "uuid": "ab75089b-88a4-4dde-9fc8-047d9cad31f5", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59736b9f-ba1f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649740434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740434, "uuid": "4ca6b72a-f168-4dd4-a68f-3452d6f57cc4", "comment": "Malware payload (Formbook)", "value": "1553a9dfe0238fceff1f658d537c93a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740434, "uuid": "4c6909d6-cf67-46f5-978e-dba7d8e846b5", "comment": "Malware payload (Formbook)", "value": "7f8435d43386aa3aee57de7fe1889c8e7762271428c279827b3293e3af5af282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740434, "uuid": "03c169f6-d96b-434d-9cb1-395ac6cb33fb", "comment": "Malware payload (Formbook)", "value": "70c2a46ee86b55bb30e18e83967a0153d6900751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649740434, "uuid": "ce436235-0502-492f-852e-2f547d8a98af", "comment": "Malware payload (Formbook)", "value": "04700b869ecb23382f26d4e70ecd214e9806e569ba65acca2ed67fdd17ab5aee8671c099483a43bae3532a0fce5c494e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740434, "uuid": "7dce97af-1556-4ef7-be41-989867d01813", "value": "T12FA47C425D5C6D86E5186033E131CA7A56306DA9A3FB50FB37E6CE3B317A3D28236139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740434, "uuid": "d8f48f5f-aacf-446c-9070-226d571d0433", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740434, "uuid": "32ab8005-2b59-4aac-9737-eec153bbcf1a", "value": "6144:FQqOHw1LFVGQcLh5wTzC5R5MuseCBXHQQYykD7McV3o2wZ4R6DIeP:Iyoh5MzC/seCRHQQZDcJKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649740434, "uuid": "85f7d8d7-3303-4e80-acea-9a663d45bfd4", "value": 472721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649740434, "uuid": "63dce80a-a375-47ac-b05a-ed9390266c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649740434, "uuid": "40e8409d-41c1-4fc7-8761-aa50d4191479", "value": "Request for Quote_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d082c7-baa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649797206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797206, "uuid": "3e7bebfa-e16e-44a9-9f18-8e1bd0717bce", "comment": "Malware payload (Mirai)", "value": "472775d2089bcd2c448674f65db0d2ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797206, "uuid": "88c20728-e9ad-4836-a33c-96dc716b6339", "comment": "Malware payload (Mirai)", "value": "7fa085df855354e185cf816c2dbde57c05f25fabc18644d084055e11cc0e8bf4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797206, "uuid": "623ac904-6580-4d33-ab2e-99db79665013", "comment": "Malware payload (Mirai)", "value": "5d885ec7bb7b05d9c6bf1fca4eb2f5d0955180ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797206, "uuid": "bf23f9a8-b6c9-4e05-b7d3-2aa601595b48", "comment": "Malware payload (Mirai)", "value": "2f48a7e9b3a8518ae54812f5e5468f765093a60263308ffa00e702450404590339da019f0a952ead8166e24b1cce9118", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797206, "uuid": "8061c37d-eac6-48ce-94d2-958ced4af0c6", "value": "T13FD34B56FB408B13C4D61776BAAF42453322A794E3DB330699285FB43F86B9F0E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797206, "uuid": "dc3ccfe3-e64a-4457-b01a-55930604ac90", "value": "3072:RXs7AfMszZbMF/PzEc4EPu/JFOotzjn3YrnVrM/9zYm7wGgWT3:R87ApNgdPiEPu/JFvtvIrndM/9Um7wGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649797206, "uuid": "23c36f53-0b31-4b33-a915-7de4f7727033", "value": 141262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649797206, "uuid": "df77cf94-8d20-483c-b27e-e459eedc60ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797206, "uuid": "fe0ab294-af20-4944-88f0-ef712e5f77dd", "value": "a1mb0t.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcf8b5b-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649775603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775603, "uuid": "10bddad8-9b0b-40b4-8cec-c76dbcf0c278", "comment": "Malware payload (AgentTesla)", "value": "58693ca150ac59a59bfba01cc7c7fa00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775603, "uuid": "f503fdeb-fad1-401b-a0be-c601ffc3d863", "comment": "Malware payload (AgentTesla)", "value": "7fd357bbfdd98bb0e111b7984ea33f0ca6ea14de91750b0c064be5208c0532c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775603, "uuid": "b66127d2-cb61-489f-9e44-fac0b74ff0b1", "comment": "Malware payload (AgentTesla)", "value": "0f1fd443b710dcbb7540941fe910dc2fd9359f34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775603, "uuid": "cb4b14ad-2bbd-48f1-b504-91aae7a19b50", "comment": "Malware payload (AgentTesla)", "value": "9ad2f69b1050196cd8bf184e1199737e4241c081ec8265cea9059d6dd853515f748309cb24d16adc440e9b458c1dde15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775603, "uuid": "1a0f6a9d-ec45-4be2-ad53-1fbab0215852", "value": "T1807412DC7F86D313E40B9675A97C5F62E887EDD9A7573A23104CB9C9307232A8421B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775603, "uuid": "acf70b5e-0c9c-49d5-8f10-eae033ffb710", "value": "6144:/scT0xcRxBL3XPKOJxgtjwY9GecnzlF3xTvsrRtabVI55CGaKpWkUL:TTVTTC8FVFsrO25TaKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775603, "uuid": "af951c7d-861a-4fa4-911a-776b4b994f5a", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775603, "uuid": "cdf34a5b-0fa4-45b2-ad1e-d2fe54a97689", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775603, "uuid": "dc193919-ecd2-42e4-8917-e4bbd762be47", "value": "Order & Contract (A-4553).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398a787e-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793209, "uuid": "20ca911a-1d4a-4bb4-b928-e51f8282dd3a", "comment": "Malware payload", "value": "aa5699b8dc3f5264105ccfaf4d44cec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793209, "uuid": "2c768709-92ad-47e7-a48c-dd2d8b042813", "comment": "Malware payload", "value": "8020ca54f6b00eed7cc01ce2a0002a50ed3b982491a7e34319086ea65a0ca1b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793209, "uuid": "db2f360d-543d-454f-b382-c35573a8e6ec", "comment": "Malware payload", "value": "f3df9445eaeebdd1c216cbe2f959080a74b50acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793209, "uuid": "9d1b1fb9-b271-4d26-a9cd-b77aaf935349", "comment": "Malware payload", "value": "1b5c227710aaf449a7918653829bc1286e3b924a9441b9e94dec26d7731cf4af09571cdff4c9787d064c5db010df0e25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793209, "uuid": "4211a7b2-b968-4cd6-af29-c92a0dfa7010", "value": "T1014423ECD983A4B73D3186BD71D936D900ACE1ED823E3B22E346A15BD21E057AC84D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793209, "uuid": "33e7cba4-f430-4ad5-aa15-73859e8e75af", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCPhhhR//mqYI:mZRgUY/fsJcO1KOiXOhhhBeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793209, "uuid": "3bb243db-8fb2-4378-b08d-3491608489d7", "value": 253419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793209, "uuid": "67e1621e-899e-4c4b-85f0-9b3181cbf72d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793209, "uuid": "1a9b5e98-16e4-4abe-b8ae-80522df3d206", "value": "intelgeneric2.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6000f604-ba91-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649789408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789408, "uuid": "4b208841-48c5-431b-ae6b-e2d3beaefe65", "comment": "Malware payload (Mirai)", "value": "044320c84d40490d196613325c512720", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789408, "uuid": "07f73d4c-3064-45ba-b55e-335e2cc2f4da", "comment": "Malware payload (Mirai)", "value": "80703a8dc9beda6d91ca277fcf8e157fff44e2461de349c4435c76241dec2a64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789408, "uuid": "31ce3e32-c648-4a75-a72c-857f4dd23439", "comment": "Malware payload (Mirai)", "value": "ede3e1ac4ab736bcc9b69a8538c661b45dd02e86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789408, "uuid": "616d28cb-58b1-41c0-bd60-d1c4431b8469", "comment": "Malware payload (Mirai)", "value": "b5280936449b707c90745dc8f239e5e73630eddb4a77ed7169e8a3a73dbbf8cf25d4ba977fd0403ee05c772d23618b9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789408, "uuid": "99801c01-ea01-4735-bb9a-86fd000cedb2", "value": "T171C2D135201A29B8C1B49037D569A4C152A6EFADF2E173337D5B16E86FC425409BCEE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789408, "uuid": "ab89e64a-14b8-4424-b0b9-7a72ed67434e", "value": "384:xbXdYsTkcAHVdXTYKrxLdYZ5k+6eu2YiKnEgO/J9shKwXQ5EeTwBYNXLhymdGUoF:Yj/bT7bYZ5k+6eBEgCswBYJLs3Uoz+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649789408, "uuid": "fe899c8d-5bef-4d03-9193-871815695e22", "value": 27624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649789408, "uuid": "5766e944-1ca0-4d66-bbf4-11808932fd86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789408, "uuid": "57595c82-ba80-41b8-a926-56d5cc3b392d", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecd019c-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649746376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746376, "uuid": "16736103-7d2a-4794-adcd-a8b07dbd76c2", "comment": "Malware payload (Mirai)", "value": "3e22256cc134fb4dd627a62dd5f49edd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746376, "uuid": "cbc72b0f-ed70-4378-ba8b-3eb715a74fb4", "comment": "Malware payload (Mirai)", "value": "80b8cf80c478bb8f4796fa1fa0139892ff6cbf6024853eaf8c28ac4c21b99b11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746376, "uuid": "45b7dabf-674d-418b-9abe-60ec492f29e4", "comment": "Malware payload (Mirai)", "value": "ea022a4d9f37eccc665d8029b6a93c213a02046b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746376, "uuid": "7c215426-9736-4ebe-969c-f0cab73b5303", "comment": "Malware payload (Mirai)", "value": "1e4fd43bc1f14a98da396d7742db2971e2f199a7807c68a03160e735dea65fa6f39e6e3529e0250333590ad4b2a3f4e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746376, "uuid": "9aa77aae-c2a9-4304-bc34-1333fddde31f", "value": "T1CD03F15CD8597D9ECBCE8F38199927E89D9A754A234E8B8CB300DCD49615A93F60F038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746376, "uuid": "c158b5df-1337-4b8b-bab4-32caec654a6b", "value": "768:F5tnZIAnOZW+orISXJNrgR0eQl/XfAby3bXWESvXoJIBBftWRA:F5tTr3rbo++PBBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746376, "uuid": "0a8ddbd9-c57a-4811-93b3-5821c5aefdcc", "value": 39188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746376, "uuid": "fd420e8f-a698-4189-925b-f30331ec9437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746376, "uuid": "9af35a5c-0960-4fa1-980a-d9268c6d11b2", "value": "3e22256cc134fb4dd627a62dd5f49edd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fafa806-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649771342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771342, "uuid": "43308797-5a17-43ef-ac49-9c8cb0ded1e8", "comment": "Malware payload (NanoCore)", "value": "92cbb2c10155b46f38b7534098d23ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771342, "uuid": "667de76e-f93e-475f-8c89-6552ca169b74", "comment": "Malware payload (NanoCore)", "value": "821b667c348d7b06a5fc8871bc137ff0248b4e0e5daf604ff6c141b4a2c71455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771342, "uuid": "2734fbb9-4c81-449e-8a08-8266d78f18a3", "comment": "Malware payload (NanoCore)", "value": "7e27a611593f8cb76c63961fa73514b30f237351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771342, "uuid": "a6c7872a-33fa-4094-b9a4-d91f19aeda3c", "comment": "Malware payload (NanoCore)", "value": "2d4ef84a2af84edb910a9a04aafda714646628f06e2ec58291e593fb9c564549c0e233afb53489b97968140e384c3804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771342, "uuid": "58031664-42fd-479b-9153-b94fa47f8328", "value": "T1DBE4E0117AFC8A26E9FD0BBDA03401808BF672275926D37CAD15A1E62D633C0DA47777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771342, "uuid": "e35374fb-243c-43b8-b9b1-e6af05febd23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771342, "uuid": "016c8d51-974d-4fe7-a808-e8c10f0e386d", "value": "12288:WYkKUk6yLaH4qJrgdAWakosoqUbdsPZAB+0TJKYJ4ngVgz:DkKX63YqJreAWajqUbdsPZAB3TQQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771342, "uuid": "6da72687-91c5-4982-aada-2c18c53bfb11", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771342, "uuid": "bbd1a695-6b6d-43fd-a032-dc71677ca4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771342, "uuid": "a77aa998-634d-4618-a906-68e5378db858", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac707bf-ba45-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649756650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756650, "uuid": "072ab0bb-630d-43b9-8aa9-a48373a1ee6f", "comment": "Malware payload (SnakeKeylogger)", "value": "9045ff6d91e93fc7dfebfc49f4622d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756650, "uuid": "bce7bb68-64f9-457c-b222-0e6cf0a7a109", "comment": "Malware payload (SnakeKeylogger)", "value": "8335f80c3f2bd7520607375a6b9ddf1b8320f9fb3aa18b3352dcd474f8806ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756650, "uuid": "c684c343-0587-4cae-8eb5-c2e482668ea2", "comment": "Malware payload (SnakeKeylogger)", "value": "53703d34edef2caaa9b9530af279fe312961379b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756650, "uuid": "8445fba6-a5c9-48a3-ad83-625363695e97", "comment": "Malware payload (SnakeKeylogger)", "value": "c1aa1e01c55441102f10f3b540997de85bed6d2c5af9396478cc255fd1eb7cc3414269e366d9442f41aef2c4a9a7d027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756650, "uuid": "4992e3ad-d61c-4908-adc0-a3837d402e8e", "value": "T15AE4D005F6A5CA26D2AA1737C0F7191407B86A82D712E76F37C1A2D92D033EB4D0779B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756650, "uuid": "a42cddba-19b5-43d2-be82-0113e51330d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756650, "uuid": "28c21398-241a-4eee-983c-90954194558e", "value": "12288:P9uDYI95TSUP4qvg9yGMpSoNrO75Ihul8sNEbC92Ws4rGaZcyEDZNyg6:WH3wqY9ZMSoNrWIhuqsNMCoWs4rGaZpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649756650, "uuid": "f657c73e-ad0d-4c11-b016-55ce696905b1", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649756650, "uuid": "7c5ec120-e147-46ba-9fa3-8e5f0c2ac9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756650, "uuid": "511a33a5-d460-44ec-a17b-90e8707aa042", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9757ef-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766587, "uuid": "409296ab-d132-4194-bcca-9ca9c08efb37", "comment": "Malware payload (Formbook)", "value": "30912b25a3b15ac405f14c5642b99c9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766587, "uuid": "ec7ec28f-175e-4264-a1f0-d0df0df25a67", "comment": "Malware payload (Formbook)", "value": "841c900cb4b5f163f77a80953d1dfc4d3f97125be41ad23ac4674b11f1f533e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766587, "uuid": "6198eadd-3f6b-4ff7-86f2-0aad7d192c6b", "comment": "Malware payload (Formbook)", "value": "80af975e722a5eeb9989ad7d6481990327900141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766587, "uuid": "df92d05f-dc3f-47e3-b48c-5f6641dd78a6", "comment": "Malware payload (Formbook)", "value": "464fd80a32c14c91c8c15a39a995334d2f030ea1fc96d3de9fe0556c7835e590e372c7b277948bddf669274bd199a3c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766587, "uuid": "60916ffa-9207-45d7-9b5c-b8df4408450f", "value": "T17834122529C4C4ABC85197734367DBF8C3FAE31123B0922BA77A7FB98C130E69185785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766587, "uuid": "9aa9a7cb-ee8e-40fb-93e5-bd1399618a8a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766587, "uuid": "1feeef97-6b41-4567-89ea-299162a9ae99", "value": "6144:8Qq+W0BMscMaZDmmAK54Khk1MvstqRWkcS1v7:TWBPDmHKWxc8S1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766587, "uuid": "cac64623-1137-46a0-ba46-c7db5e424542", "value": 245065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766587, "uuid": "5bf7bdc0-17af-4189-ba40-7bb2102b9aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766587, "uuid": "9bd3904b-2460-4f37-bc08-523a26b555a6", "value": "30912b25a3b15ac405f14c5642b99c9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e68600-ba3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackOut)", "timestamp": 1649753734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753734, "uuid": "e46ff3e4-6e9b-428a-b6f9-12c6722fd984", "comment": "Malware payload (BlackOut)", "value": "9073239b3b7b38bc0eabb124fac2194b", "object_relation": "md5", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tomybank", "colour": "#F688C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753734, "uuid": "0defb7d5-8866-4ba6-a7b2-f8bb487264cb", "comment": "Malware payload (BlackOut)", "value": "84f416154320af7571f93624d2005f846720a86c59a003ccf6939d3599b7e52c", "object_relation": "sha256", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tomybank", "colour": "#F688C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753734, "uuid": "c15167e9-0bdb-413e-9245-c88fe3fa8020", "comment": "Malware payload (BlackOut)", "value": "29ec56bc6f8813521f0af2499665f78cb4c7517c", "object_relation": "sha1", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tomybank", "colour": "#F688C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753734, "uuid": "35612922-807b-4292-8215-6d22547b2fe6", "comment": "Malware payload (BlackOut)", "value": "59e988b3075c0872d4cd79f2f55b7c01714c74312cb03934823998fa5aa523ee7ac66a4c3ab4b9af4c9bd5c807f4d131", "object_relation": "sha3-384", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tomybank", "colour": "#F688C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753734, "uuid": "0bfbd51e-808b-4667-b3e3-095e86fd6142", "value": "T100245A6E72D04F11E94869B8D2E7993003F3ED837273E38A3E5442965E527E88DCA7C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753734, "uuid": "04219517-3d77-4181-ba2b-101955404303", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753734, "uuid": "fc3ace22-3512-473e-8161-755ee415846e", "value": "3072:fpJdaiVkrsoSZwROw0ZxHkLnmpnChUDOWNgiER+X15Okm18eQ1eeD9iYr+:hJIiVkIoX0XHkLnmuiAseQ1eM9iYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753734, "uuid": "b3f403d4-6529-4bcf-983d-643e90d66ff6", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753734, "uuid": "424bc5a2-5a31-4d1d-8e09-566f32063063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753734, "uuid": "88b16a30-687a-4392-8f61-99652a060f29", "value": "84f416154320af7571f93624d2005f846720a86c59a003ccf6939d3599b7e52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b838155-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649767604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767604, "uuid": "da60ad88-1f36-43bc-a9f3-c6e81523b8c4", "comment": "Malware payload (Smoke Loader)", "value": "4066eef9eaeb407c1c2cba9fb4345873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767604, "uuid": "bd5f6e70-e363-45bd-acae-09f89ba65f3d", "comment": "Malware payload (Smoke Loader)", "value": "85134cb676ed53bbdaeb39546ac147a5b8eaf6f8afb45050ee92880cb5eb5f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767604, "uuid": "a875afd6-dfa3-4d34-b051-4fa52ece2bba", "comment": "Malware payload (Smoke Loader)", "value": "2b52d2ced5770b6db14a31f804ff4cccfd252ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767604, "uuid": "fc8ab009-92a3-4866-82a2-b0d4718b27b5", "comment": "Malware payload (Smoke Loader)", "value": "ebd14b11d598a33c49758d886f81d3da7425fb719a5b73b1bbce68b1dce370e61d370988278ff48d2bfbea05518d8c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767604, "uuid": "82d3cb00-9353-4f9c-87d1-315cfd6a1e8e", "value": "T116D5D012F1835359E03301305C9515518E89FAAD7D621ABFBA0EDE74B3673A1FA22B7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767604, "uuid": "3dd03036-d106-4fb4-8fc2-ce9221258269", "value": "e3257132b5c0fa8e6d8abcb3249c5746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767604, "uuid": "ba330ec0-4aa3-45b3-a178-be09e0da9bb3", "value": "49152:tn0w5xH4UWvrNpTGxR+jo/zk+AZ+qeG1ajiUPhw6+M9HyV40DwAx47+CObrcRT:t9xH4UwJdGxRGcA8qeYajRy6+M5yVdk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767604, "uuid": "65a725b9-7ea9-4d4a-b0f1-cf7494d40789", "value": 2930176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767604, "uuid": "e01069e1-d451-4ec5-8ef1-9f3a248bb7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767604, "uuid": "8c9b636d-ed4d-44ae-8d8c-1d62be977d50", "value": "4066eef9eaeb407c1c2cba9fb4345873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7267ca39-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767535, "uuid": "8c8512af-1d5d-4268-ad78-0fee16730e8e", "comment": "Malware payload (Formbook)", "value": "1725d011fe582111bffaff69088b5914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767535, "uuid": "5bb1878f-0d47-4fe3-8601-19c8242f67e0", "comment": "Malware payload (Formbook)", "value": "8523b78ec725e01d19eebfcc0ddd20f717ff3780f199116814628cf6078c3672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767535, "uuid": "87cf7a13-51a5-402d-97fa-d3d0b38a44bd", "comment": "Malware payload (Formbook)", "value": "557e0f3526b641b721fb89634d16290f5be5f737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767535, "uuid": "c4ae9d80-98ba-4516-a48a-20c9f7901bb1", "comment": "Malware payload (Formbook)", "value": "763b3228ee64fe73ba8955081d8a0c013acc9c07e38b97f5e20f47479609497344cd8890f77918ab96f60dbe7100481b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767535, "uuid": "ed43d7bb-2cdf-4ebc-bd19-0c2a0c50bbbf", "value": "T14E15F111F6719A05C5BC4EF388B6425B4B70C905D021C6C73BFA368A8932FA73A7975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767535, "uuid": "aa9943be-1491-4752-ba48-a896bcc185db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767535, "uuid": "d0692795-3977-4ae7-997d-a6e357acf11a", "value": "24576:S3zWIpXne7RRf8g0bxcJcLyzJV5iEdNUkPaF:SInffixRWD5iX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767535, "uuid": "1cf36111-c729-47fe-be8a-06138784d54c", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767535, "uuid": "000e93cb-5a1a-449c-9027-bb50438e4fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767535, "uuid": "c1cc8caf-dc2a-4d6e-a421-c40b41b58790", "value": "1725d011fe582111bffaff69088b5914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9563f73b-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649766734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766734, "uuid": "97f8e4db-d81c-4d28-9b37-d7358ba5b3d8", "comment": "Malware payload", "value": "b06c4160cd95141072551e60d499b0d8", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766734, "uuid": "4c0e7c9b-39a5-47d8-80f2-a796b51a890a", "comment": "Malware payload", "value": "8641ebbe5bfc1832c1e84e63223672b7ceb4eb958c35ef625ee7235f1140c596", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766734, "uuid": "b95534bb-682e-4ae1-a4a7-03d3b66b1b49", "comment": "Malware payload", "value": "4ce53562e661fe7dbbb4993d67d52cc379d56154", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766734, "uuid": "6a90f131-6aaf-4305-a343-0a45af3e185f", "comment": "Malware payload", "value": "433db8657507118cffb82c81210d25dd1a69b543c4e45d160a40e6dc1a23249e89570a7fcebf903886e51a4b75a87218", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766734, "uuid": "5d2623ef-a2a6-4869-8fcc-9078e03cbc02", "value": "T15C942304C7D19E2AACC451F7EF24CBC440A27193A19F2D492B6CBD6D20DBC6E516E9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766734, "uuid": "6fa71c00-058b-414e-85b1-86640f10a308", "value": "12288:64XQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8Ud:YwarmMSAGMID1R5Otd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766734, "uuid": "d7671949-9d3e-4a75-a53c-c779b41b74d6", "value": 441477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766734, "uuid": "030d7442-c9e2-4f5f-9d6d-f8de563475af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766734, "uuid": "6394003f-07a2-4902-bba2-7baa4c426a61", "value": "7841200103541000.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5809b33b-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649744727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744727, "uuid": "6cbaa96a-abae-4859-9f31-123369fdbda5", "comment": "Malware payload (Loki)", "value": "c8ed09e556149a1395baaff1c49c8b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744727, "uuid": "a32c3ce7-debb-48bf-bc9a-d7e8406ca89f", "comment": "Malware payload (Loki)", "value": "86c6cc93d8405840ca3be8cbc58db75d6ed324c115461969aebcbf0a84f13a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744727, "uuid": "36a28824-a122-4922-8583-5b2d154117e0", "comment": "Malware payload (Loki)", "value": "7dfc4646d11ba17672501d8a63d1394946026607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744727, "uuid": "a12f90db-b1b3-4bde-a93a-9858eb6116f9", "comment": "Malware payload (Loki)", "value": "4244c56ee430a4013efa8a61aed91d496a2706fa11715862bca6bc722315ca4524192bc0e6cf4aba309023454f9cf476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744727, "uuid": "e35cd72b-59d6-4297-b1e2-619c81870e5e", "value": "T154C4E0117AFC4625E5BD07FDA03400804BF676176826E7BDAE05A0DA3D633C09B07BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744727, "uuid": "9144d5e7-f1fe-48d8-8b45-d789f064e5a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744727, "uuid": "606608c5-49ea-4086-ba65-8c0aec70c30c", "value": "6144:ckk2O4P0Uk6JgEp373NPUbHfo4qEJ02TvPw/iI1/ued8dpj7y9eCqvwfqEiN6P7e:ckKUk61hUs4qEJNuiI1Mhff4fjtgVgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744727, "uuid": "be924d17-bd1a-4d79-96f6-31bc1d1901a7", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744727, "uuid": "3b4c3073-b020-45b4-869d-00ad44578867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744727, "uuid": "b499e59d-f7a7-4e44-a6ff-0d41433d4622", "value": "c8ed09e556149a1395baaff1c49c8b76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9aa4d2-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766020, "uuid": "fa645d55-42ab-42cf-a092-db38ac7d3608", "comment": "Malware payload (Formbook)", "value": "c05d8c6b4fb8e4bd63f346fb12090b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766020, "uuid": "ada9bc9f-7b5d-4fdc-b501-fdbbbe83ed10", "comment": "Malware payload (Formbook)", "value": "86de0059bc369b5c7bb6cc548514b1adfcc59df7787ebee4a698bc347d410b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766020, "uuid": "9efed299-1f72-4981-ba74-2b608be20e44", "comment": "Malware payload (Formbook)", "value": "5b4f3d473f5adf07b8bf4147e2044527902639e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766020, "uuid": "1b7015e8-b2ad-40f2-bd24-d7293400714d", "comment": "Malware payload (Formbook)", "value": "78f8f91d0827a6ed21f51e695323fa4f6d0d3f12110e1514b99740e623be4b3994644872dc7c82e7cff65f76a3720ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766020, "uuid": "528316d5-8226-46cf-8b55-5d32be19f35e", "value": "T166F4CE49F5A6C902E2A917B7C0E7090407B9A683D523D72F379162E94E033EB9D173E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766020, "uuid": "32f66979-3b46-4c13-af0f-02f43c7c703a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766020, "uuid": "64e36fcd-2a8e-4410-8397-e914b3b82a3b", "value": "12288:qPTCAV2hvtU4qIKZWsklmcq5AzquxdzXieemznnIqnzdktQml7g2g6:0exqIKQYcq5AT54mDnjktQmlUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766020, "uuid": "02626fe7-481c-4875-823b-e02045f020c0", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766020, "uuid": "8091d26d-b7f1-42fc-ba09-48afdcc29b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766020, "uuid": "2a478b5e-a770-4510-8412-04b3ffc3827b", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d893249-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649771338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771338, "uuid": "4367f323-29c2-41a1-80c6-56a0630fe5df", "comment": "Malware payload (SnakeKeylogger)", "value": "c683618f024ce42a424c1b1a349a890e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771338, "uuid": "e844268f-3e37-42c4-82df-ca5b370e7dbd", "comment": "Malware payload (SnakeKeylogger)", "value": "870a92bc08aa5e54c738bd27cdbb266fff517dc8a5d57091559eaa5dfc200607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771338, "uuid": "cde4e9d8-2435-403c-a74e-454fcda2df95", "comment": "Malware payload (SnakeKeylogger)", "value": "de4a9e0647d4e999cc4f4ef5b61cb1486ec913f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771338, "uuid": "67cb9bef-7316-4556-9e8e-2fa5cac1a9cd", "comment": "Malware payload (SnakeKeylogger)", "value": "fab86cb454e67316285525e1cdd773a284714f7f1214542783c6bc39d83d9b4b5714e663c16e27be82806ebe87b090c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771338, "uuid": "6b1b62f4-2a62-426e-b965-9b140d06185f", "value": "T16FF47C2137C84E47E1BBA639A520021143F6BCD7D671EB9E2DD136DD48F2F809B19B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771338, "uuid": "120e2c58-7629-475c-b731-7517c7749456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771338, "uuid": "80f3d8ff-77f2-4ebf-a6b2-6640db2dc15d", "value": "12288:18NHRcFiu02RHzSxA0heRl4WKr/4P3+xwbIXuKkMEX5VjFqEvboJfK4gCHBQ9FLy:cM0fXHBIXwozAYbpoYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771338, "uuid": "dfcbcf23-4750-45e0-835a-97f9dfdc70b7", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771338, "uuid": "ceec1162-3c15-4d20-a14c-b74a9c6e0b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771338, "uuid": "149537d9-1074-4c82-a801-3c02d0302ee1", "value": "Payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3d0be2-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649771339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771339, "uuid": "44786608-ae8b-4cd2-9f12-a5289bfa8299", "comment": "Malware payload (AgentTesla)", "value": "7f5ae2a849be61885d54823b952284d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771339, "uuid": "024973c5-e5a2-4736-a41d-d12b25cbd1d2", "comment": "Malware payload (AgentTesla)", "value": "8795246dd96d284032a9a70d73db2be180b3f8b4ceac5e0f53ad3c4d886879a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771339, "uuid": "7d8d3cac-111b-4801-873f-5581be6d2fa7", "comment": "Malware payload (AgentTesla)", "value": "e6c4a075ad6c17fd70cc1c51225edc05d425d7f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771339, "uuid": "5f6e9682-dadb-4599-aa66-6790e9ed84a2", "comment": "Malware payload (AgentTesla)", "value": "7bf2a767eee61b2acdb6fd669edd42b628dd06ea21bcb61b175c2802ffe3bf073f675207aa16ca8396b16c572d630020", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771339, "uuid": "2f10f8d7-408b-4cfb-8dbe-81e0822a34f7", "value": "T1D9F4021CF723ADE5ED1A43B92970AC133F31E653A4AED9ED15C852660D24383419BECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771339, "uuid": "b6004dbd-de12-48b4-8e86-1d64e5032e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771339, "uuid": "b27f6a79-f7f8-47c1-8dc6-3f0bab31b688", "value": "12288:957E0ZQULAXM5H04ZXq/5fpKrLsLA/2/vU4kLu+wf9NC2nHzXL9s9JF/:j7EeLAXu0Oq/PkL0A/Gc4ku+KzC6T5sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771339, "uuid": "6ec98667-d745-4f4f-8b1d-2d491ec8ead2", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771339, "uuid": "74e25c15-639f-43da-aad7-21e9fa14173e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771339, "uuid": "4ef509f6-2309-40c8-a6fb-2e8f4b2524af", "value": "Payment Swift_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a3da5b-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649767671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767671, "uuid": "b35b79ee-2da5-4d45-8716-da8d8b16b098", "comment": "Malware payload (Smoke Loader)", "value": "023ff1141d814909b9311443e0301bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767671, "uuid": "58c0b53f-5480-4144-8cb7-12aeb30f8740", "comment": "Malware payload (Smoke Loader)", "value": "88a8e09bdb23b76097166a3381e21c23957a4720cc08c094a3ce57513ac9358d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767671, "uuid": "cc2b2d01-53c2-4b87-ad2d-41007b0aa0d9", "comment": "Malware payload (Smoke Loader)", "value": "6b47f0f3d8c9e3c99132a583e1e4defa1c83b92e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767671, "uuid": "99e45377-8a18-476c-a5de-3fd0aea2c4da", "comment": "Malware payload (Smoke Loader)", "value": "2724b1c0ab834a291e5bc13c2bdc73020e6b8ccdeea8dcbbcd4677103d8ca408b7805a4306fbaf24fc8da3fe9d4e221e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767671, "uuid": "b694417a-6262-4fb1-b5b4-196f7b6d7120", "value": "T1A3D5DF13F1836344F07701315CA516114D8AFA6C7E720AEF750EDE64B7A73A0AB66BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767671, "uuid": "0ae6e1cb-355f-475a-9174-e33a384daeef", "value": "b7c70b8eee0d0aa90b12b585306f3901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767671, "uuid": "185dadce-6981-4b44-8e99-c609d0cb9174", "value": "49152:LNpyZGYPUWvrNpTGxR+jo/zk+AZ+qeG1ajiUPhw6+M9HyV40DwAx47+CObrcRxn:hAZGYPUwJdGxRGcA8qeYajRy6+M5yVdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767671, "uuid": "a36da772-8b33-4935-86ae-24d0e08dc586", "value": 2959872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767671, "uuid": "1cdf3a73-fc29-4b26-9c4e-c73811f0d2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767671, "uuid": "c05d4627-5b6d-4236-a3fb-489ad8f1fdeb", "value": "023ff1141d814909b9311443e0301bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8c8790-ba3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649751902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751902, "uuid": "2c48de08-2c8d-432c-a1b8-1adae1d1ca18", "comment": "Malware payload (Formbook)", "value": "61c3702c13c0c06727904575613d5388", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751902, "uuid": "30def836-c496-4749-b186-4170d7827be5", "comment": "Malware payload (Formbook)", "value": "88eed605657dcc9cc542b4a3850b49e5ee83ffa39120c04669fb9f1d53955c43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751902, "uuid": "e044e310-659e-4593-ac04-b312d8a22ebc", "comment": "Malware payload (Formbook)", "value": "0b30d6a61f4f5b69dc6210822d50a9ec776664db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751902, "uuid": "5e15eec7-a998-4a73-acbd-1cdc4c0641c7", "comment": "Malware payload (Formbook)", "value": "09bf6a2aca4e0d85a2e85aa4bcd0e1c65d22fc5624c830c96121cf2a84edf39a534dbc78bd7a7acee7c455d004c87a3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751902, "uuid": "dd497067-75e9-4b85-a6b3-33c416af71aa", "value": "T14334021437A0C433D9B207732E3D79A65EE9A6062062135F67852FCEF5B67C2C90EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751902, "uuid": "698c1ad2-efe5-4279-9165-4737ba1151d2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751902, "uuid": "e3b073c1-b23f-41e5-9694-72a4eacc79ee", "value": "6144:HNeZmxC8wuP7bWDTYJu0Zsz8dnrS58Je9MQ8Sf:HNlxC8hPnWDT8u0Zsonre8Je9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751902, "uuid": "05aa9ca1-f75b-41e0-b778-f172ef6f274c", "value": 249428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751902, "uuid": "7d55a4cc-3edb-4838-bff6-c9ff953668cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751902, "uuid": "32dcad17-550e-4f6a-b13f-45f9efd2f996", "value": "61c3702c13c0c06727904575613d5388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7a0547-ba92-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649790077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790077, "uuid": "24b3f808-544a-4981-be65-c45209413aea", "comment": "Malware payload (RedLineStealer)", "value": "115cc65e91a90be872ac728e0e377d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790077, "uuid": "2e88c334-5a8a-4ca1-a4ed-b0065f38de31", "comment": "Malware payload (RedLineStealer)", "value": "8930f6f934a64dcf090b74709b4ea5863559adf17ac180cca74eaa06d7e1c22d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790077, "uuid": "6cc9e194-1ba8-42f3-afcd-5da0a25ef80b", "comment": "Malware payload (RedLineStealer)", "value": "f975b56f9b3edcfe318e889a33ef24031cc26570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790077, "uuid": "b05f6d61-5c97-48f1-96ae-3d4f67d77363", "comment": "Malware payload (RedLineStealer)", "value": "ae7e091a27ce0e2c9a95377692d8083359fe519e41cf9b8e1ca439f6dae310fd0df805741287f32f22f0fc2aab5ff2f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790077, "uuid": "de238553-b07b-43a7-bdb0-1fcfeb849875", "value": "T1E684CF00B7D0D035F1B752F856B993A8B93E7EA06B2450CFA1D566EE5635AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790077, "uuid": "b2f4f4ba-bd1f-4bbf-8aa1-62fb2edd8a37", "value": "bc127f63c742090bfc36b22a0cca5923", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790077, "uuid": "758bee27-f8ab-4be5-80e9-be6c72ad8042", "value": "6144:AikaWvAOaDd9TRkcjQg6ZD8DNMURxrowJyCegmqFZ6Y8g2x1YY9MHiUobN:OavacjQbZD8GYxrfJys6YUeY96j6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649790077, "uuid": "58152738-a38a-4ebb-a94e-917b61710d8f", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649790077, "uuid": "9c69a9db-a3eb-49d5-80a0-f209c6076b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790077, "uuid": "cc05f792-4a18-4bbd-9dd8-fe1012a88040", "value": "115cc65e91a90be872ac728e0e377d86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b783ff4-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649771335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771335, "uuid": "1cac30ba-4ecd-40e6-ab99-d8efe1d2e32c", "comment": "Malware payload", "value": "c9a5a118c2d18af7da2b1756a87007c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771335, "uuid": "d8900e53-ce30-4a71-be65-97208e90b1e8", "comment": "Malware payload", "value": "89337b5b28eb8d4bc09a1916503ff509e42c14cc13a84a1bbad793639c7fc43c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771335, "uuid": "3de43e8d-2ab6-407e-a008-f4351d97e09c", "comment": "Malware payload", "value": "5be6b90dc4a12b11e18b3af3bbb213a4524a0c2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771335, "uuid": "84952d46-8f1d-4016-9020-09ecfa59188d", "comment": "Malware payload", "value": "eee827ebf0f6e0b3e6b3ce292b1f21211342fc8df0fee0c52229eb36db1d215f6822b35695828c378649eec8aefd4821", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771335, "uuid": "6e495418-6b12-4e44-bd33-8d914aa208b8", "value": "T1F132093CC0E74AECCF8AA2E849267E480199BA7DD3D9946335BCB3B0178AD5F8517434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771335, "uuid": "f4db273b-b222-4b78-88a4-e85489f83c16", "value": "192:uR8uXPebgKqSvj/PlA+yfqK/MbtTN2C+BsNLlzHWbs2IdFwAoflYstp+k9KiAX9:48uWbgKnv7Pe+jyMtZ2C+BsNR2QlnwAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771335, "uuid": "536080fc-9bdf-4ec5-82e7-ab6f83245b63", "value": 11634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771335, "uuid": "c259149b-8c21-4042-8f09-e70c7c395b39", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771335, "uuid": "c7885dd6-d76c-4aef-908b-03256c303b38", "value": "22142014789.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b100fb50-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649793409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793409, "uuid": "92a541bb-3761-4ed9-8b7d-c18a419758b5", "comment": "Malware payload (DCRat)", "value": "6f241b487a6fc16c07de933a2da22637", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793409, "uuid": "cdca10d3-dd86-42e4-9366-b064e6d3b1c2", "comment": "Malware payload (DCRat)", "value": "897a70096ab52508696ed4fa58e0c880d928e628a1d1983680224acb4bc17e21", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793409, "uuid": "68ee2cd9-8608-469a-ac03-dd26ff913e25", "comment": "Malware payload (DCRat)", "value": "16717c993271ec6827cd3b83a7c9e14a723fac39", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793409, "uuid": "29a3e138-d4de-458a-b132-769dee033a4e", "comment": "Malware payload (DCRat)", "value": "5a1614eba88b6c7a1a581c501bd901589b7fcdcffe788ba57487399983934a69911f4694c8a5c640d8a5211cd421a882", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793409, "uuid": "fc716567-213f-4fb9-939e-5ca7458e10f5", "value": "T156559D127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793409, "uuid": "1eb7e14f-2c8b-4729-9ddb-d2b49add93ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793409, "uuid": "484e0ec6-3195-4997-a313-e9496883e4ca", "value": "24576:XHQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:AxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793409, "uuid": "d2ce0110-4d7e-4cad-9dbe-c90dff45f3f6", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793409, "uuid": "3f2ee385-a883-4300-9fb5-ff62bda417c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793409, "uuid": "0e61db44-9342-44db-b2ab-70c0b114d700", "value": "vIvxVSz6jnHdRo4oweB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2c6d7a-ba2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649745563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745563, "uuid": "c6eff081-f0bd-4d15-9583-84c5b9d2e4fd", "comment": "Malware payload (AgentTesla)", "value": "62fb5cc63a0ba46629f3b82b1f57952a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745563, "uuid": "a85e343d-0f43-42d6-b279-7e475cb391aa", "comment": "Malware payload (AgentTesla)", "value": "8a42ec618549252364cc9a7814a3a7df63af3821099a93a0208e3d6366e55500", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745563, "uuid": "27263fd6-8e5e-4f56-8d87-e5f58f5f0a01", "comment": "Malware payload (AgentTesla)", "value": "f2db8dd98c93b6f87c997a82890fa0270e75d8b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745563, "uuid": "f52b4f8a-9f2e-42ad-a8cb-763a70368e43", "comment": "Malware payload (AgentTesla)", "value": "da8e1b4a888dd79c1800653121127469ee7791bf5292eaa1b68bc5ce7288134a78b22067765a8f9197e4a4b789f67779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745563, "uuid": "e624d950-aef8-40e3-aad9-129131e5e81a", "value": "T1BF350233AB46DE63CDEC86740451FE85A3E2D2225287DB4FADCC81B9B7876D827051C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745563, "uuid": "72eb5b19-0d03-4d8a-9a82-635889f02afd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745563, "uuid": "1a1bba88-f450-4362-b5cf-ef24b28929f0", "value": "24576:udXwO0vfeMdVe8HZNgJft+xJRamOT7j5iD:udXwOYfe8VtZNgP+xJRamOTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745563, "uuid": "76587bce-e907-4ad2-bfb5-51c91aae4c8a", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745563, "uuid": "d3a183cb-314d-47e4-900f-2a0a4de6fb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745563, "uuid": "5eb93402-c9d6-4745-ab42-452b134e317c", "value": "Order#-01172320202505 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878a5429-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749961, "uuid": "975bc03a-e169-4abe-a085-9e59ec39ea54", "comment": "Malware payload (Mirai)", "value": "cbfc156c5b940d295a576d36f657bdcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749961, "uuid": "663c1b54-9fa4-4503-9250-554b7e2ab53f", "comment": "Malware payload (Mirai)", "value": "8a4f5afd844671f5568b20e765636d03d92e868a3c00c492849c1bffd5bf0c41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749961, "uuid": "7b40ccf5-2643-47e0-8ce3-2bd9febceb10", "comment": "Malware payload (Mirai)", "value": "3b73a4cc383112a742c267d9fc0b16ade0e830e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749961, "uuid": "b28bc6cf-3c8b-4d55-8e5d-c8d04ef75941", "comment": "Malware payload (Mirai)", "value": "1e32b9e0730158d719a41c5f68084994d7b118c114b09cd93818147942850f1db1455525e22d395f734f57c866ff457e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749961, "uuid": "595a80fe-b630-493b-ae24-1c7aeeea9586", "value": "T13B333D87B801AE7CF85FE6BB8533490DB920A2558193073377BBFDD76C321A85A12D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749961, "uuid": "a61341e8-6b07-4bea-8e45-223e2232ed4a", "value": "768:QAe+gVovaZnDfZ08VCKFOXWBuGT/ymoAOtMnXvOvhS4Y0deE+ZLvR683ysxhR:37gAKLFamoA4IXvZ4Y0dqZLv88CsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749961, "uuid": "67ed5330-92d0-403a-b0f6-af5a700e7519", "value": 52276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749961, "uuid": "e8e1f4c8-b45e-42a9-bce8-6dad7dcba633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749961, "uuid": "7c8cc88d-7702-4c9e-8502-8709d3103178", "value": "cbfc156c5b940d295a576d36f657bdcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcaa5fa-ba81-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649782797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782797, "uuid": "e3a77b37-9586-4880-8e06-133a5978938b", "comment": "Malware payload (RedLineStealer)", "value": "3eaf6188296479da58d9ebce5de7adbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782797, "uuid": "6a3291ee-ea75-4090-b1be-8149b2efd527", "comment": "Malware payload (RedLineStealer)", "value": "8ad619f9bcff4153558b1bea48da8024c720766ff2e4a855dd839165433b6d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782797, "uuid": "60bf89a4-da2f-4bc1-a841-73bfa4477b03", "comment": "Malware payload (RedLineStealer)", "value": "255ef610731b7d1dd3dddd73cfd58175b849767f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782797, "uuid": "04e7d826-9e0e-4e9a-a5a7-030db99f73f2", "comment": "Malware payload (RedLineStealer)", "value": "9496e56e6d2fe2d72c89a05c615780be18f39db448a92fc6e433946a3061e5dc84d2d364a35ff1c9d301008eb0dd0196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782797, "uuid": "1dc4ec30-a8c1-4347-adf3-b286fd50b528", "value": "T149F5336B94A97E2ED216033F580E5F6E01759D3238B586DD232EBE0BC65635D38390F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782797, "uuid": "68d31c9b-b27c-4000-acaa-164663d44442", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782797, "uuid": "fdcc2aea-429e-4c43-b54d-f13bd93fa339", "value": "98304:h8/KKkdHMQVgjqBKuuFrZvJJenQ1mtiE2SqzFELBN:huFjuBJuFsnB0E2S8uLBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782797, "uuid": "e043119c-258d-4d68-958e-40b8239863ea", "value": 3554816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782797, "uuid": "1e4190f5-0b7f-4a8c-b5f9-2bd50dd430bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782797, "uuid": "b417636e-2592-4c4f-956b-6d14ae0a4ac0", "value": "3eaf6188296479da58d9ebce5de7adbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212fc31b-ba2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649745923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745923, "uuid": "c8f74790-912e-4d11-990a-0b2f281a1477", "comment": "Malware payload (AgentTesla)", "value": "ae7dc161fe57445fcf3af4f5c27ac6b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745923, "uuid": "bcb85a54-0b5a-4b7d-a5af-b1c269b20db1", "comment": "Malware payload (AgentTesla)", "value": "8b10545af3eff83b91ab5450ae8d10bb0c14ab6782e475f19935a48faf10a737", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745923, "uuid": "084da991-34d2-4b48-b83c-d8dea0af6490", "comment": "Malware payload (AgentTesla)", "value": "1175367b2bcefecae642bc63cce2f86cece70bd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745923, "uuid": "621daf46-c44b-4af7-8463-2f586bd3f811", "comment": "Malware payload (AgentTesla)", "value": "27c79f143c7f88689ce5c75c6fadf7e49142f00e055f76a8f7db89fd1cbea1c3e7aa10fb18aab1726f73e7f555ce142c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745923, "uuid": "d05f1766-19a0-4fd9-b731-a659f7a9eabe", "value": "T1304533B19069C221F1CFFF6510C898AC0D0EEEB9DA22FDC08A1D497791FD495A476B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745923, "uuid": "ad606e2e-9b38-42cf-b7c3-69ca3ff58f72", "value": "24576:PDRxU+9hgCV4FvEU04koR4q4rWTHbw72zWgX7j2PznbnKqtoemM/k+3lxXK:PEQhgCyMVDJsbZP2PznbnKemMP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745923, "uuid": "15fec59c-7fac-45a6-8c6b-c5637d3b206b", "value": 1193950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745923, "uuid": "393f9297-ebf4-4b27-91db-3dfb23d0879f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745923, "uuid": "cd1881d1-a2de-443a-969a-8c33830ec9a9", "value": "Overdue_Payments.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a9d39f-ba16-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736420, "uuid": "d97d4e4c-4bd5-4b87-8c14-d9399e64e5b6", "comment": "Malware payload (Mirai)", "value": "1cfe6bf04fad471ad4b7390f9d2d6f60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736420, "uuid": "6420b7fa-a86b-4564-8eb1-2f22b08d05e3", "comment": "Malware payload (Mirai)", "value": "8b5679afe1bf74d0a3fd525ecb7a6fc99629aad2ad736fd777e19b6775006a65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736420, "uuid": "8ccdf71e-4815-4f3f-8a14-9b751df8628b", "comment": "Malware payload (Mirai)", "value": "c022f88fc9e4b961d0e46bd2ea2411df169a0ba3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736420, "uuid": "0d69aab3-0348-4a32-8341-8b7714f04dca", "comment": "Malware payload (Mirai)", "value": "a63e1b8c8fa34d29f9fb96b741746008fc595ce3f64af8c9f478e57aa17f7051296dc7e32987c43075023602d1c47dfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736420, "uuid": "14f0ca72-f064-45ba-abaf-3352720bf4b5", "value": "T1F2438D71E0196DD4C19642B46834CF794F23DAC096A31EF79BA442B1948BFACF609FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736420, "uuid": "925eaa65-b771-4bd1-b5b7-fa3746b76f0d", "value": "1536:aaYU4kPYEHHJyVgpisUfweCGR6da10mA:atJc5UfweJ9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736420, "uuid": "cac3ea82-8c2e-4809-926c-28a08a6ab4ee", "value": 59932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736420, "uuid": "564ac982-5285-4c33-983d-2f9a3658ad52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736420, "uuid": "aa35905b-3888-42e7-bf91-7956d58f53d4", "value": "1cfe6bf04fad471ad4b7390f9d2d6f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06469b56-ba3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649753609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753609, "uuid": "18842e55-7db5-4853-9d7f-8e6ccb537731", "comment": "Malware payload (RemcosRAT)", "value": "f2fa3619bcc781b0b51fd4353e9508ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753609, "uuid": "c21dae2b-8c7a-4316-99cb-cb478866a282", "comment": "Malware payload (RemcosRAT)", "value": "8c45a06d9b4a601333c206c47747108e511e9609b184a26de49b925e463ed808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753609, "uuid": "62a2e17f-a794-4f38-b97b-0e3abe02c8bf", "comment": "Malware payload (RemcosRAT)", "value": "29f6580d237ac6fe0b3efc08c993335118ba5904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753609, "uuid": "5a7438fb-9bf4-482a-a30c-e0461a788612", "comment": "Malware payload (RemcosRAT)", "value": "d8188275cfca08d54e544e19d663b67bd5c5613e7166238219052e62b089bd77611f4909abf27a7c50ed960d93cf8666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753609, "uuid": "ad22d846-12e0-4882-8a84-c8063b178d55", "value": "T1BD15011576FC8525D6BD1BFCE03401804BF676276D27E3BD6E06A0C52E633D0DA06AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753609, "uuid": "849604ed-f961-47d3-aa03-44d01fea772c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753609, "uuid": "716b58eb-f698-46c7-8884-1293512f6566", "value": "24576:zkKX6O4qEm2i8MMxrDiQsZkqiz00C4S96B5m:zkKXSX9Mgr+Zkqi5hS96B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753609, "uuid": "88b9e43f-5376-46cf-a925-473fdeefb290", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753609, "uuid": "5cd417d3-ad91-453b-9527-f6ea6e99a123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753609, "uuid": "123875dc-58bb-45ed-bc8b-7a2bad5cc65c", "value": "Inquiry N0 PN KFM8700366-20-36+10R32+S2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650c1c72-ba26-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649743460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743460, "uuid": "b3128040-948d-4525-9412-ca8c2dede79e", "comment": "Malware payload (SnakeKeylogger)", "value": "61229497d54038ccd2af2e57708fb003", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743460, "uuid": "163af03a-2aaf-4c1b-bce2-612b64fc8710", "comment": "Malware payload (SnakeKeylogger)", "value": "8c5b20644ffa3e178ce3988c865d94da1957f539619519649d2cbbfdc828b016", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743460, "uuid": "2799c67f-243a-4faf-bc68-bd29591b257c", "comment": "Malware payload (SnakeKeylogger)", "value": "d6cca72a1364aaf6cbc47158b46a6679b7372fb0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743460, "uuid": "aa06e407-96c2-495d-b37a-4053a387fbba", "comment": "Malware payload (SnakeKeylogger)", "value": "ef88dce045183117579fde37792514eebccc53c85f96872d65ccd8e2e5aae82aee717346e1f4d234fb5337aef39cf0d0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743460, "uuid": "5e712673-beab-4339-8ab5-7fa66da81d12", "value": "T197E42335F34C2FBD3A691FEAE8B8013D52986DAEA40851445AC5E7517B24FD390BB28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743460, "uuid": "cdc28028-3ed1-4292-ae83-8f4e862dbd8c", "value": "12288:0oFFNeKv97onk5xsFjx79sLpuGeYt4FfCoLBXHN5hJPzZ:RF6O7oMxCF9sLp5ePCuHHPzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649743460, "uuid": "8d810a52-7612-493d-8e76-1411c1395629", "value": 685902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649743460, "uuid": "3fbcbc39-166c-430d-88e9-ff710ebbd2d3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743460, "uuid": "5d821755-5295-41e5-8345-86babc15c15b", "value": "PO#094989431.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61c3f32-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649778010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778010, "uuid": "88ffa0b9-1c03-4f1f-8785-53dc1ea3a39c", "comment": "Malware payload (Mirai)", "value": "869b6b711c39796cd30ea3f10f7fc940", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778010, "uuid": "0067580b-65ff-42dc-b348-5c278b4f59ae", "comment": "Malware payload (Mirai)", "value": "8c9238123085130a5558a1f3fbdb6ad03111f5392e53c6eb8caed567ccc532e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778010, "uuid": "77c86b34-82bf-4d4b-a1dd-e6826f23a634", "comment": "Malware payload (Mirai)", "value": "5b8bae3a94a91928d3d6c5d17266c13112c8d3c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778010, "uuid": "e7fb69d7-d5f3-484b-b703-f7c72d28625e", "comment": "Malware payload (Mirai)", "value": "1f69afb09122cd5b6f494344af6ef734437b3f6122b77aab4271b380b6b151328f70a7bc569d3df55c3d9aafee3f689b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778010, "uuid": "b479ac9a-98fd-47da-941a-419a71c7747c", "value": "T18143185178D19A16C6E423BBFA6E40CD372563E8E1DF32178D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778010, "uuid": "70af7b3f-6042-4037-a455-ac30bf05b4ab", "value": "1536:saEJMzL7BC+nfbXq/5XqbFJ9WhKvriEALd2:saDD2/kJQhYbALd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778010, "uuid": "a4ff3cd9-53c3-4e83-90ba-9724708c5afb", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778010, "uuid": "7c24ef60-17d1-4c55-9902-96f321831dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778010, "uuid": "a12770cd-0249-4664-82ec-d9ccfd4c6136", "value": "869b6b711c39796cd30ea3f10f7fc940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f2b88c-baa5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649797892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797892, "uuid": "6de3ddad-3f3d-46ae-9fe7-346df24c9cca", "comment": "Malware payload", "value": "bd3875d418be4a8da5d44a8c7aa01cd7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797892, "uuid": "5f43d7d1-9a05-4665-a276-1c8da78c8aad", "comment": "Malware payload", "value": "8d926a013daeadc49279f7665d9cf9415dfaa1a65e72962503a125434d5ebe42", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797892, "uuid": "3696056d-40f4-4651-9b86-09f60acc1b6e", "comment": "Malware payload", "value": "506b5dafa89a3e0fede673381a4ad85b7aba1f4c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797892, "uuid": "d95def4b-1fd2-4a58-bca3-53d9db90fe6a", "comment": "Malware payload", "value": "9b8470d5b6322e0e1c87a1e448fa5489ab477820b98422133af42d43c3f33abcd7683a1d591a5be2ee1d6552c7fa0408", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797892, "uuid": "2ba6e3e8-641b-4e6c-bc43-3a717ee18f5d", "value": "T17895333129D257D4C580EA354DDB35C896D52F20BEFF78D7AB47108606CAAABE3AC350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797892, "uuid": "cb6c6300-63bb-4b0a-938d-c0f0fcee141c", "value": "24576:NuCCu6yH1X1OxG7D49jUShv+ZdtRol13iCIhQVIUn6QfYrR5LBdpV9TFGkJC/:kv4HtIQDsJ+HoTy8n6gQ5tdpV9TjJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649797892, "uuid": "db650e53-6e6c-4e7c-a94e-eb5a275ef0f4", "value": 1920835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649797892, "uuid": "c888955d-8f0b-4938-952f-b2cd62acefce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797892, "uuid": "1c788772-26cb-4f7b-b520-45784297cd90", "value": "EWASDOPMJKA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cd5fef-ba4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649760591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760591, "uuid": "06cd0e4a-9d19-488a-9a08-75bfa3f187b3", "comment": "Malware payload (AgentTesla)", "value": "765a397dd23048189ba17c85d4d57535", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760591, "uuid": "079baf3c-fe9e-4830-9ac3-2f4e3e9d9c13", "comment": "Malware payload (AgentTesla)", "value": "8dd1b5caf0cd6f4d0972591216d4898f1a9dd4dbae2a2b5c92cc568d561cd144", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760591, "uuid": "93461bb4-be09-4d41-9c67-3ceb5796764e", "comment": "Malware payload (AgentTesla)", "value": "724ab5d57541aa87b97ff24270c63abf49ed170f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760591, "uuid": "485e356d-b5cb-47ec-8f0b-4d9be4277762", "comment": "Malware payload (AgentTesla)", "value": "04c2b0eeceb65f213de4b9b9a80b0ad98dd96008ed79eedefc760167a2736ab3cf94ba071e3def157c8f71d3334e14cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760591, "uuid": "24f52b0d-f810-4f6f-8050-b8c7d93b9243", "value": "T12235F237BB469E93CEEDD3740821BEC293E183265287E74E6DCC91B9B7826D917050C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760591, "uuid": "432e3b8c-2a09-4c5b-9451-d1c5a1b2530a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760591, "uuid": "bfcf36f3-a012-4306-869a-e9f93209da70", "value": "24576:edXwO0vfeMdVe88f9kQhGSX0rD/jd5ZNgPb:edXwOYfe8Vc9k7SXiTZNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760591, "uuid": "32067941-74b7-4b94-89c8-8e58b32f366e", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760591, "uuid": "d883a9ee-6a06-43bb-9e95-c9d3c2b5c298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760591, "uuid": "d9c593cf-36c7-4ef2-b99d-ae7ee4b5f234", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f9a6c3-ba2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746223, "uuid": "591fa342-8bfe-445f-bcc5-16c21cfa0e5c", "comment": "Malware payload (AgentTesla)", "value": "8e465178f205d2f7b52cd3027c51af3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746223, "uuid": "e8ddbec2-aa78-4c7a-850f-96bc3d0307bd", "comment": "Malware payload (AgentTesla)", "value": "8dd2ea100a46b99ad89e7754af2dbd306ce5ec10e214687edd629aa6b7ab4cd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746223, "uuid": "63e0c4c1-e308-465e-9ac0-124da789f5e8", "comment": "Malware payload (AgentTesla)", "value": "70c865e9b4d19d45fa2adff5f8654eb9580f3cbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746223, "uuid": "c4ab1764-d59d-46e4-a3ff-9cc8ff10e631", "comment": "Malware payload (AgentTesla)", "value": "d5359f08c85f49ae71049a25bb8247aa52b726239a341dd4a8e15f185be737af1da74e34bede157a7b2105b7baac987a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746223, "uuid": "c59f6b56-1598-4f1d-ae88-8cbec9833b2d", "value": "T1E7E28307FF6DA0A7F7682FB744125341BF65A10A7422E30F9E193164FEA22C33D92665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746223, "uuid": "d8efa23b-1ede-4eba-860b-5b6ce8c10f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746223, "uuid": "94e6d9b4-e2fb-4078-83ca-9c1bab64d7e7", "value": "192:8adMd1Z5/ElfffffN6fba+GFh2cotBjtHW0wHTAzmyeIeQZUKS5C+w9tao:8adMdx6fffffzq2fHTeHfRUHzw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746223, "uuid": "8d7412d2-259c-4555-8d6f-63f54e42700f", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746223, "uuid": "62cb02dc-fde7-45a6-9987-ea2ce665bbf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746223, "uuid": "fcd09cee-92db-42fc-9a47-faabb87f83b0", "value": "Quotation-pdf______________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb35e69-ba2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649745169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745169, "uuid": "251dbb1c-f4b5-4ae8-bb13-7927922413bf", "comment": "Malware payload (Formbook)", "value": "f5f055169691492af171e8ac15bace03", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745169, "uuid": "0001e008-93e7-4c6a-8f4f-ceab8af592ad", "comment": "Malware payload (Formbook)", "value": "8ecaa9e7e60ec419b3e76773f8c9e0d4d66b7bf188a4a1a129da79a2906bb356", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745169, "uuid": "af81ab04-871b-489e-9c8e-186794684366", "comment": "Malware payload (Formbook)", "value": "4d4894ef8666e1307a621f6c91267dec444a1559", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745169, "uuid": "cb079d17-14de-4596-84dd-4798c6646104", "comment": "Malware payload (Formbook)", "value": "46db0bec388bc15bf122f89e6eea7735d7e94e92c7cf5047559a561336b8dd77f3ffa522ca199d5334e922269d20f400", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745169, "uuid": "20a52ba1-2ebf-4158-95fa-e9d6cc0f1cd2", "value": "T18B05331228E929B218447B2FF01814D8DB64ED66DF4BB507353FE885D1DEB46C01BBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745169, "uuid": "613591f3-17c1-46e2-8dbc-888b2571e8f8", "value": "12288:grwYLlppx93mbBtZYP/VAmAyladC030oBJKbLQAV7fuiZstnHQ0ICkNAzpk:grXL5j68/VAA0dlEoBJKbEAIi4nH1k2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745169, "uuid": "21f19b05-4938-4e63-85f5-acac0c05c0f9", "value": 818558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745169, "uuid": "10343cdc-7b11-4ab4-8694-bba1d4e57c11", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745169, "uuid": "ae86adf1-6826-4b65-bd38-dd005875e5eb", "value": "PO1707693ADXVB.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a8e2b0-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800764, "uuid": "7eb84cbf-c999-403e-9e89-b12a89269748", "comment": "Malware payload (Mirai)", "value": "a2b65a1a6583f0106a3441936ecf1ad4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800764, "uuid": "d113df19-2e6f-4f88-a97a-c3af41992326", "comment": "Malware payload (Mirai)", "value": "8fb6c9eb29ad8a8ec83dcdaa2d0fc5588775fac346e91903073fbe0db6de8078", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800764, "uuid": "4761e39f-e2a9-4108-a718-7a13be94e04f", "comment": "Malware payload (Mirai)", "value": "1c5bb76511af32bacc37f8d3abe681fdc27ad3d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800764, "uuid": "0e65dc58-e459-417e-9b3c-42a98d1f610e", "comment": "Malware payload (Mirai)", "value": "d2407425364d65b0e5917eab298a0d604a1f99d21042579bb826b5961a529fddf7ec0752af8beffbf1846438f79a873c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800764, "uuid": "ae27e0af-846e-4e85-8102-82b253c29002", "value": "T17C43F1043717E6E2D9E328B6DCEE864A3E59CBFE552235A39300490CBD81C56CB7C9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800764, "uuid": "ea1bb8cf-ecb3-4121-98b0-22c431e4080e", "value": "1536:RPwRZ2ONPySblEPZaMt3+McbSv6M4y3LSxmggZiEnT:RUwO1d5gnqbSvr3LSu8EnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800764, "uuid": "46521269-af04-479c-9cbc-d8b5f4e9012e", "value": 55200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800764, "uuid": "06664331-3406-480e-97c8-c1d94a56eeb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800764, "uuid": "5ec483a4-4a36-4dd2-b7a0-4896aeaf08a0", "value": "BDK.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6874afff-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746473, "uuid": "b6aaf48d-387c-4b58-81b7-45d24c302258", "comment": "Malware payload (AgentTesla)", "value": "596f026cc2d474fa0a6229c2eca53109", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746473, "uuid": "3fb6d05b-5a5f-4812-bcf7-92f93c5cb6fa", "comment": "Malware payload (AgentTesla)", "value": "8fd9805391c42e21bf06bfcde5470b4f179b00cfc976d583019f872f8a8d0e38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746473, "uuid": "99d22970-f730-41af-a106-d8b45cc1d3a0", "comment": "Malware payload (AgentTesla)", "value": "9809ac04033e8eeb8639c0ca973a84cf1c43f28b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746473, "uuid": "ddb2b257-32ec-4d7e-ae61-b38f057eb772", "comment": "Malware payload (AgentTesla)", "value": "32b82939e3dfaea402a99f5b7bd1634ab2a4f7424bd1926e81b4f1c69e6055a9effb07db0ea9fd69ab4aa3953a3c3ac8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746473, "uuid": "514fdfec-e910-48d0-86f4-6cfeff5792b3", "value": "T1771523A394AE73FE4895879F37C801F91EF81328982F059604F5D7E5DF2E5A980A035E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746473, "uuid": "82c6d455-5ee0-4ec0-9a4b-e925af4b7ee5", "value": "12288:KQLWKsK2AUav1ddzRK5+91778IKPw0FrRF+65DraSHUNy8+RFLPbYNpX3CJSxmmm:/LEHg5S+778IyRF+AyMU/QPcNpX6SWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746473, "uuid": "68df5f3f-2f3f-46bd-9598-30d9c723125d", "value": 897504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746473, "uuid": "9415e343-7d55-413f-b812-cba16e9b6ec0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746473, "uuid": "739f7a93-1a95-4942-8809-2106f514563c", "value": "payment details.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab97915-ba74-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649776836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776836, "uuid": "366246c1-1653-4b4f-a4ad-2702fe38394f", "comment": "Malware payload (AgentTesla)", "value": "31d260440f2fc5e2ddced244f9dc4335", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776836, "uuid": "37cb1ef9-9196-4d14-b768-f0771c618b41", "comment": "Malware payload (AgentTesla)", "value": "8fffa056d875899fa2a0c90666ce59fbde5818d70c21d8072a5c9687a3d3a373", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776836, "uuid": "d2c8f1b9-0fd7-4154-973e-aef1442147c5", "comment": "Malware payload (AgentTesla)", "value": "392669a75fd3dc8bd802ff099ef6468962687a84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776836, "uuid": "ce1660e6-eb65-4bb5-90a2-ad8c199c491b", "comment": "Malware payload (AgentTesla)", "value": "f0646dd233dc2acfdb47b082e08785e6245973fe478c2c497b3c51aa020010638d6a61cceb6e71d081b6c3256139af60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776836, "uuid": "68a2fb52-3cb3-41e0-a9b9-67b3175c544a", "value": "T198F4CF19F6A6E90AE2AC1377C0E70C0403B5B697D51AD72F7791A2E50E033EB494379B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776836, "uuid": "bfb66d4d-cd34-484e-97fc-b6a49cb399c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776836, "uuid": "7e218865-3aac-4eab-8e9a-6412565a4d98", "value": "12288:Ra6Wxf5EMDj4qJgBgRGZFXGQDjti/FPfk5UvyPiGr31QDINdGHTh/imDliSfSyg+:I6WRtDUqqCG2Sjtits5UKiGL2idGHhpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649776836, "uuid": "069e1f23-ae5c-415b-84fc-b7de2b186a0d", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649776836, "uuid": "3ed73725-4726-4fdf-9b9a-99101d21e5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776836, "uuid": "88d05f25-e103-4913-8a2d-5980e8a184d6", "value": "Quotation sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3d32e5-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649766556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766556, "uuid": "2f924c5c-69ac-4f6b-9961-182807288c30", "comment": "Malware payload (RemcosRAT)", "value": "8c2849b00405b4a005b68fa898334005", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766556, "uuid": "1e8c390a-9dd0-4f78-8dac-b4c217cbbe4e", "comment": "Malware payload (RemcosRAT)", "value": "902f4adc25817f82a216b60a7658cb9a267e877ea0197d69cc279fc02ba4906d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766556, "uuid": "be0b7f54-75cd-43e4-9432-d2565ad2f6c6", "comment": "Malware payload (RemcosRAT)", "value": "83f1b06a9095034bd4865639936517d4fa603fff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766556, "uuid": "c36f8628-08dd-4665-8f2b-c9edc25d1aea", "comment": "Malware payload (RemcosRAT)", "value": "6587da184f49e533702f14830cdb5f1b52c7e7b469827116878a22d3ec7396efc4ecdbe9dd8669851e72909370d702ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766556, "uuid": "02938572-b9ef-4189-8e9e-25ebb21d7923", "value": "T1F8A32D42714DF6CDFC2E4CB5C10EC2B6D3537DA15AA6DE1273E4359E61A013A1A0AEEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766556, "uuid": "e8441c99-19b3-4497-ab8d-2af2166b74c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766556, "uuid": "9cce982a-da91-4776-a937-2d6c2a5f3e7f", "value": "768:CAD3pjPiHLnwxx7CWIBNerpwl/2Cpp5tTQBqLN1ZB5fqt6oxlMF/2IzgUaxHvo2N:FlzQaEMWJbp5tO6oru/qTHsce6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766556, "uuid": "194e6cee-f2c5-4134-9f9b-b4752ac9786e", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766556, "uuid": "8334f9f2-1846-4e5b-af4a-b829fc9a86c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766556, "uuid": "c2accad3-08f8-458c-a115-42e0152e7e7b", "value": "8c2849b00405b4a005b68fa898334005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc05b9a0-ba7e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Ousaban)", "timestamp": 1649781402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781402, "uuid": "c4ff4b67-8e4d-48e7-87ca-e5cc813ecfd3", "comment": "Malware payload (Ousaban)", "value": "2ccbfafed0697e315afc452575b11445", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781402, "uuid": "cb16549f-7674-4396-96b6-81ca0980e588", "comment": "Malware payload (Ousaban)", "value": "9091a791b900c6b7398b38b4641edff93036f83a36e1244594d5ecfd664b9931", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781402, "uuid": "1b6f6aed-686d-42a1-8bcc-3a60fd1427c0", "comment": "Malware payload (Ousaban)", "value": "94b2d136a4933bc2c3542c0e4e0dfc740ddbed5c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649781402, "uuid": "11cb691a-f280-4266-a957-dbf15f6c956c", "comment": "Malware payload (Ousaban)", "value": "70b3b5177cc675cfc6be655d24726dffdb302b4e50817ef9f26a7b755f61354e3c8efc28f540124b97365f652696e824", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781402, "uuid": "f2e1045a-5f7f-4992-806e-e6a7dbcaf4d8", "value": "T17416234BF586DB3BD1FB8B71695BD33684BAE0340093456A5364B40E7DE22C0A3D71EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781402, "uuid": "0d5a429b-2820-4bca-b4d1-204dd680bbbf", "value": "98304:M6Y5AzIFrBvf/jMkQ0WWCowEUKIFrBvf/jMkQ0WWCowEUFIFrBvf/jMkQ0WWCowH:M7FrBv/QbWCoyFrBv/QbWCohFrBv/Qbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649781402, "uuid": "343cae5b-7ec0-41dd-876b-8529df020e9b", "value": 4063744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649781402, "uuid": "cee88d00-2d25-42d3-9e60-671f253415a6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649781402, "uuid": "8e7a45a9-fe85-4220-a038-5a7d1b77b3e3", "value": "hyh6728i0zbnnp rspehu.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002a8e6e-ba3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649752740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752740, "uuid": "6321e0e0-0496-455b-969f-f3dd0201eab5", "comment": "Malware payload (Heodo)", "value": "ad81cfa84d2027b74eb44b202daa5fa6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752740, "uuid": "ef2ad0e2-8eed-4445-9eae-69c7ebe46536", "comment": "Malware payload (Heodo)", "value": "90e5e5489aa2ba8d24fb859053b15a56ac3dac2ad447af9be4c3fad55db4574e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752740, "uuid": "72d3050e-f949-4567-abad-22e957800e26", "comment": "Malware payload (Heodo)", "value": "65fd846b07245e924095085341d3cb7320fff94a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752740, "uuid": "f008482e-1083-4612-b03e-0c0eb201efc6", "comment": "Malware payload (Heodo)", "value": "aeccd620c4858e401f0d9da1a73e8a19910dd336aebaa85deec77276960065d12ccaa50de77da53588e49c2f2be0e356", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752740, "uuid": "737643ad-e91f-41f9-b0f0-895aa322cb98", "value": "T1F6A4AE2176D1C076DCDE46312647C2AD62F6BE608EE5C257FFD53B0DAE32141CE2928A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752740, "uuid": "cbdaf831-f1c5-40ec-9150-3d8eb4755898", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752740, "uuid": "339fdbbe-dc02-4b20-90b7-0dd1b991faae", "value": "12288:bGptged525pthqnhB+RUKyTpoOvHuf27:Ch525DhqnhympvOf27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752740, "uuid": "4e96901e-7e64-47b3-863c-59dd782b96ab", "value": 462821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752740, "uuid": "7a3c747a-3bdb-4a51-9a76-65ccd23ffa12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752740, "uuid": "79c67715-8c4b-49c4-a19d-a5fb11f622b3", "value": "emotet_exe_e5_90e5e5489aa2ba8d24fb859053b15a56ac3dac2ad447af9be4c3fad55db4574e_2022-04-12__083855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c507f312-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649767244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767244, "uuid": "327ca680-1207-49e8-830e-120e3ee2ab67", "comment": "Malware payload (Loki)", "value": "ece1cc95b6820ddec1ce56f6a2c01ce4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767244, "uuid": "d62d21f3-65a2-45a4-b8ad-53b53a4dc39c", "comment": "Malware payload (Loki)", "value": "917c0742036df8c74f9a51f60fa049f294f83e1ab6c08444f8fb01733d85b655", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767244, "uuid": "f05aa4bc-907d-417e-8ee6-7556a0fa3ba4", "comment": "Malware payload (Loki)", "value": "012a44e4b175b39f4ec677c44a64d8f292e5c421", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767244, "uuid": "0189b0ec-bd34-40b3-9619-c7bb94da6e40", "comment": "Malware payload (Loki)", "value": "ea88303d7c690c48c137da1de38026905157a89218bc7f16a1f5b02c611d7495aaf2747fc5ccaa45d16b6e869765f374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767244, "uuid": "bac6c6e1-de0a-4709-99c7-c749a8a7895e", "value": "T166C4E01136F88615D5BE1BFEE47500844BF6722B6C27E3BC9A1560DA2D633C0D607BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767244, "uuid": "77913030-fdd6-4d9a-857d-0f9dc01259d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767244, "uuid": "3451ae87-e4c5-4935-83f6-a22104add3c1", "value": "12288:xkKUk6tSIIM9T/b04qwAYwKcXu+GmN+hK0JZJuzZ+VPQcg5mgVgz:xkKX6tSIIMdPqOwpXAmN+1YzZ+dQcORm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767244, "uuid": "4db49088-d92c-4a55-9333-6178c661d3d5", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767244, "uuid": "8f99e3bb-d988-4632-ba0f-210f6cc39e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767244, "uuid": "11ca7265-9ec3-41d8-a4cb-dbf5b41df744", "value": "ece1cc95b6820ddec1ce56f6a2c01ce4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea6154d-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764334, "uuid": "c8da382e-de0c-46db-aee1-3a49f80c7bd5", "comment": "Malware payload (Loki)", "value": "8e7cd376f90072b7ab92d327b1c139ad", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764334, "uuid": "d95b2069-7ca5-4c5f-937a-3f265382c44d", "comment": "Malware payload (Loki)", "value": "91dc751a245cd6f67c89f3d2352b1bdd6b08b095ec9202d266bac83ca7435827", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764334, "uuid": "b65c3666-f5fd-48b7-97bf-bf37b4edc0f8", "comment": "Malware payload (Loki)", "value": "8008e64118debf6d6b680129671f086f3796ddfd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764334, "uuid": "e4a4f2b0-f402-44c7-bc3a-818ff1b985e1", "comment": "Malware payload (Loki)", "value": "3d718cc619b0429f97c5975aa5bbab0bec1ef769f83d2c2feead6cb19994eadd1fef7a1aa6b77f13f7a2dfc8c886c6ce", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764334, "uuid": "3a4c3b5a-af3e-4fda-ad5f-f178cfe92892", "value": "T123252365FCF06F36D04326B282ABD540553EAC101604F9CB572EF4CA743A27D99DAAF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764334, "uuid": "893daaa4-5693-4c0c-b8e5-24da74c91397", "value": "24576:4Roov/wk6mce6p0eIc/RQTHM5TF/EWqMGO9Ar:4/Ak6m/i0eIc5Q45JEWqMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764334, "uuid": "e76b6cdb-3624-47f6-a47a-ca3864d7fb65", "value": 981016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764334, "uuid": "ac732459-fab7-4db4-8327-06b25b412166", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764334, "uuid": "aea720bc-b2f7-43c2-9b37-8707c5ec2b8d", "value": "PI04.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3163f46-baac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649801117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801117, "uuid": "8de1682d-08db-42d1-ad17-b64f372ba9e0", "comment": "Malware payload (Mirai)", "value": "8c8822a47b67c9a3df339dc3dc08d6c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801117, "uuid": "09332c6a-9c19-4ea1-a254-7d3b72cba860", "comment": "Malware payload (Mirai)", "value": "92576768bc01aedd8a5877c0b5093d13001294a58986f2a03bcf4c739d1884c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801117, "uuid": "b36d62ae-ff23-4e49-9e3e-b9f320882e97", "comment": "Malware payload (Mirai)", "value": "a5fca26b39190a4bd890c887184b5146f2087ae2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801117, "uuid": "48a969e1-f993-4c93-8430-21b902d6d299", "comment": "Malware payload (Mirai)", "value": "a4d1d18b933512716f2e4163b2efd3388cbde2806a24e424e116e8602c790409a456dec930ab91526c02e58c0a0a4094", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801117, "uuid": "0ac74431-3b30-49de-8840-67e7d8ccc372", "value": "T15883A5197E319FBDF79D863457BB8E216A5823D632E1C580E19CDA001E7024E781FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801117, "uuid": "3135793d-59cf-4dd3-831f-954adb563416", "value": "1536:GslzEe5ycvD4DVC2txjAp+TX9gsBgxM1nlKWTo61a10Zf:NzEev4VC2gk9gsWM1nlK6ohuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649801117, "uuid": "c5b451c5-1693-492a-a3a4-9647cff4f82a", "value": 85652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649801117, "uuid": "134c73ca-8451-466b-96d2-1acb0a438996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801117, "uuid": "2364057c-e1c1-4820-bc0e-051ef880c387", "value": "8c8822a47b67c9a3df339dc3dc08d6c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a38a16-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649782821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782821, "uuid": "234fc666-e42e-4a01-b887-6a5ec3c6c1fe", "comment": "Malware payload (RedLineStealer)", "value": "53aa1a1aa43cb5f145280a4a5e014402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782821, "uuid": "7755c212-7a65-4979-9124-a134700822bb", "comment": "Malware payload (RedLineStealer)", "value": "9257e5747777847a0ca576ef1e3b650a5de696f808919070f8308f173c50127d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782821, "uuid": "f024d011-b3a3-4678-bc55-2d0e29cd316c", "comment": "Malware payload (RedLineStealer)", "value": "64f8992c17a233631e4f760bbde93be2e63bda4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782821, "uuid": "59805b16-c83f-4a6d-84b8-e5c3f877b563", "comment": "Malware payload (RedLineStealer)", "value": "c18414ae4998f885c258df1b10d7860d6a6daa9599908192d4e7450f88a6124887faa3592772e8e3ee05f00f312b61c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782821, "uuid": "508ce5f4-f7ea-4e1c-ab1e-0049920feaa5", "value": "T18DF53392C6E260ABC795E738CC796C6E13E488C1F52DB08763F37542E7A94989DCB413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782821, "uuid": "4739692a-fe8c-4467-8bd7-e3416415ff25", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782821, "uuid": "4543c521-82a4-4cd7-81ac-f129973d319a", "value": "98304:f5gcgEa2JLUUWOLLC8IUaUoo5WesEKlK7TLNapTR:fVDaQtTKsjTLNuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782821, "uuid": "167b43aa-a88c-454c-9ce6-6d659e839816", "value": 3573760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782821, "uuid": "57509b8f-fa04-45d7-b173-54bfb5e8e7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782821, "uuid": "82e35ad2-d0c7-4b5f-988a-bc317aa5768e", "value": "53aa1a1aa43cb5f145280a4a5e014402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc1edcd-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649753404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "0a038737-c0c9-482a-bcee-7fb2ae03b8a2", "comment": "Malware payload (Mirai)", "value": "46adbeead9f7526ea3636433387e0ccc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "42d757fc-f930-4231-b6da-30a3389c31e4", "comment": "Malware payload (Mirai)", "value": "92b0fe999c115579d1635f20b08457d6145fea98679148f44fd4413fdb32581e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "cf921003-cec7-4ff1-8ac3-748083ff077a", "comment": "Malware payload (Mirai)", "value": "09e469eee93c8928f3418f852bcd6f65ff48381d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753404, "uuid": "6da3b261-1f8a-476b-b1ca-a403cb15d31e", "comment": "Malware payload (Mirai)", "value": "534aa29466f93060f213dc9aa07e24a64cb1009ec78d086873776f09984762524551b82bf7fccbc5d5bc56d23228aa4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "22c8618f-9655-4103-9439-6f407077d734", "value": "T149B33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "ac55c238-3701-4f14-8311-a8095bc91c82", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAH+TRCm7FnVqfJXFWbNb:T9a2aLqkrMesm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753404, "uuid": "4f5580af-1688-49b0-b0d6-3ca3ed7157cc", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753404, "uuid": "f865bcf3-ced9-425e-849d-34e62fa03b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753404, "uuid": "f7743c12-4170-4d32-a662-237a84f4014c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda4c94d-ba5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649766372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766372, "uuid": "5b28c054-f2ef-4e74-8700-ed27f2edfde4", "comment": "Malware payload (Loki)", "value": "a8c3d6923aee8114d480933cfca08aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766372, "uuid": "396f7c22-044d-4d44-945e-ad43c95e7b56", "comment": "Malware payload (Loki)", "value": "92bb5012578914468bee4337e356ee6932c50ce7718a6ff7ce5ee89de97cc850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766372, "uuid": "eb13200e-9fff-4469-95d5-5016ee63d974", "comment": "Malware payload (Loki)", "value": "399ac87f306ccbc0e788561445e596f96afcf5a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766372, "uuid": "af0e2e27-ccd3-4138-8c86-bbc7e6aae05b", "comment": "Malware payload (Loki)", "value": "2f53cfeb02929c3aae7e585a1c1c1da987aa2ee658626e30c80f29d0b8879b21d319b5a7e70e8cfd50640aaa6292f81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766372, "uuid": "17a2348d-fb9f-422a-a987-829b47580c0f", "value": "T1A834126F20E5D92FE503053388BB962BDAF79A0127B2216B37705F7A3110157862AB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766372, "uuid": "036cfc1d-400e-4d9b-ba92-61863d6b1b51", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766372, "uuid": "1eeb4f42-13c9-4fbb-93e1-44bb4afba1eb", "value": "6144:8Qq+BLiv+57DwU+TY9uAlEm2vU+b1D4pOQSTF/lm:TEv+5f3hR+5sp4Nlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766372, "uuid": "1fd93992-fc39-4069-b6b1-7d50b0c18586", "value": 233366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766372, "uuid": "2f3cda31-a51d-44f3-a0c2-e33247358927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766372, "uuid": "162c897b-0031-4645-a734-552e31fdc72e", "value": "a8c3d6923aee8114d480933cfca08aa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212e13b9-baa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649796604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796604, "uuid": "c2443095-72f7-4c22-9dc8-eebe74b93a4c", "comment": "Malware payload (Mirai)", "value": "16148b60bfec00cc3d6e52eac3c25881", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796604, "uuid": "9de2a67a-4f59-42e9-a252-4fa92f5d3418", "comment": "Malware payload (Mirai)", "value": "92be7c7d05edfa583f2fa376ce1a0319545a62af042d99575d3ec7997653aea9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796604, "uuid": "a2a56a67-12e6-4e51-8fe7-647a3170969a", "comment": "Malware payload (Mirai)", "value": "c656057c0d6d7107406fec70819703db5db01811", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796604, "uuid": "11518801-4123-478e-ac17-0b53f9929898", "comment": "Malware payload (Mirai)", "value": "501eb226bf5b05596b19e982c186cf2427089e48efb6fc2e9891246d2d1a72cba8375ed33e3bcd09dece6317423e840c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796604, "uuid": "c18a9d4d-24fb-4e7c-9233-47392ce26b30", "value": "T1CC33F112A3321F72ACB98877F5A441466A9D87BC61CAF7738248C99C4963F4BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796604, "uuid": "e6732821-8d76-429f-a27d-fcddd49baa7e", "value": "1536:hOIlMtSFSIhqUXKpdhi41Hf/ZVWLv8WHq:hOmMoBlapbief/Z8LFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649796604, "uuid": "877aef17-2395-4661-bd67-a92bb49e187f", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649796604, "uuid": "47e4e0aa-c598-469c-8d88-efa9cef4bead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796604, "uuid": "547c606b-3faa-4f37-9ce4-9bc160f0f02a", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4396abf-ba20-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649741124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741124, "uuid": "ae70a393-75c3-4237-84f5-10f3cd19e51b", "comment": "Malware payload (Formbook)", "value": "c35c64ff82e0716fd47b3bdc6ff93383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741124, "uuid": "d7f738bf-19be-420d-aa97-a33e0baca0da", "comment": "Malware payload (Formbook)", "value": "930759b9b35cdcfbdd7196aecb009374c34a02a142b67c99d07da2918e9aa341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741124, "uuid": "0da0a750-1202-4bc3-b87e-12e8d779284c", "comment": "Malware payload (Formbook)", "value": "1e5ea83ec92485cdd8839c9b3232871a5ae03f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741124, "uuid": "1eef0c31-b150-43b4-919c-a690b99b5085", "comment": "Malware payload (Formbook)", "value": "d82c77486ca6066ac84c72cc40c3d64afdd80b5405ded3dd3639307c8e9e024e3f0328bdccf60e9f6d8fa69561d135eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741124, "uuid": "4adbca82-1294-4648-921e-e792dacd2921", "value": "T1AE15F100F6759A0AC17C0EF388A546AB4BB1C416E412D7DB3FF9364A8922F9B3C75647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741124, "uuid": "53491842-f91f-4706-bcf7-39f261026de1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741124, "uuid": "b867a6aa-e2ba-446a-b7d8-7dc2417ee93c", "value": "24576:RXzWIpVIhtCd8+aE2ivssNEQ3VLhARJ8/LMi5Z3I1:RHIhIraEPEsNEQCELMi5Z3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741124, "uuid": "e27e4fe5-fb10-430f-8028-e28f9c8f2ade", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741124, "uuid": "4272c8f9-a955-4f10-ac95-ce1054ac144f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741124, "uuid": "8c45fa33-1f15-43d5-812c-1252b2f470ad", "value": "Nov\u00e1 objedn\u00e1vka na duben.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07bdc58-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649765894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765894, "uuid": "72e79cc0-c39a-452a-ba8d-9de4de7d2df4", "comment": "Malware payload (Smoke Loader)", "value": "5dcbd357241121efd30ba934f566063a", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765894, "uuid": "88440177-5c82-4569-911b-569e6b552e8b", "comment": "Malware payload (Smoke Loader)", "value": "931a125cd267490a79c4354842ecba57456cacb3dc58b784580740a358513666", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765894, "uuid": "4d084cc2-e551-44ee-bd7c-642eade0dd92", "comment": "Malware payload (Smoke Loader)", "value": "31a7cb4887bd3a1d1037b28fb888c259b28dbffc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765894, "uuid": "90b876f6-c861-4d0d-b603-ce9307fea49e", "comment": "Malware payload (Smoke Loader)", "value": "15c177496e70a9cb3bf998f6dc642002ff12df89f25f553c3deefb295d8d6e060d22d1f2f05bfd554b5a6324ecd664be", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765894, "uuid": "734d9f09-b8f0-497f-b32e-9e192dcd883d", "value": "T13554AE313A98C471C49355338820CAE0DA3AF831FA64B5677B58276A6E70ECC96F635D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765894, "uuid": "20de6e94-da98-41da-b46c-c463fb577506", "value": "44ee62a4400af83b87d8ba40d9bab42b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765894, "uuid": "ac14377f-23c3-48d3-8db1-3bc5259663e2", "value": "3072:TsQjb4qHwXYo11EhFRJgGz/g2R2d9lTQ8Wrxpzbgqru:TNPNfy182Grg2RSn1uzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765894, "uuid": "674a3881-b3b6-4d7e-85b5-cb6e6e2cf97c", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765894, "uuid": "c84ee5f4-38bc-4d5b-8120-6dfa83566d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765894, "uuid": "1eaa3904-726b-4033-a717-a37535231925", "value": "5dcbd357241121efd30ba934f566063a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7867fc8b-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1649741775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741775, "uuid": "9583701e-6791-4edc-a434-06cca92f13b5", "comment": "Malware payload (ArkeiStealer)", "value": "4b252625066da4e6dd2e61f7b653ae9c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741775, "uuid": "8b630a85-1eee-405e-8a69-eb64cfab1e09", "comment": "Malware payload (ArkeiStealer)", "value": "9360eed8311ecbad67096539e474c15a40389bb3f9b1f28bfd81f40b6ef42631", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741775, "uuid": "1f363b32-a8c1-4ed8-97dd-b447231ef71e", "comment": "Malware payload (ArkeiStealer)", "value": "5d1322574c843635e526ed7d75d6f4f4a403a5f5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741775, "uuid": "10b38cfa-884d-44d1-a3f1-a1def7b2603e", "comment": "Malware payload (ArkeiStealer)", "value": "e46f99274a5b53e45e6b507b63282df8aad3b3f53f70f466cc5a4b57a207a9defdf28fbfdef1266ab1a8d079b34f635f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741775, "uuid": "20f661f5-e316-4852-8d5e-6e672a3f7090", "value": "T1DBF32938D340F16AD4E200BAC97B4B75ED946B32138954CB93E4A88167355EDBE32C9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741775, "uuid": "92893da8-1653-4b84-abdb-1f5f3180467b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741775, "uuid": "05983ce4-5064-44c1-8d7c-545f7bd26d70", "value": "3072:AJ/E8k9L0JIYmDdMh1+foxoSaSvpmynT6sVu2Kqb8EG+:AJ/E8k9AgD6/T36sd8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741775, "uuid": "511f29e7-86c1-491f-9a67-93f3dea4ef5d", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741775, "uuid": "69737b17-e1ab-4e87-b7b9-ac74836ae0e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741775, "uuid": "40ba4052-a0c5-4ecd-9e58-c6e24785911e", "value": "9360eed8311ecbad67096539e474c15a40389bb3f9b1f28bfd81f40b6ef42631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979e5194-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649765879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765879, "uuid": "366a2e1e-889e-4231-9cf4-ef231c541069", "comment": "Malware payload", "value": "754baf652dccf66ee102a4c1c7b7d887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765879, "uuid": "75f7297b-f211-4a6d-8cdc-6d191c9aec32", "comment": "Malware payload", "value": "9469034627434b3aad5d88683729e7e8bafc2078ab62758808da1f2727999dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765879, "uuid": "4f1e7236-3d79-4950-8ee3-e7e015703c0a", "comment": "Malware payload", "value": "b7d3750ff73bc492378940053a38642628d3058a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765879, "uuid": "b73b4100-233d-4bf3-b56f-fe40e26f2647", "comment": "Malware payload", "value": "ba6ed4a5908061835fffc0da3323e764f74c050a7efd83bcca59911c7e0256c6a8f0679e676a6216d304ca35acbf113f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765879, "uuid": "c647839e-31f6-4c83-a101-0c41e3936b28", "value": "T1DC2512007A90E035F6B715F455BAC268BE2E7EA1A73451CF52D439EE1A38AE1DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765879, "uuid": "7265a486-313f-4b32-b476-8c51dbf4c5ba", "value": "da226befdbef45462493cbd252b0858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765879, "uuid": "f75c05f6-4dd5-4c39-803c-e1089d2cd5e7", "value": "24576:9XZrTxeu6zgKK+TWYD4/lrHh8R7lZ0pKoDw3VY:Rk+kBs/sR0Mmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765879, "uuid": "114d29c2-c437-4ed7-95da-14d7ba70f2ec", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765879, "uuid": "3e7c88a9-5577-42bc-870b-5a9ba5bee78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765879, "uuid": "1d53d017-a06e-428c-b8ef-595036d3794e", "value": "754baf652dccf66ee102a4c1c7b7d887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4eb338-ba1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649738478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738478, "uuid": "e739137d-5840-4092-ab36-8553edf0fb0b", "comment": "Malware payload (AgentTesla)", "value": "2e65fc4e818be0f8712b1e983bed100f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738478, "uuid": "86f412e2-8971-4486-ab8d-7012721beede", "comment": "Malware payload (AgentTesla)", "value": "948da83b549381eb9f532e96983e5fe85347b34c5650200c3482a209ccba1d67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738478, "uuid": "1ec0bf83-ba91-4eec-9a74-bc8ddf24969b", "comment": "Malware payload (AgentTesla)", "value": "4ea32c9fc307bd15e40daa3f033a9580c5b66718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738478, "uuid": "b27b9680-3b7a-4ede-a539-789ae6eb2c7f", "comment": "Malware payload (AgentTesla)", "value": "1d1a31ca68614f4087d6b14c6c37d21e1aa45b169985bc0c601fe339de7fdbf7268743c12429f509cb751478f1530a93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738478, "uuid": "69e10d59-0a8a-40e5-a64c-3129849e3c3b", "value": "T1A9350277BB56DE97DDED82781431BED263E283229243D78F6CCC90A9B3826D45B010C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738478, "uuid": "de450304-ab1d-4486-8d14-33ee96c0793c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738478, "uuid": "5603213a-37d2-4792-b1b6-e68b41b87d9c", "value": "24576:AdBqCebfeuXVgOnZTgFw/ToDCGeu9q3/6xdJVh:AdBqCafeEVVZTgFw/ThbPPuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649738478, "uuid": "5812cb50-ee8b-431b-a790-ca3f46d3cd89", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649738478, "uuid": "6c2e999c-bae6-4e58-ace3-500ed6030202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738478, "uuid": "348cb2b2-9c64-41e0-bd64-9804d1914880", "value": "22142014789.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef4cff8-ba98-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649792547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792547, "uuid": "f61e2bd8-2797-4889-aec3-4385c2163911", "comment": "Malware payload", "value": "66ac9a127ebb19f915987c31cf67d8d3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792547, "uuid": "cbba2e95-2115-4a1a-9fca-d754e43f0174", "comment": "Malware payload", "value": "94c0cedd61450d24b1195538edcd623b734749553680a42b5b64bc6194c2126a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792547, "uuid": "bab28c40-2ce1-411f-be7e-1ad7151eada7", "comment": "Malware payload", "value": "b90e008f65d129cd9ade9aa24a9e046d727ff3f6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649792547, "uuid": "9bd19ac3-befb-4436-a209-e38a7bb18be6", "comment": "Malware payload", "value": "b7fbab8973f0f76b1d3c3841dda2fa7daabace38e67974bed33109917a0f63d7f56d7c2c0b43283b33f01e3548c07db4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792547, "uuid": "90b0acea-b5f6-4bf2-ae49-061f5ade8d4b", "value": "T14D35CF4D492F1AC8D6A550F26B3387F6296EF4940420DEBD32B67025ED8DE7D8CC291B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792547, "uuid": "da4bee69-2684-4728-8d66-3207e3226edb", "value": "25c7ac00c91884fd2923a489ae9dfbca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792547, "uuid": "224d2d6e-0c20-4546-a2cf-fa1c6445bb03", "value": "12288:cabbKACcbDWwVexYHi4mrh+IyiPU0D88nTtgO9HvjA3RlkuRCYJRB7laUqdezDk5:faXcfWwgmKrhncQYlez5nGa84djgol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649792547, "uuid": "1fa4e3e8-fe27-4e12-a3e5-2117c8d073d9", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649792547, "uuid": "f78e7feb-512f-4774-aff2-264335d8ba54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649792547, "uuid": "c3132a1a-2ae3-485c-9a1a-35b08227bb87", "value": "x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5494b1b4-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649775645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775645, "uuid": "7ebde927-4474-49cd-b7c1-87d6d744d085", "comment": "Malware payload (SnakeKeylogger)", "value": "887d5890fb36dbfbfc53766b541c489e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775645, "uuid": "44d00f25-56cf-42bf-8119-ac0093a14eea", "comment": "Malware payload (SnakeKeylogger)", "value": "9516f1cf487efd2a423225820ca722edb17e15149af7864f174ab022719524ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775645, "uuid": "aff67a87-531f-4778-be41-e1dea4d08c9e", "comment": "Malware payload (SnakeKeylogger)", "value": "e174737e23ce499428f95d466f31ee4002ec962d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775645, "uuid": "d8bfdd2e-ddc7-4d4b-a27b-d1f4828acebd", "comment": "Malware payload (SnakeKeylogger)", "value": "a57f5c53170ae7754b52623aa754fb310bbf07ff39a7d1738b4de3546074eabd6bb4903d80000484cab31715fd7f5ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775645, "uuid": "f2655389-a706-4217-8939-88dab11a0cad", "value": "T109E4DFDC287B01F9E32A8EBE5DDCE9B0CF78E6212604F4B978D51F524B40B4489D2679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775645, "uuid": "d0cc122b-f082-40b2-9388-aca9cc3e88f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775645, "uuid": "33b11219-da5a-433a-a6c0-6a07274452ae", "value": "12288:B/qby0chFFQWNz+509Cmlp+J7mH9Kofvy/j/PfMWqoQhBm3xLT7za2f36NhbtFvW:AbHchFoI87mdKUvyLXJQeBdf36NpjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775645, "uuid": "9965eb23-ebcf-4658-bc74-b2779dff214b", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775645, "uuid": "97e3f975-ec98-4b9b-a90d-475fd0fa1f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775645, "uuid": "2181f8e7-51d6-459b-b64d-e67c193783e8", "value": "887d5890fb36dbfbfc53766b541c489e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b169971a-ba96-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649791692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791692, "uuid": "e9f68499-98cd-4507-bdc4-985e61bfb8aa", "comment": "Malware payload (RedLineStealer)", "value": "ca5436bb79e000032e9a54bdde62a810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791692, "uuid": "73b93628-ffa3-4204-bdd5-4cbdaeb0da6e", "comment": "Malware payload (RedLineStealer)", "value": "9551cf8d48f22c56838d5dd4e13ba6a2650936dee8a18303cddd57a3797eef91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791692, "uuid": "5768d9e5-3f84-4a0a-ac69-55cfe058199b", "comment": "Malware payload (RedLineStealer)", "value": "004b38e0235258ac9f2c11beb292880953045110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791692, "uuid": "0273a748-b75f-43a0-9758-ea728927f3eb", "comment": "Malware payload (RedLineStealer)", "value": "7d7554472f8952f96d9160afc72942ab0d771de00312fe9b5b58c41f245c68921d42b48fa1d51d6a931de8ea3e668d9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791692, "uuid": "94b63574-6a1f-424b-a1b7-0b4e274838a2", "value": "T15F74DF00B7A0D035F5FB62F89A798368B83A79B15B6490CF62C526EA17357E0DC7035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791692, "uuid": "91b3d18c-1509-4654-a840-810ea82da9e2", "value": "6116c6c1746619ba7e0e6ece7ad64bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791692, "uuid": "d89092b8-6b2c-4316-b932-fbc007633d70", "value": "6144:SpAeowDMPHCrutlmsMUBaoE52kxEFKNmm4s7t0h0o+wYLi6Kx/bB3Afj:oAUDMPirutlmCaz52kryseh0o+wYLiJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649791692, "uuid": "f618a80b-06de-4234-bf58-8bb00c3c5523", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649791692, "uuid": "5d1e8123-ff8b-4ead-a0d0-fbe0301ca85b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791692, "uuid": "ff1d76eb-8382-4681-ad66-b228a1399d3d", "value": "ca5436bb79e000032e9a54bdde62a810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009a9ad3-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764337, "uuid": "c5a6ef5d-16d6-4854-9e3d-86bccbb3e06d", "comment": "Malware payload (Loki)", "value": "e5c3cc8f931cad3528f1eba2d1bb6423", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764337, "uuid": "b6338ba4-702e-46a2-85c6-9d81547314b7", "comment": "Malware payload (Loki)", "value": "955224e30fb1ebf233ec2cee4d1bc0043414bdc1c3346b4a66f6bf35f8ce79d0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764337, "uuid": "f0cf2f14-7e71-46e8-b704-ed91bdfef45e", "comment": "Malware payload (Loki)", "value": "33867be5f309ab132d2eae1ed599ef06f8cf3943", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764337, "uuid": "99fc679d-54d7-4b10-b675-fffdc4963f98", "comment": "Malware payload (Loki)", "value": "9069d6584bbb9fcb9be2c0ae5bd676457ffd7a581efe9f6f44e08e984d69ab652a4eb56718dda9b69cd3b347e7a80439", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764337, "uuid": "3db7ae78-94f1-4161-a89e-bf11e5716500", "value": "T121742343B6B45B77EA473BF69A313A843182DC444B6BB50ED97AFA80457934470B0B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764337, "uuid": "b2c82853-76c6-404e-ac15-22b5c35f13ce", "value": "6144:cYYmFZXyiNEKwH5B7PpyoQqZ3wMzOu+iv5UrJKXGnDAYfsf1UUk0EKVwgKMnB:imyiNEjZ15QqZg5ulvq9nEGsf1UljUp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764337, "uuid": "8c2439c4-fb95-4bf4-8e9e-2e0df0e5ae7f", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764337, "uuid": "40c2484a-a9a4-4664-9814-8fe861d95304", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764337, "uuid": "4c5bd170-eaef-49c6-95db-79f557827607", "value": "Q07936.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451de6cf-ba64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649770036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770036, "uuid": "c5ab42fd-c0a3-4458-a520-68db309013f8", "comment": "Malware payload (Mirai)", "value": "b3d4c6030e51cb2ae8c9b247b92354b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770036, "uuid": "5a083092-eec6-4c5b-8c3b-4c738f163762", "comment": "Malware payload (Mirai)", "value": "9583e918250f130d1e46ac1b21fe3074a717784e4defeb346bfe911c6e57d873", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770036, "uuid": "24c2d7b3-efdf-4b27-856c-cf29e1063138", "comment": "Malware payload (Mirai)", "value": "a97f6c79e2e99b6ec41d07b37469c64b98fef7f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770036, "uuid": "0c51f19d-947f-463e-bd78-071aa9c71989", "comment": "Malware payload (Mirai)", "value": "69fcc3ee8113cbff6080a101281f70215191392d04fc1e5d5f405dc7ac0aa8224d8722aa57a48254a4c7731f0b1c1823", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770036, "uuid": "83597cc9-738a-4a2e-ad8e-299d89985004", "value": "T1D7A2DF1821CCE972D1B0803AE23CC257AEDB47B652FE713E1E184B9DA49190AD7BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770036, "uuid": "c598ece5-17bc-4941-a03c-82ac9e6fa6ac", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb2hymdGUop5hXa:YKoh/DxCvhdR4IjWVFbSCs3UozJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770036, "uuid": "8e0ed56d-fa16-4538-bb82-c38f388b63b3", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770036, "uuid": "619603b7-3a36-4e63-9beb-4bb85f175832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770036, "uuid": "b0e60ca1-0c5a-4e5d-9883-7eca947ba1a5", "value": "b3d4c6030e51cb2ae8c9b247b92354b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539fa41b-ba61-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649768771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768771, "uuid": "73023c17-6ead-424b-b150-a2a3703834e2", "comment": "Malware payload (AsyncRAT)", "value": "bdcc93e78067547b3e70b719d1cfe62b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768771, "uuid": "f2d506fb-0d59-470c-b7ec-bf6bc2b9fe53", "comment": "Malware payload (AsyncRAT)", "value": "95bca18b03f45d44a3b1962f05c170cb598c4d315a3a90de532deaed57e16920", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768771, "uuid": "f84d0898-585a-4843-8591-5a80f7994488", "comment": "Malware payload (AsyncRAT)", "value": "de63d69745f5ec4ac2aa583022a4bb37c480199b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768771, "uuid": "2687097d-867f-4ef9-bd1d-f536d7b6e900", "comment": "Malware payload (AsyncRAT)", "value": "cbfa1836c0957832df9cc59dd6d01196572f224e8bea952468d370bdef7de5f4f8a26284fb479a0840f9fda18cd0d584", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768771, "uuid": "c0050919-e4e1-4e13-ba96-f482353ed424", "value": "T104C4B75C6E05A661FE8EC13948034B04BE5B8EF3B660F6C1DBCA26CAC74B5719D35AC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768771, "uuid": "ea7f6415-5815-43db-96e0-8e20c1a06190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768771, "uuid": "95177bed-2c2c-4bfe-aad6-a137b0bf39a4", "value": "6144:I1I+N+cldh2kWDwy+p9D4Lp2trhUc2afmZ1epvS435tuL/WM95zHaiq3LQZ:I1DlmwyC9sAhgzqS4vKWIzHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768771, "uuid": "ba3d5ec2-aa22-4b64-94ea-1d0c055cc8f7", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768771, "uuid": "b460e989-07d5-41c6-b1d5-a264e6dfd424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768771, "uuid": "aef8ed09-f469-4965-8a50-106b6ba879ba", "value": "FIR.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812d8579-ba13-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649735347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735347, "uuid": "c092bcfc-47af-4a74-8247-41c5795ae879", "comment": "Malware payload (Mirai)", "value": "de559f97d741743c354943f144c36e5d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735347, "uuid": "1be4eea4-7683-4575-9698-6f1a81d00406", "comment": "Malware payload (Mirai)", "value": "9642f4966a679bec44c1c5b10e1644cbb6eb1f2be4ea0cd1073bca1b6cf18885", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735347, "uuid": "ba221f00-7bb4-4602-aaeb-b9887ff6320c", "comment": "Malware payload (Mirai)", "value": "e75a26cd4a8627d036d2e69e5a0d614379ec4d9b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735347, "uuid": "90dcfcac-3a52-473a-8a43-c1bf9235cfb1", "comment": "Malware payload (Mirai)", "value": "ede51428a69a99f9964bdd83548fe718315e84e39bad7ca961c3b3f1a5a4350f10a28de61d4b3676df5de307743892ad", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735347, "uuid": "d4bbdc18-2705-4ad0-a253-4028afd5eaf3", "value": "T1E9532A03B58181FEC099C17466AEBE36D82374FE1379B19A37E4FE253D4AD211E1EA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735347, "uuid": "bf3254c9-a548-4df3-87da-ac2c11de9170", "value": "1536:BrNX6ADsOYXwfOlUzNDVD8C50IGwFyj65L:JNX6ADXkwuUZeCmwFyjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649735347, "uuid": "8443b12c-182b-4506-b3c4-a60cc1ae603c", "value": 65488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649735347, "uuid": "a3ebbdaf-f1d6-4ac9-a907-3fbfdaad485e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735347, "uuid": "72b76ec3-1ae6-4dbd-9073-60b560636b97", "value": "de559f97d741743c354943f144c36e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fe99b2-ba51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649761773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761773, "uuid": "b2a9bc43-7bbe-466d-ba88-bbff165d88cb", "comment": "Malware payload (Formbook)", "value": "7c3e71ebe8f232ee6f1e00e03b46a1b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761773, "uuid": "88a97912-482a-4118-882a-d2c488198288", "comment": "Malware payload (Formbook)", "value": "96c1866c600cfad949efa72be8fb63db84dd160492e7320ce4912610364807d7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761773, "uuid": "f3f2184a-e2f8-4d7c-90f3-40f49751b348", "comment": "Malware payload (Formbook)", "value": "45c6960dd147d3ea235e7da30381e189f5f0ffd6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761773, "uuid": "596c661a-33d3-4922-be6b-0c35fbbeb7da", "comment": "Malware payload (Formbook)", "value": "00a5c23b5df8140d77e76cf0c2a94abe7e3ef0e55097c915975f2e738f2e7d47eb47b9be5897e79405fac7e22bf424c4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761773, "uuid": "5a6ca583-d42b-46b6-b472-33790c633efe", "value": "T1F83209BCD067C5F8CFCAA2E46939EA6811D6726DC3D9F00379BC6B7117A2B2D4606434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761773, "uuid": "2364ae8f-1bad-4020-bf72-b4e9c5f6de54", "value": "192:cWV4G+l0rSSBF17sZOr9e62uFwhFESleeDUYVuD2oM8IDh9T4vq+YmQM3G5hMWNu:cWVWl02WWZs93FwLlBHVF8Ih4vqkQsMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761773, "uuid": "7f3ea6cd-4503-4804-bccd-c365ed028028", "value": 11282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761773, "uuid": "573eaf55-e2b4-45da-8d6d-7c81b15c5c92", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761773, "uuid": "0700e633-b152-4378-83b9-fda1bfe9e07a", "value": "Request.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ed003a-ba0b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731810, "uuid": "74b3119e-219a-4c3c-973d-54053cd1fc54", "comment": "Malware payload (Mirai)", "value": "c843858117489ffad073bc8269ca6e25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731810, "uuid": "bc6b1eb0-ef72-4678-a70f-dcee1db34b12", "comment": "Malware payload (Mirai)", "value": "97204dc7c39aca905547700904be052f99739d3163d862360babc9515d497105", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731810, "uuid": "5d3e9758-cacf-4c71-93c1-99dba51bd3f1", "comment": "Malware payload (Mirai)", "value": "c63de2f70c99b5e2b24c65e920f56c0d5f105b16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731810, "uuid": "f998bf3f-e011-4d6d-9eff-a43cfb12e0fb", "comment": "Malware payload (Mirai)", "value": "5212fd77bdd2c3ed1c38f02ab590f512059875dedd5db6bce459dbc75700d706f950677c0d439e971f26439e2556588b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731810, "uuid": "b7ac61f1-ac64-4f2d-9f90-dd094af134ad", "value": "T1F5D34B56FB408B13C4D61779BAAF42453322A794E3DB330699285FB43F86B9F0E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731810, "uuid": "d57a2a73-a510-421d-b7c9-373c4e72ea0c", "value": "3072:RXs7EfMszZjkF/Pzwc4EPu/JFKotvjn9wurnVrM/9PYm7wGgWT3:R87EpNwdPGEPu/JFDtLiurndM/9Qm7w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731810, "uuid": "b935d5cc-bfec-4f04-8ad0-358ddbeae84f", "value": 141262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731810, "uuid": "86dd96a5-0591-4774-85cf-05e533d06d7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731810, "uuid": "6bfd2a1e-3242-4302-a691-9e364487bb4c", "value": "a1mb0t.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3380357-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764315, "uuid": "647e4665-24be-476e-9673-3e13b6562633", "comment": "Malware payload (Formbook)", "value": "7cf52a50283878529ce4e0b4558eff1c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764315, "uuid": "7b389053-c4e3-422f-9a73-664e1796dbd8", "comment": "Malware payload (Formbook)", "value": "9733156bcc612dc5b921301201061834a74536a43467095afad926f3a62cc074", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764315, "uuid": "6496d351-1430-42c3-bc89-78e414d4bd42", "comment": "Malware payload (Formbook)", "value": "0571c18a7c098e6468b9ffb858d42b7cd2c395c3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764315, "uuid": "e4fc960b-da2d-4551-8135-f065603cfab6", "comment": "Malware payload (Formbook)", "value": "2a6606ae1694465fa24fa017359a4e0ac99cacc9e1c1667d69d43c4838242da7adde68dfc0fb913388fec35f9b11c017", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764315, "uuid": "257d27cb-fb9c-4937-a4a5-07e010942e3a", "value": "T1C27412A0B96A69C3D19F6A35DA322F345062FCA3F3DCC125929F3B950A70753D8791C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764315, "uuid": "f7a8984f-9426-4434-a89e-d8e59a8c73c2", "value": "6144:0xpmjqXwqKCwNfj0IQriGfBrKRPvIjdLCbjYp8KbDCD1oPADgzhZd7ugonYB:ymjqXwdCw9j0WWK6wbjY41oPADgzndiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764315, "uuid": "5cf6f278-8d40-4cf7-86a3-3d42ce493cb1", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764315, "uuid": "d19ec800-ee52-47db-961d-d149d6c982b7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764315, "uuid": "17934c9b-f415-492d-982d-eccb86577c76", "value": "Deposit Receipt.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe15137a-ba81-11ec-8e58-42010a9c0032", "comment": "Malware payload (OnlyLogger)", "timestamp": 1649782801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782801, "uuid": "b560cfcf-6c6c-4dbf-9879-11cc899cc726", "comment": "Malware payload (OnlyLogger)", "value": "76a216ea59a29d12a4aff084ecd84432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782801, "uuid": "a031c2f5-caef-4c5c-9b07-f0ba4d649650", "comment": "Malware payload (OnlyLogger)", "value": "973f5ebc85c4468b274d01c2396c135d80f264fe9719c7a1f5bda62cacee081e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782801, "uuid": "b789faaf-18a6-45ee-93ed-676025664a8e", "comment": "Malware payload (OnlyLogger)", "value": "0dfeba24d285c6cba3f27b7c0cb216eccce2d548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782801, "uuid": "fa54a41a-33eb-4e75-a5a0-c44d75517b7e", "comment": "Malware payload (OnlyLogger)", "value": "f0a8ebc3033b06aaf1ab3a07ab21f6d537d35161d38c0e5a25bda470630fe443920c08de156bec37d913f47e35e5fc0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782801, "uuid": "59757569-2318-463b-9c29-f513790c3063", "value": "T1AA84CF3039DCC432D4A745328825CAA55B3AF83069219987777A677B1F30ECC9AF635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782801, "uuid": "02081731-e42c-4385-a0b3-24e4ae11b762", "value": "44ee62a4400af83b87d8ba40d9bab42b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782801, "uuid": "321a4c74-23db-4150-b7db-052413b32673", "value": "6144:/4eZzRUqdWR2ZMOnnC/6AvJkZLWc64cAwlSHSuzbgwu:72EWReMonk6bzcDunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782801, "uuid": "ebaea8e4-e36f-49f4-a83c-80a65beff105", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782801, "uuid": "8646cdfc-69c1-4b99-b17f-51c5c2828375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782801, "uuid": "472d06bf-cb97-4e70-b685-7741f7e49e1a", "value": "76a216ea59a29d12a4aff084ecd84432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e774b044-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764295, "uuid": "82f8667b-4896-4dd9-93ad-7aad25558ebf", "comment": "Malware payload (Formbook)", "value": "7a4b75d95bd6eb473fb620863236847e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764295, "uuid": "9f5d9a1f-c283-418a-b492-e6fec7acdc83", "comment": "Malware payload (Formbook)", "value": "979d078e071b020ac8a126851e57cfe99940a968f33cd356eb3db153f1b0a060", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764295, "uuid": "df2e3546-fdfe-4c8c-98be-cc1d2f0ccafe", "comment": "Malware payload (Formbook)", "value": "0c6d7621500b0c13992a04bebf9f34d232c255fd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764295, "uuid": "f7a6bdca-90d6-4c13-be27-ddce887a1e91", "comment": "Malware payload (Formbook)", "value": "c2058bb885f9f800133bd3f4e2e7cb318e9cf9931267b32c5413566a308069aa52421b4cabdb8fbba003868f204ecf59", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764295, "uuid": "1c1fb5df-b310-45ff-936f-e9e03b7ce154", "value": "T1F37412AE3C425F13C9A2EE3400776D085453FD11A7975A9CEF06B725533ABE38A12A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764295, "uuid": "a71e3f2a-52d3-4741-83b5-e62761197219", "value": "6144:KkvctqlvZXM4JmPp43Q0cCDOcSAGP9tDR+tzrFM5NRmmb:K2ctuDDOcgP9j+9FM5NAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764295, "uuid": "327a6743-4c6e-4fad-b516-5b9eb61020b5", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764295, "uuid": "80554a6b-1c5e-4979-b4c1-1cd18e6785d2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764295, "uuid": "79e021f0-4047-49af-83a6-08b9922c449e", "value": "deluxemat-et Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490d3dd9-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649771331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771331, "uuid": "715e73b4-55ef-4de4-b2aa-139df98fdaef", "comment": "Malware payload (Formbook)", "value": "4d28121cbb526b7104f0799f9b51c9d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771331, "uuid": "dc042bca-196f-4090-9b43-6cc0f82789ee", "comment": "Malware payload (Formbook)", "value": "97f9be81878384fc88e1e0b4dc912a297579bd88a49058a9b903810d0ebd5620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771331, "uuid": "13d6c377-48a5-41b2-8cb5-a9481c27cda7", "comment": "Malware payload (Formbook)", "value": "5ac6921b53b90e28d74c14dbd7bf1e1c400f5c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771331, "uuid": "b587f5a3-4478-4651-9f3d-2f11b40f5c2a", "comment": "Malware payload (Formbook)", "value": "4b8bafd78a7ee247fd8ca4c0aa929964a439d30ee3f3947c752e7d8df1ed5160b03eae9b16aa3277c37fc4b0185d648c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771331, "uuid": "973cffcc-2c42-42c6-b36e-047eeea82cf7", "value": "T156341236F9E488DFD6A685B200F29B29D3FB734C19056BBB17F41F395716483AD0A122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771331, "uuid": "332f6c78-9570-4cf1-be59-6cba250f9aaf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771331, "uuid": "7ee81bce-1390-499c-a83c-36b833afed5b", "value": "6144:8Qq+bVRHxSYWEb64pez37F+3mLR7sHBZuagnWhbo:TbVRy7c3mFUBkaMWhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771331, "uuid": "c7824d2e-2457-4718-bb33-84c89ca45df0", "value": 240528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771331, "uuid": "82ffd63a-f46f-406a-bf4f-050dc593974d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771331, "uuid": "5f58edf5-e931-4017-a981-88c362bf7bea", "value": "bill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7354720-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649765932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765932, "uuid": "c84b11ad-bebb-4c46-afeb-8976766478af", "comment": "Malware payload (Formbook)", "value": "0193bfb7dcee338a667652bdd31e9fc6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765932, "uuid": "9cc100f7-d89f-4bca-a806-8d9bd6dff832", "comment": "Malware payload (Formbook)", "value": "99e7325389a5f270c7564e5b699b44b0fcecbe7ac4a981c581bec8a63b5138e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765932, "uuid": "9f149144-b6f9-4502-97aa-41e9f78a58aa", "comment": "Malware payload (Formbook)", "value": "75b20026e2146a529d9a1350cfcc65b604ea342d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765932, "uuid": "d041b40f-e76e-43e5-b2ea-35fe603101ae", "comment": "Malware payload (Formbook)", "value": "3e817f367ec718a0c3622f8d1cbff6d5a49135778621fc8de6333c6a0adeb7fa36f7bf022e027cc7c3b0344606effde7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765932, "uuid": "a9d51b01-dad7-4fe7-b6e5-402d5d29c907", "value": "T194741225F27D1E66D597533C80E681250B3CEF48DE299F86A0B1B91C187BAEB19C03DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765932, "uuid": "72c63cf6-cd25-4503-a679-efd788fb9443", "value": "6144:dBng0PNvZzo0qEm3VbHKOgi6eBl8Y1SsLSA0yRHgTgYCyM3Qb4b1BLFTzRGAOmbO:dBg8Ro0M3VbHRg101SwSA3VgTjVM344u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765932, "uuid": "db0b8e4f-d46e-4d44-a8fc-36a41adb1b18", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765932, "uuid": "6126069b-90aa-4505-8e08-494e79f6478b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765932, "uuid": "0aee9a15-643d-415f-9f0d-86fce0e835c3", "value": "CS-60.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cf8074-ba0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649732452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732452, "uuid": "a9ca0438-6e1d-4bef-bab0-8abd2b13e28f", "comment": "Malware payload (AgentTesla)", "value": "7860a9fa04854b0ef834c4a38dd5f1ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732452, "uuid": "2cc12c99-59f5-4a1e-8597-514632339459", "comment": "Malware payload (AgentTesla)", "value": "9a0be359a0a681bda8008fed45641514f27f5b6d12765cec65ac1d261166f3f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732452, "uuid": "c75ca4aa-af40-44b0-95b6-22c1637c631c", "comment": "Malware payload (AgentTesla)", "value": "5b4d403fc4df191808e75cf97ec9369e530ee640", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732452, "uuid": "2622e5bc-dcc7-4146-9ab3-aa71f576bfca", "comment": "Malware payload (AgentTesla)", "value": "b35d9f64defe6635eb0b5eff4637600274d24dfe79d005ad8d1ea5f4493b65afd1b13d0b92427e6eb41ad77657f08c9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732452, "uuid": "44f39b57-cfaf-4d27-a209-a091d0fc3b4d", "value": "T170E4E12573FD8615E5BD17BDE438018047F6762B5827E3BC5E05A0E62E233C0DA46BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732452, "uuid": "b06f94bb-1baa-4ae3-afe6-10554f934645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732452, "uuid": "3b031c3b-5ee5-4ace-8002-caa05d6b1e4c", "value": "12288:VkKUk6P+P4qBh5l7e+0wANTSePB/UGdaqBWJ3asnizfK5JJF5ZdgVgz:VkKX6mwqBhH7AGw8DgWJxn8gJJF5Zem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732452, "uuid": "3c83de8d-16ec-43e7-98e7-698407bca078", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732452, "uuid": "65ebb00d-52a2-4a2a-ade1-a3dffeb8d010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732452, "uuid": "da4dfd8b-0b78-453a-97e5-1b72294076cc", "value": "SecuriteInfo.com.Scr.Malcodegdn30.26389.26552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff5bdb6-ba6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649773624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773624, "uuid": "10aac555-538d-4c09-8750-a055607b25c1", "comment": "Malware payload (Formbook)", "value": "127d29214c3c963eaed82aef3c5a8309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773624, "uuid": "5aaa57d6-56da-4b33-ba25-145aa7deb767", "comment": "Malware payload (Formbook)", "value": "9a89f7d24e1bc1ca09e2a9ed6b123a5e34fd963b5ced315c49e2bce5ed6b4bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773624, "uuid": "a25e45d5-6876-4533-b4cd-82a39cb03e4c", "comment": "Malware payload (Formbook)", "value": "df5a3ee56a399610513af3dcb9879af23b7ae0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773624, "uuid": "50191c15-11e1-4752-91f5-106eb9dda35b", "comment": "Malware payload (Formbook)", "value": "fe82c1f5c48caf7ea91587068b619adcac9ae22a9752aaff96184cc94f561061749efe7336085ca80bf84a22864ab650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773624, "uuid": "9685130e-0032-48eb-85c2-d827d1b58f30", "value": "T18D350237BB159E53DEED93740421BEC2A3F182176247E74EACCC91B9B7836D92A011C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773624, "uuid": "02a8a501-ec78-440f-b928-62db61b77cbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773624, "uuid": "4edca40f-a86c-4429-bf75-7db1f4aa1435", "value": "24576:zdXwO0vfeMdVe8cT5l3PwzG2aUiI/KjGpUbiZNgz:zdXwOYfe8VGLPmG21piiZNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649773624, "uuid": "e7058a2d-7cc0-4bfc-84ce-9ec81de56a39", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649773624, "uuid": "fed3f120-c6f0-4f32-ae1e-cb39ed17bd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773624, "uuid": "834e1657-a4d1-4ee0-b97c-d6ca4658a358", "value": "Swift copy MT103pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14594706-ba7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649779832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779832, "uuid": "ed1c30db-3b2e-4e2e-9052-160f2e215729", "comment": "Malware payload (AgentTesla)", "value": "d6d7d39779f8b7c473ce78bbc33f5171", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779832, "uuid": "8fe8c20a-ed68-48d6-94b0-24bcbdcf92af", "comment": "Malware payload (AgentTesla)", "value": "9b644eae2b5352d45bb2550593d61c8ba72468b130da4f79edea35f0b1aada87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779832, "uuid": "c4e5956f-89f5-44fe-9d7f-60d593c0e4c6", "comment": "Malware payload (AgentTesla)", "value": "a2bc4bdc29cc342e44e271226c8a21e73763743d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649779832, "uuid": "ce426648-6093-4cd1-b488-e8470499c904", "comment": "Malware payload (AgentTesla)", "value": "99abbaa18d2b00bc34dd93be513f1ce2ce218ed71190d62f2098d8f9e2a24b6b07650d10ccc14362e7c06706687f3dc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779832, "uuid": "d895dbd5-eb0b-4d1f-bafc-52f14d72c6a5", "value": "T11C45FBC6F9383CD4D95772F384BA4C812A6DBC26A362A55C346DF2450B5F2EA493381F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779832, "uuid": "0b25b5e5-f120-4caa-a6d2-dbcac9631b16", "value": "1536:lm7N2c5OPi7teVgUmISU43ZPTCNJjJvP:I8lVT4pPTCPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649779832, "uuid": "73de0220-49ae-4af9-865f-055749f42023", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649779832, "uuid": "02ed6202-7892-4b58-b0f9-aebbaf3ef958", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649779832, "uuid": "ef89a0c4-0ef4-4f3d-a65d-4c80e118ca46", "value": "Scan_4300005864556689954.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3f29c9-ba19-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649737787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737787, "uuid": "db0eb20f-5b9c-4c92-bccd-95723e020146", "comment": "Malware payload (Heodo)", "value": "32a74f95f48f9822f2c6f88ffd061b43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737787, "uuid": "d26b79e0-f97a-4493-bf7d-bb0ea7f66226", "comment": "Malware payload (Heodo)", "value": "9c475d660fefc6b8d7904867f0dab0f4483ae998c4c6d172bc486ea5c9036e00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737787, "uuid": "3041dd9c-ea42-4be3-9e91-1c2e57fe093d", "comment": "Malware payload (Heodo)", "value": "9e6e366cbd9d3874c28d820506826d750814295a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737787, "uuid": "578301d9-8eae-4453-aaf5-6bebb8814986", "comment": "Malware payload (Heodo)", "value": "c9856f9a3761f69b79f5d1612e14b3ba59382d5d3f55674a5263a54eed58cfc3625af0a0c68024c7ad6ccde00e99c81f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737787, "uuid": "0c81fb60-44fe-4056-90e5-f6297598ab6a", "value": "T131A44B0173C390F0C657A574840FD525ACB7B83C6B19857EA28BA26F4BF78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737787, "uuid": "4b6becb5-fa8a-4d4c-b06b-ae53224dc09d", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737787, "uuid": "caea3784-6c04-4b87-a5db-205f4e0cc89a", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhA7ArkqBoEimFmzUM090/DHr8cQh:S54yM33d3q3Z7BogxreNmF+U/9JcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649737787, "uuid": "d7ce8e20-2d54-40e9-bc55-fb2a0de35346", "value": 474392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649737787, "uuid": "54c66271-15e9-41b8-a2e2-3776666231e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737787, "uuid": "c9ec8857-9bde-42cb-a786-ce791ebd4122", "value": "emotet_exe_e5_9c475d660fefc6b8d7904867f0dab0f4483ae998c4c6d172bc486ea5c9036e00_2022-04-12__042942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46a1261-ba72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649776235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776235, "uuid": "1a2d4e81-c260-49d3-952f-de4aa2ec0603", "comment": "Malware payload (Formbook)", "value": "afa5e55248bb006f2094b5a809ce99f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776235, "uuid": "f138bf74-a869-468e-9758-570016db1acf", "comment": "Malware payload (Formbook)", "value": "9c6a6119bc7008246685cb9960fe21969a8bfbbea6659e6e0afa329358c60a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776235, "uuid": "f374c087-b0d4-4d4c-904b-067b15a76651", "comment": "Malware payload (Formbook)", "value": "688b649b1319e2a3eec3f40582545f8486dc53d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776235, "uuid": "a24d85b6-17b5-458f-a6d0-3557a4d88864", "comment": "Malware payload (Formbook)", "value": "66f866fca4b7b8673ed21b866d828a6a591840419d9ddfd34eea786ac174adb6cc29f4cd1c612b8bd2b61dd63cae2754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776235, "uuid": "55c596a1-3b0c-4738-a2b2-8b1427d58e72", "value": "T1C3D4E0157AFC8625D5FD07BDA07401808BF6762B6816E3BC6E1660DA2D633D0CB43BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776235, "uuid": "79bedc59-f912-45ba-bbfb-ce7d293e2431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776235, "uuid": "55f58225-8d0e-4283-8ca2-8665a579e118", "value": "12288:hkKUk61+4qp1IZufcTZiMXetUVqXHTuQQy3oJJRbELOFYxw+gVgz:hkKX61Vqps8MXetRC1ygHbEL0Yxw5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649776235, "uuid": "c5d29e92-3ac4-44be-b891-34dc3ef119dc", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649776235, "uuid": "3ea266d7-3778-4687-8bfa-bad8f2afcf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776235, "uuid": "98c497f0-8f4c-45d1-91d7-46f1443320a4", "value": "bluezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1052f0b5-ba3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649752338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752338, "uuid": "cc89d049-7608-44f4-aa00-e36a8ba11de8", "comment": "Malware payload (Formbook)", "value": "3b1b0899d16957eb89846f3993c7b458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752338, "uuid": "e73fde93-98a1-4e13-8606-f10c81e14060", "comment": "Malware payload (Formbook)", "value": "9ca60574d9d34c0b3450b8c79c865b3dc722169a3b16d86e6ccb71eef22cc9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752338, "uuid": "35c7b3d5-c952-4d3e-842d-f98ebb43f285", "comment": "Malware payload (Formbook)", "value": "934f55e1ce3ac1a61a31fb50986fbdfbde1e9593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752338, "uuid": "373beb59-185f-4d49-b830-712cef2dbc8f", "comment": "Malware payload (Formbook)", "value": "e0d66b915d7745308441aeef3a2341fb3656d2344edba6c4db5f8d4837702fbcfe7b1e5e5d3afb5a61f9cdfa59b21a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752338, "uuid": "6941e418-7397-4352-8ac0-256fce27a492", "value": "T1FAD4E1157AEC8525D5FD07FDA02401808BF6B22BA817E3BD5A16B4E62D233D0D7077AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752338, "uuid": "22c941cf-cac7-4dd7-87c9-a4dd9966b4be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752338, "uuid": "eaf13887-7677-4f61-ae20-c546328fda6f", "value": "12288:gkKUk6j4i4qM+j99IG8BeCZQmIrfX+ebddaoMBPA56dgVgz:gkKX6M5qMt3B5krbpwA5jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752338, "uuid": "2ef7da99-dc61-4a9a-8c10-7abc9256aa25", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752338, "uuid": "bf57d06c-c2d0-431f-a0e3-60283565ce3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752338, "uuid": "48e815fe-0e1f-4ba2-90a1-5bd3b03f8763", "value": "payment transfer copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e889e7-ba94-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649790671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790671, "uuid": "d5916b0a-f1f0-45e0-b210-cc727da57090", "comment": "Malware payload (RedLineStealer)", "value": "bbd4a3a5b4cbfa3fc406a0581bc8c136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790671, "uuid": "5844abc6-1dd9-4944-9051-c3700c60b953", "comment": "Malware payload (RedLineStealer)", "value": "9d11c964c52912f41f745011a35eb1bc3dfbfcbff568ce3c1fbafdffbcf17606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790671, "uuid": "1959d4d9-f759-4737-aa80-0fbd395a700a", "comment": "Malware payload (RedLineStealer)", "value": "f761aab7c23debd03bab6ba205bab6f978966667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649790671, "uuid": "f2df266a-1693-4917-b326-caae1d52653c", "comment": "Malware payload (RedLineStealer)", "value": "9e3c284a9f03511ed3d810f6f2ad1b0387229c932a46e5cf651ac7ce1321546ddbccc1753b629c656b5f039996ce9d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790671, "uuid": "4a38ee0f-7615-43d9-9490-7d8f456c1101", "value": "T19D74CF01B790D039F2FB52F45A7A83A8B92F7EA15B6450CF62D526EE16346E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790671, "uuid": "9e48fe9f-ee2b-4940-a038-ed64cc36dc59", "value": "6116c6c1746619ba7e0e6ece7ad64bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790671, "uuid": "0069f7a8-86b5-45e0-93e9-a6fa1495c089", "value": "6144:MDkh2n2q8KHRrh4LsuP5KsXg8IQZ4KhPjeJY1cgI/C7aEa4hgmIlPC:zhRq8Kxrh4LfKc+Qbt+qO4zIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649790671, "uuid": "dc7441dd-7fa2-461d-affe-edcdf45b1c76", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649790671, "uuid": "79cc9981-f4c3-4163-b788-959e5009968a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649790671, "uuid": "105c49aa-60b3-4ef3-a711-1af31a0199dc", "value": "bbd4a3a5b4cbfa3fc406a0581bc8c136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0e9512-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649766581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766581, "uuid": "ded0d39f-5908-40e9-ab52-b35ddae7a858", "comment": "Malware payload (Loki)", "value": "f2f848b6498d59bfa68bc2460ed9ebf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766581, "uuid": "8f23c908-8941-4c45-a192-9169d0a39582", "comment": "Malware payload (Loki)", "value": "9e302e72968dd1317f734d7d93d40803453d0811985d496c91d33d255e64b2dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766581, "uuid": "7a7efd33-af74-4c63-8c27-1ff4181c97d8", "comment": "Malware payload (Loki)", "value": "2358660002eda438e49a5bf40d32bc29c9938bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766581, "uuid": "f35ee892-36e6-4bf7-8a12-904d50219ea9", "comment": "Malware payload (Loki)", "value": "0a435f34517655b005d5006c5c8b4d4439526cf84f318fc7c15ae470c1ab9c257046f48a612bc9bc2061747972fae23b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766581, "uuid": "7aafce50-6413-4036-b2cc-b0c8b2dc742b", "value": "T1AAD4BE0EFAF7C916E2A91B77C0E6090407B0AA42E556D72F758122990D233E79D437BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766581, "uuid": "8c49a275-5cb2-46e1-ac6c-f1b4c5d56b33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766581, "uuid": "8f1c3577-3d3d-47ab-aee1-3e8573de2ec5", "value": "12288:eU6Kiaywput4qKZw3lT/DVLDn2zf+NH0M+5QzglPg2g6:z7pUaqt1TZvnoLH6zbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766581, "uuid": "5d5fbcbf-4edc-4bae-ba21-de8fbb9370c2", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766581, "uuid": "0fa0a765-1c5c-4faf-9978-d49409da008d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766581, "uuid": "d49b1ecf-76a8-46a2-b3b1-bfccb4905c23", "value": "f2f848b6498d59bfa68bc2460ed9ebf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cae1c01-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649767579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767579, "uuid": "7f272530-4b7a-4343-a922-87f44ea01882", "comment": "Malware payload (Smoke Loader)", "value": "8630773a0aa1a22cf616bfd71a33e09d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767579, "uuid": "af90c398-52b0-43f4-8555-fbdef3634e46", "comment": "Malware payload (Smoke Loader)", "value": "9e49724e1da8cfc7d1f78b25eca2459b3031aaf502290de20b22abe3fba99deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767579, "uuid": "6b2348c1-24e8-498d-972f-2769ff72ece9", "comment": "Malware payload (Smoke Loader)", "value": "f7eba6f76856b6964976ec8118230cb5319111bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767579, "uuid": "32936d6f-b7e5-427c-b4f7-3e90be3ecc2e", "comment": "Malware payload (Smoke Loader)", "value": "73e1f55e2d6830dda7bddc944f7b4e8e7bd2ecc50cedfd5a60914b7ec157db4761332e69b57fcc1ee6d02fd03a6cc726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767579, "uuid": "fc5a2c63-d46b-4acf-b242-4faa81fca621", "value": "T128A46D42B5D1C05DE4A263B46BB8C26944367DF0A734A0CBBE842F6A2D766DDC970F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767579, "uuid": "b076042b-7595-4ddf-9c13-318ccf572b3b", "value": "66039fef1e9f08fd78629571b5807c29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767579, "uuid": "36f24ea6-f054-4bcd-b5f9-3330a7f155c6", "value": "6144:1bDg7hWaq+Cmmhx5y10iQK4RMcj47uIXSrYRTHr3i9/QEtEZRIY:pEE5+3mhxsxQK4GuIirATHz0Q7ZRIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767579, "uuid": "0804594e-515c-49f2-9e74-71a922e8c24a", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767579, "uuid": "b4d991c1-3e0b-4d3d-957b-bccc2d61deae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767579, "uuid": "263a19de-fc61-44e0-a310-18cf7815f365", "value": "8630773a0aa1a22cf616bfd71a33e09d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f68daeb-ba91-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649789407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "6acaa382-dff8-425b-be4c-1b38d33d0585", "comment": "Malware payload (Mirai)", "value": "34e97c9166db648d66e650775b66d529", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "89139ae0-ec76-4fea-9f6e-8b7d634a791e", "comment": "Malware payload (Mirai)", "value": "9ee8033481185890e8fbc7f6a18aa99ccf05d362594ad540509125e0b1d4bdcb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "b0bf4f0a-4bb8-4092-baf5-2dd029efbfab", "comment": "Malware payload (Mirai)", "value": "b65a729e06106166e3d1d3cdbd75ace406adb765", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "cd91c0e8-7978-445b-a2b9-813ffbce98ca", "comment": "Malware payload (Mirai)", "value": "73b50950374c558b0ce66e487e8bb034338d7d195aff36dcd3c9f97abf3c499bacc5d06d35a2d35ddad2cd487d15f7ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789407, "uuid": "e5dda5ec-a3da-48ed-b400-53d1db565dee", "value": "T18D33F22CC470AF7461901D39C8BF4E020BCE55BC86B784BF668A79EC9580DB785F6369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789407, "uuid": "5755d102-1e7f-4226-95a4-32ab3d548532", "value": "1536:lr/1ZrCnDfRF9Gy+0xXIe4xLLwdwu5CczGAnZsvKkn:lrtZrYlFgy+0xYe4xLLgwFczGEQKkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649789407, "uuid": "5e939958-b18f-47b6-a2a3-171d705adb6a", "value": 54520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649789407, "uuid": "b11ab467-fdcd-42b4-8dc6-7c5f1f4845ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789407, "uuid": "840aee47-bcf3-42b4-8e1a-75a42ecd4f52", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a4258c-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649765950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765950, "uuid": "362691b3-24d0-4801-b09e-f0d43950214e", "comment": "Malware payload (RemcosRAT)", "value": "2e4af587024f469f74eae0ba8e453d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765950, "uuid": "d0122178-eb05-4c32-b08b-09aadf0eef05", "comment": "Malware payload (RemcosRAT)", "value": "9ef6b1868ca09cf927398496746dc5c1e73980fe7e3c1ffe4f45004a1f11d16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765950, "uuid": "1a52cc54-fafa-4aaf-b3a2-ce48cf508425", "comment": "Malware payload (RemcosRAT)", "value": "9bafd10709e45378ac779cf8d18ce38c3a4f3097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765950, "uuid": "96a4b844-f800-4153-aa8e-b6932a200dfd", "comment": "Malware payload (RemcosRAT)", "value": "e66968e6cc8641bbc19c1ac1aad23cf7771e4454f7e48a99f40afcea4bf2a0d252ac01e313fde17cc082f4d3dcc65ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765950, "uuid": "6335740a-016a-4e7d-87cc-c95011b19fde", "value": "T1BFE49E12B2718F33C97F1A7E4C0BA6A86823BE036E1852D72BD46E5D3F7518174692D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765950, "uuid": "6894c70d-153d-4de9-a272-886f1c182a29", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765950, "uuid": "3b4acbcb-bdc9-4e66-bc95-16e7f5e8f924", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2YZec4qO:wkKHuoE+/vI0icJskYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765950, "uuid": "46c5c8cc-256c-441b-90c3-ea1866745e00", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765950, "uuid": "c8b207a8-42d3-4dc3-b204-6fc398f8bbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765950, "uuid": "c2d0eef9-7b10-4161-9ea2-e7a6b3992570", "value": "UPS-Shipment_Notification#12042022_Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e915b346-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649753560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753560, "uuid": "5bf21b19-762b-40d6-84ae-74058e1c5c2e", "comment": "Malware payload (Quakbot)", "value": "adf6553d0d94ba2e0960040b54ae9a63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753560, "uuid": "f6ed41a5-2473-4ca7-8514-ae0c2493b370", "comment": "Malware payload (Quakbot)", "value": "a082db10b798ae0b7796bec4e7ffe58ba8e24ca010dd84ba5682adb13b5f8b83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753560, "uuid": "77a6947f-85b2-4ebf-9b98-e770afe14223", "comment": "Malware payload (Quakbot)", "value": "c851e132d6353fa81a194d0dd9831da4e07fc4ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753560, "uuid": "1a2af777-d84d-4431-a89d-5d1a04869cbb", "comment": "Malware payload (Quakbot)", "value": "eadf8c5e4a77a0764f7d779314ec35369bdd9e2ca3166074cc2bee05d74a8201da55b07c19c7789de6154e6322c4514c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753560, "uuid": "84b78a47-be46-402c-8242-409db6138278", "value": "T11D15AF3AD29096FFC163BA7A6C36F180AC113DE1D614E50527DFDE4E4A397822724787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753560, "uuid": "a9723447-3186-4a18-852d-8eab0022a954", "value": "f335497b5901bcd9e242e896ee9878b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753560, "uuid": "76c080a9-6423-4031-b18d-3bccf40271a8", "value": "12288:MvdyMlRePlWuktyda+/egKRuCQ1X8eLQRNGoDTStoMsaD2F1PrIGCn:GnlRxuwTI4BqMeGNruaVa6FZCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753560, "uuid": "cabcbd84-e8e5-4d3a-a696-221b90eeae81", "value": 888402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753560, "uuid": "62c79b97-5d8a-40d0-ae59-e8bf3893a4f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753560, "uuid": "ac31f54d-848d-48d6-9964-dfa27f46ee3c", "value": "a082db10b798ae0b7796bec4e7ffe58ba8e24ca010dd84ba5682adb13b5f8b83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bd31c0-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649731679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731679, "uuid": "2521c5dd-4b42-4db3-9052-ae0e45c420e1", "comment": "Malware payload (NanoCore)", "value": "c11a5207e84fe533e025d39a1bdb2dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731679, "uuid": "76453dcc-3dad-422a-81ac-c3d7c81e4251", "comment": "Malware payload (NanoCore)", "value": "a0c4f2836d7b935bd927dc9727a0391762ba85f984656e77df325f9c5e8e6db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731679, "uuid": "e01b346f-b74b-4188-9d1f-0c52e73cf6a8", "comment": "Malware payload (NanoCore)", "value": "514c4cdff88c878e8e545cc0bce2a529c0305445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731679, "uuid": "6322b90f-3a05-48d2-a108-4750b9b21c36", "comment": "Malware payload (NanoCore)", "value": "ef5ba89a1a2c28bd3dd35f88c40d77a866a828ce27f624332ba515cdd569e1b924f271a08d43bf08c8a0cc00820a8716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731679, "uuid": "6e50edfe-0780-401e-9828-adadf653511b", "value": "T1F2E4E1117AF8861AD5FD07FDA03401804BF6732B6826E37D5D45A0EA2E633D0DA47BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731679, "uuid": "25d90f4a-3f7a-40a8-a1e1-901ac251678a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731679, "uuid": "d89e5305-6e98-4b88-951b-6bebba113f4c", "value": "12288:wkKUk6mf4qGEdTJjMSrLNYT6/k6YpdEHmPjpx4qGxgVgz:wkKX6mAqGsjMStYXBmCSCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731679, "uuid": "125440ec-68f1-4cd8-a245-31e99b52acf6", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731679, "uuid": "d0aeccb4-ce03-444f-a56a-d6261af1be24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731679, "uuid": "9746df87-1004-4a99-b950-d966009b9d1c", "value": "PURCHASE INQUIRY_PDF___________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c62f44f-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793294, "uuid": "f874a0c3-ff49-4e10-9ee5-ae51e615fcc4", "comment": "Malware payload", "value": "075c98a726aba230c86f7cdea579a703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793294, "uuid": "02d79387-c643-448d-b38f-199580631d32", "comment": "Malware payload", "value": "a129dee2cc943b4ba9a7e2ce8f24689026a7b954b4ee562b181e56d748b51fc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793294, "uuid": "0615a7ce-798f-4b32-b862-37e5026c4f8e", "comment": "Malware payload", "value": "c7cd28af62b4fb182a412a8407a8cf04ddf14aba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793294, "uuid": "54ea05e8-1d4c-456d-a7b9-dd8f6dd5a7f2", "comment": "Malware payload", "value": "e694dc43f59f3e1f19330b0afc2e726685bb3f81b961f7d21a2c337638e06ebfb5440021c11def1f8252588b15cf7eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793294, "uuid": "f948c185-5249-49ce-a830-99e723bf7075", "value": "T1E44422FCEA46E1B7A93107BE704835E5019CE5DE41BE3625E35EE086D236183EC85E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793294, "uuid": "926e86cd-d05f-4931-9801-5140083fc72a", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCnSgmQ/mqY4:mZRgUY/fsJcO1KOiXe+Qe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793294, "uuid": "a2222f1a-b4a2-426f-a9f3-be9c1d506578", "value": 253397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793294, "uuid": "bf2aead3-c222-4b64-afd4-584e4db5a1bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793294, "uuid": "02ca2d50-a6b2-4f22-b87f-ff7982efcfcf", "value": "intelgeneric5.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fe9b68-ba80-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649782248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782248, "uuid": "66f9b4e9-5541-443d-8ef6-b8a419ad70b0", "comment": "Malware payload (DCRat)", "value": "07eeb783aab93376d05d54c3cd24e408", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782248, "uuid": "609bb2ba-5c40-428c-975c-f71902fb40ce", "comment": "Malware payload (DCRat)", "value": "a25fa75823b12ad0c72c4d4ec76ab7d2764d6b86da330955a155cb3ec47d81a1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782248, "uuid": "0ec1cc5f-7959-4973-9490-7a5ff652b5e6", "comment": "Malware payload (DCRat)", "value": "a89d2cc609667cb54cefd1a7ccd933b2b63145f4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782248, "uuid": "639d690f-651b-48c8-9f73-83db3a00178f", "comment": "Malware payload (DCRat)", "value": "5b17344f9b643a7753c62e9f9cd5f569c86d750320dca2624656bbf3d467f3770cd879f6c3bc884d2642897a79afc313", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782248, "uuid": "7e5868bf-4c0e-4124-aa0e-3a17bef29772", "value": "T16984C07DEBED6A43D69A137988C602B187F19510B093DBF7B0AB1AB52D83350DC1A14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782248, "uuid": "bcfd13e0-7798-4961-82e8-099c27572958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782248, "uuid": "986d04a9-f968-43ee-9c17-83f6a4c86523", "value": "6144:nqvhJhz0IUSR3T08h0ZrMQHyBrACty1gMEN7jy4uKAsrKcqt3:qHhYCQ8h0ZrdyrACtcl2ZzrKcqt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782248, "uuid": "a29768e2-7103-48be-9a33-69c1a6e87f0e", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782248, "uuid": "37279696-965e-46ec-8edb-1cac551ca86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782248, "uuid": "9d528bd8-77d4-4a07-a85e-9301e7fc519e", "value": "07eeb783aab93376d05d54c3cd24e408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baa3095-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749807, "uuid": "9cef4a72-c34b-4f82-9086-d31ef8d08162", "comment": "Malware payload (Mirai)", "value": "15ce6eb6a208bbc966f02d9f67a17dee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749807, "uuid": "34788d59-733b-4c1e-b708-609493847000", "comment": "Malware payload (Mirai)", "value": "a32ef6a3e2442ebbb34119f9ad8c0e4065b1ab02db50f4382f4fc0bc5143ba74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749807, "uuid": "239e9aa8-8494-4508-a93f-6fb0dcb9a413", "comment": "Malware payload (Mirai)", "value": "1c7dc8c409f2d3fbe988451354f65ae632c30055", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749807, "uuid": "b7bdc5cf-da82-4f58-bfc1-88c282287a75", "comment": "Malware payload (Mirai)", "value": "bc8756d1413020f8744acc3ddea19e230b63e68d8724f63e9206f5bf1207e2838a6b6d8e83360b58adcdac94728e74e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749807, "uuid": "3fa7a044-b3a9-49ff-a14e-86cd19b12704", "value": "T193A2D02127C69D10C2A02935DF7C08C372C36BECB5FE32A407B4D268B6D5657D4B99C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749807, "uuid": "84ddcef4-f7e9-4bb8-968f-884bd1904ada", "value": "384:UgWXxFn2W8cuADu97MNAR5reJer5p1IpLRzZs5Pr/IvX7IpPLhymdGUop5hW:3WXxMJ4DuRMNAXecpQRds5Pr/M6s3UoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749807, "uuid": "78c6aad5-ef75-4623-be9f-a9b70f5e5b54", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749807, "uuid": "ee1f39d2-9a4f-463c-8e9b-47ab95b8b36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749807, "uuid": "1aa0440a-fa79-433e-8fa3-0da6cf67473e", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1ab984-baac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649801132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801132, "uuid": "5c6414e9-3705-4819-9595-467a7880855d", "comment": "Malware payload (Mirai)", "value": "6123f11f90e7b20e02c37d3f5cb07896", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801132, "uuid": "5dec8bf6-3d5b-4929-996d-2b88f79b704d", "comment": "Malware payload (Mirai)", "value": "a431588c8faa6c604e79944314df2ddcb7028c8795022192196436d1585ec6d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801132, "uuid": "177dd3e2-e522-4737-b283-4344f0314a31", "comment": "Malware payload (Mirai)", "value": "d65025c821c9d98732b4ff4473ead8eecbbf3673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801132, "uuid": "6b48ae42-83f5-4d3f-be15-efc514127f6f", "comment": "Malware payload (Mirai)", "value": "046511fcbca61f556a999f2204b8a5fe244a2a803e3602b760015f73d6275a1fa8b043bbbb66a8b0c80b5268aa70713d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801132, "uuid": "14a7f725-e0ba-4e4a-a437-6a104cab35f8", "value": "T13A534A52B32809A7D0A30A71253F1FD15BBEFED111E4F6853A5FA74A8076E33154AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801132, "uuid": "1412d050-812d-4408-8e4c-f90128499ae5", "value": "768:GLIS8DXipYDi98YsRn3fxgsWSSemoztjIXf84AtGimv1oUHWlpDosaDbInWS8w6K:G5qDiy9hfKsNqmDDoVbIWSd6sa10+21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649801132, "uuid": "bc2846f6-a4fc-45bd-a3a6-842b8c29c439", "value": 64164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649801132, "uuid": "f49467d1-806c-478b-927f-b1b55f158f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801132, "uuid": "d877f63f-d803-405d-9042-44648870bcd8", "value": "6123f11f90e7b20e02c37d3f5cb07896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d5d113-ba72-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649776261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776261, "uuid": "ac4af4fa-1798-448c-af13-13a23da335dd", "comment": "Malware payload (RedLineStealer)", "value": "2668360cfd3bf4415e40049638365dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776261, "uuid": "4a4828e3-71a6-4fb3-85d7-f1e548824fe6", "comment": "Malware payload (RedLineStealer)", "value": "a4352096cac075b7c5c1f436c0ccc7703552265451e5decac88ac57622b65df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776261, "uuid": "c7c427d4-f74e-43f6-88b8-9622233af105", "comment": "Malware payload (RedLineStealer)", "value": "5e6d7ba187ccf79de580d5b0329b13704776ab03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649776261, "uuid": "cd04ad21-bcb2-4f0c-8b2e-58a0721097c4", "comment": "Malware payload (RedLineStealer)", "value": "fb21f9858d2e14085716f2e8c78f935b29e37cb35e9a026c9779afa98da17e1bb5f9b2a4af6a730be5e10e4ba8d2b488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776261, "uuid": "33370e63-11e3-435b-9228-f3567ebce896", "value": "T1CD84C000B690D035F0B726F849BAD3A8792E7DA1AB3450CF62D527EE5A346E5DC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776261, "uuid": "7c11d964-1fef-4fd5-9411-5460decf3210", "value": "abeb572091795033c85c3efeed8e2553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776261, "uuid": "d8889477-99b2-4aee-b2f3-df9e5bfb2700", "value": "6144:AgAUB6TrVMn9V5gMmxEt/LUQGju78m4OilLAUNe2ouiXQlf4jT6uXLq:LADtMnH5gFk/Lsjo8m4dLA/2ouiXQlfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649776261, "uuid": "1fb871f1-fff6-4254-b28a-e1dc54b4f461", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649776261, "uuid": "3c94ce25-00fe-4afe-8206-b56662921a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649776261, "uuid": "c3122aa3-6691-4a32-93a3-88ad410b960d", "value": "2668360cfd3bf4415e40049638365dcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74fa597-ba55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763865, "uuid": "eaf96bba-d314-4ebe-9368-7463c034fc16", "comment": "Malware payload (Mirai)", "value": "c19dfe03df1c784e4de24c4027d19603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763865, "uuid": "5603a681-9388-4caf-94de-77f73c9ada26", "comment": "Malware payload (Mirai)", "value": "a497b33e0b9d5860886a42154096e9f058e8343d1ee25905de7365ac17ecc760", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763865, "uuid": "eca5d4b6-ada7-464a-b987-ba3e7bb3b52b", "comment": "Malware payload (Mirai)", "value": "02c4a22560f8aa2008f1d9f40c89a3a5a49cea1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763865, "uuid": "29608aeb-9d30-4f06-b62b-9980013a30a2", "comment": "Malware payload (Mirai)", "value": "67a5c7a964ca85350353f7c17583ba2e9520b90ca9358835000c4b99b1fbe08aae42b3df56da45c39d280408eb8b4d2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763865, "uuid": "9bef14f5-420b-48e1-8f44-372d31f0a18f", "value": "T162F2F2A2E05DFA01FBA8A3BBC4DCFB29391095A6DD1DC0A741486572D072F840D2D3D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763865, "uuid": "2590c5e7-f850-429b-abd0-849a3ab7c987", "value": "768:KysvFEeyLxKmQSTK2O6McTvdf/HxDxNystL0mv58nImTxnbcuyD7UHQRjG:KFEeuxKDb4X5xc00A58nntnouy8HyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763865, "uuid": "6616f1f8-6924-4036-9047-fae3feae0b1c", "value": 36104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763865, "uuid": "3641ba3e-76ad-4744-ad9f-03e782bb3bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763865, "uuid": "4599d402-8b87-4832-b1ee-2fda61f4bff0", "value": "c19dfe03df1c784e4de24c4027d19603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfa37b4-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649767230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767230, "uuid": "fbbf7348-f537-4f13-8bf6-23e27a64283d", "comment": "Malware payload (AgentTesla)", "value": "12fdf4d675a8594c75528f64638966f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767230, "uuid": "adb51ba9-f441-4499-be85-deaeb0416130", "comment": "Malware payload (AgentTesla)", "value": "a4cafd75b158468af748409a3cdac4f5245f74cbfea052cc4052f6d6a526cc73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767230, "uuid": "6aef13e0-ded5-4712-8d19-448b2bea74b5", "comment": "Malware payload (AgentTesla)", "value": "596e80ca300186295d507e1f6535f50b0549a65e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767230, "uuid": "a5032e2e-f919-4ad2-8c52-8a1a6190f9ac", "comment": "Malware payload (AgentTesla)", "value": "6cf98a162aef12d9e6cf9adae17f9cee8222685679a38622ab02615e0ee8c35dbb05e66d73697df8cf124f085df4c66a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767230, "uuid": "bd8d666f-ee77-47a5-bc3c-6341e5fad621", "value": "T13DA33002714BD6DDF4AE0CB1C52E85B6935A7C8456A6B91233D6308D2392A7E0EC7FDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767230, "uuid": "aae249da-3c14-48a5-8b6d-0a5d4367b9ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767230, "uuid": "f268fa4d-cb38-4b88-a29c-ebcd9e1f7c12", "value": "768:Xh2mp/Hd5rEbvsYc8U7xieWUjwZru0wOYbSOWoNSf7WDrXDGNshIrxrfy1Je6u8D:XHd5r+v+T7xieWUjwlu0FUwgXDG0e65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767230, "uuid": "8be70ab5-6a7c-4bd3-b1fe-c488752cd6be", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767230, "uuid": "3cfb1b7e-8b14-4974-89e4-7cbd45b52f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767230, "uuid": "807bf358-ef8c-4cb8-a8d6-4c06cc3597be", "value": "12fdf4d675a8594c75528f64638966f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea89144-ba4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649760603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760603, "uuid": "dc2fc375-9a93-4bb8-9013-132d40f49c31", "comment": "Malware payload (Mirai)", "value": "31f85d14fd37d0c7af009b8f6f58e9d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760603, "uuid": "5535ad5e-e343-49b3-a6c9-fe12e65c7386", "comment": "Malware payload (Mirai)", "value": "a4da228bdf52182c5f3eb18c6ce4384ed52e03ef2912923af614f0a35ed81f13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760603, "uuid": "f5da7cb8-7433-4947-a8e6-f18d140312b3", "comment": "Malware payload (Mirai)", "value": "acb0bfecef025c429b57499cb8e3695da09d7499", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760603, "uuid": "36271308-f909-46a5-9248-83f71820106a", "comment": "Malware payload (Mirai)", "value": "7d4155f596c7af2e559714003674a2843b8522e3fc7ac2cc717e716c93a5ec4cad6383849be3035dd4d3a8d3ebd4acd4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760603, "uuid": "9f3afb1f-afbd-4d1e-80ba-1298248ef434", "value": "T1C423F25D9077F9E0F24456BC9ACDBA86223030EDED465EB3BAEC1F6F1401FA81921264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760603, "uuid": "d50cd7ee-73c8-4c54-b7e3-ef915aec327d", "value": "768:C6r6ZGY+rfV4ljsZzEoznQNBcT6cKRzz9aufTjKjQSWw+4YFY4CCo3fj3e6QAyFu:Ca6ZGOyZgicBcT6c6z9afN/vYFB8j3ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760603, "uuid": "f96ddaf2-4ec1-4905-8da9-182a1a3d67f0", "value": 48792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760603, "uuid": "bacf2b0f-3f71-4495-b6c8-7af83c7d59fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760603, "uuid": "9a8042e9-829c-4678-8c16-99e36d9f087e", "value": "notabotnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f84e82-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649753547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753547, "uuid": "2b288bef-e731-48bd-89a3-54704004889c", "comment": "Malware payload (Quakbot)", "value": "35a7ed73981b4608879a56617e05d1e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753547, "uuid": "2cd301de-07c9-4d0a-beed-1aa5e55daabd", "comment": "Malware payload (Quakbot)", "value": "a5bc0cd5d00f106956ae962aaddf631a4fc5fc4da24b36fa2518d1a9700a6f63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753547, "uuid": "6c451fd1-054e-40d2-a709-9daeab6a389d", "comment": "Malware payload (Quakbot)", "value": "aa05bdd339e484d3e701084a069ffebc7a5c534d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753547, "uuid": "e8281acd-9b0a-4aaf-9f83-c6aef8fd4de5", "comment": "Malware payload (Quakbot)", "value": "f07923c6e77a8b2e353d3e609af152986e10e5e223e23376a6fd6ee906272aee966a37f2162f2415ce685055abad5281", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753547, "uuid": "97e1a308-cf26-4181-8ad3-131b5847bc48", "value": "T1B415AF3AD29096FFC163BA7A6C36F180AC113DE1D614E50527DFDE4E4A397822724787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753547, "uuid": "bde53bac-2c72-4b0e-92f0-1143f9340e3a", "value": "f335497b5901bcd9e242e896ee9878b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753547, "uuid": "8570a90b-bbe7-4a70-90e1-a6cd1b92cc4d", "value": "12288:MvdyMlRePlWuktyda+/egKRuCQ1X8eLQRNGoDTStoMsaD2F1PrIGCn:GnlRxuwTI4BqMeGNruaVa6FZCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753547, "uuid": "3c7c07fe-92f9-4a3f-bf45-7c3e5d4f60bb", "value": 896970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753547, "uuid": "052f52dd-a794-4916-af2f-db6ba9639392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753547, "uuid": "7bae9fb9-9cef-4c96-9ba0-4ba07d9e81f2", "value": "a5bc0cd5d00f106956ae962aaddf631a4fc5fc4da24b36fa2518d1a9700a6f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fe7116-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649765953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765953, "uuid": "3a2e5722-f093-4669-aa3a-d5fc6fd2ec32", "comment": "Malware payload", "value": "9346531a21dbef227356447d5672961b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765953, "uuid": "af3dde22-6219-4cfc-97a0-fab6ad5adade", "comment": "Malware payload", "value": "a5f9e8572d48726966ce496fac9bef3dc2c975583e46a0495a3225e14f5896a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765953, "uuid": "e0b99135-2aba-4871-be24-7df834ec2ef0", "comment": "Malware payload", "value": "9989dd37aedcb32cf905fb4d7a095cf9922cbb17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765953, "uuid": "477f1f61-6964-4577-81bf-a2dc48d3ab2f", "comment": "Malware payload", "value": "d1acb8f3fac7a5f204bf01221c15062b2d40eca0940bdd8d7233c8c716428410887feccde17bc033e43fd5b412aa6f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765953, "uuid": "541d8558-9a05-453c-8778-a04c47e7293d", "value": "T193258E5C3691B59FC8678973C8984C18EBA0AD66530BE317B05336AC597F3ABDE011F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765953, "uuid": "16e6e02d-9b29-4240-88cc-e93dff337687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765953, "uuid": "94df7a72-8791-4091-8422-b8b88025fcfe", "value": "24576:UYfJOy7HquKaTMWiOpoMeWaKWc2nDz5a6EQ+p:Uk978q+MeWdJIDz5a6EQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765953, "uuid": "05e53e61-82a9-46e8-a18d-a50ef1f1f1e9", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765953, "uuid": "6a368892-7332-45c7-a1ef-145615eda185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765953, "uuid": "8d43c924-ddbf-4131-a12c-af32d61257d2", "value": "00078322TNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e33265-ba55-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649763828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763828, "uuid": "7668b603-02c8-4c38-b362-480626d18a7e", "comment": "Malware payload (SnakeKeylogger)", "value": "c58b68cdc1dbace7ee78340e9dac2d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763828, "uuid": "9a1052f3-aa69-43ed-a1d1-765891a81539", "comment": "Malware payload (SnakeKeylogger)", "value": "a79dacbc54c46395b33b82373c2e710b97ad68c18ef575077d51ae4e6ffd01fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763828, "uuid": "500790c4-b49b-49d0-a98b-c736c3f239f1", "comment": "Malware payload (SnakeKeylogger)", "value": "1a7f0a15d004c7b538e60df44e39e5725800e17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763828, "uuid": "7faa872a-8232-4f74-94c2-da1f912aef20", "comment": "Malware payload (SnakeKeylogger)", "value": "dce5aa1cdc861d8b6d9bed9cad4c1e07a6bcc7de3435336925185af31ca2b4764ce6cfd7b528df0a73176357de1dae36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763828, "uuid": "d94ffab6-9f2f-45b8-a62c-cb82428e038d", "value": "T10672E912676CC573EB750BB789735680037BFE1A6433FA5E584EB4145EB37820AD2E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763828, "uuid": "67c32b61-a3bf-4b49-bda8-b6307b771ed4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763828, "uuid": "77bcb863-c9e1-416a-8881-981b5ec25cf5", "value": "192:kB72YVm6hfMgGSJufffffw4coY9q3y80uHTAzmyeIeOZLK7XeS/iPp76ch1HBCwv:kBqYVmr+ufffff2FU5HTeHfvL4Vb1wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763828, "uuid": "f0a2c504-83e7-449c-8cb6-c4e6b976ee16", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763828, "uuid": "79a925f5-7cab-459a-bdbc-b66f9c035582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763828, "uuid": "a7320fba-4179-4f61-aa0c-5f2bbcc61384", "value": "Halkbank_Ekstre_20220327_073712_983787.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f312a72-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649767610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767610, "uuid": "cddbc3b4-0151-46d4-aae9-1b3841dcc510", "comment": "Malware payload (RedLineStealer)", "value": "5e19c410c5fbec44d4b1a5a144cd9764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767610, "uuid": "5d21ee1f-db1b-4579-9af7-baf17f67a8b2", "comment": "Malware payload (RedLineStealer)", "value": "a7a353a365fc7119051d23cf8eea04a61b87a46257af7e223b899a41f3a751f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767610, "uuid": "10bf131a-77ce-42d3-bdd9-df9119558600", "comment": "Malware payload (RedLineStealer)", "value": "74d8f28f7c95f6b83744786e6a03ff9b83ea2e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767610, "uuid": "358fcbc4-9736-4b20-bdd7-a80b7388bbd6", "comment": "Malware payload (RedLineStealer)", "value": "b6e94b27576a90e5eb3a3234da40a708cbfdccf15d928d7306fe9cd2887c37bd5deb0444cb0f003ce3e9709af745a330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767610, "uuid": "197bae1a-de1f-4db6-b69a-58c3cbebb274", "value": "T198153347EB14CCE6CA5599374CFAD653A1AEFEA0B019843B6C8DB173773C9C04DA10A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767610, "uuid": "735142d2-b7a3-4d8e-a038-203dc624e310", "value": "1c56583812dde43a22f3de557ded6819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767610, "uuid": "e6eafb08-c451-4095-82e4-f45025b57992", "value": "24576:WvLmyQXEF8sKHhMrbJfHqoRooNlEDwxCO0Z+e8HBm:xyQThMrbxooNlEDwxd0Ohm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767610, "uuid": "0660c25e-07b0-4a12-a4ac-e74b6ff2b3a4", "value": 913648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767610, "uuid": "222271d1-7e65-4e6e-b513-e33668db0f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767610, "uuid": "e3c00c39-70d7-4479-a7e1-8fa1e5712be5", "value": "5e19c410c5fbec44d4b1a5a144cd9764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5386da69-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800554, "uuid": "934474c5-fbef-47c7-97ba-395b594430c2", "comment": "Malware payload (Mirai)", "value": "fca0c99af9f591682cab2f725926c10b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800554, "uuid": "bf5530d3-491a-406d-a2bd-561bef6c2515", "comment": "Malware payload (Mirai)", "value": "a7b84c78daeb58491dfeef74163111ad2ced67fbd327c8ee28dc4c1c2fd02b5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800554, "uuid": "9cfca8d7-ce3e-4d21-99dd-12a003fa4999", "comment": "Malware payload (Mirai)", "value": "34dc71bc13775848f047d487cdb87d755dcdb3c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800554, "uuid": "966c7f27-ef28-4128-9884-3c34489a12e6", "comment": "Malware payload (Mirai)", "value": "fd7d32599da6f10b62b0f30c843232bbe0fd40bbcfb042f38abc7827ae02bd2e04456d4d57c8c095eb5b040e2113d68c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800554, "uuid": "2ceeaa3a-6a5e-436b-a7ca-50a411909366", "value": "T13C83D949BF610FB7D8AFCC3705A91B02288D555B22B93B327D70D918B64B24F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800554, "uuid": "5b5e6f60-27fb-4369-b6f7-a3a812acc38f", "value": "1536:XW+fQT5FTWTG0Las0w5EkMc5QrWGs8tEZqsUUB6la10:XW+fQT5Fa5Sw5RXEE1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800554, "uuid": "8b7af539-b20d-49d4-9007-39c6ab2d6252", "value": 85652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800554, "uuid": "38bbfce7-844e-40a5-8ea2-368e75d3ee03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800554, "uuid": "86c7b357-e278-4bbc-afa3-ad6ba1722b9c", "value": "fca0c99af9f591682cab2f725926c10b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8498d95f-ba13-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649735353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735353, "uuid": "8fd8b35d-ef87-421b-be72-f9bec37994b6", "comment": "Malware payload (Mirai)", "value": "e94593fd723f3873421285ee9003f229", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735353, "uuid": "04ec6784-9826-4f3d-87cd-e5eebcc7406e", "comment": "Malware payload (Mirai)", "value": "a8030cb61f60baff01fec70f30c63749bdcd9ebc616ed59cddfc283d235a176e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735353, "uuid": "538b2bdc-62ed-4f0c-a5d5-b07c1591c3bd", "comment": "Malware payload (Mirai)", "value": "485c061fd84aa961074d2b5efe3fd2ff72afe092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649735353, "uuid": "7fdca518-788f-4957-b2fb-a712bb487a2f", "comment": "Malware payload (Mirai)", "value": "caf95de7039427282d27853e22ca241ef4b1dd57799860a73a577153dad45be0b230c4a93c1e83f978b2ab3d781c0238", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735353, "uuid": "6ddbc3c0-809c-4cd9-863c-045c17c106bf", "value": "T12A634BD5F801AD3DF84EE176852A0D09BD3163C04A931F27A7B7FDA76CB20987906D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735353, "uuid": "c9060b00-efe6-417d-8265-a11a2ff98958", "value": "768:oe6n68/zYX0SzecI/mKuc+4vtILucv5O5S1xg9HHbKYT8NmGK3oQLDgT:oRkzI/KdCtIScv5Bxg9nbKe8ZK5LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649735353, "uuid": "88ee2331-c8f3-4da9-a8f2-337e74eaef2f", "value": 68980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649735353, "uuid": "60f7c0c4-0cf1-45ab-a660-57ecc7e01047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649735353, "uuid": "dbb91168-f159-447a-b728-50006f88d075", "value": "e94593fd723f3873421285ee9003f229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964fa15f-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649766736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766736, "uuid": "2986c578-5cd9-4766-9ff5-74cede01a375", "comment": "Malware payload", "value": "aac1337cb3c5ade70b68e4c06dc66d3d", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766736, "uuid": "b27607b2-e76a-4ccb-9969-f5fe2b4118e1", "comment": "Malware payload", "value": "a85cd14fbd869e0531fccf34750d9e98d6148d44882d4c957223b374301d75db", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766736, "uuid": "bf2cd78c-5a95-4f2b-951d-089d354cf6bb", "comment": "Malware payload", "value": "0c79389de81b54d0e7b5a45f23ef822d57bda030", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766736, "uuid": "132700e8-8dcd-4a73-b444-c237818b3d8a", "comment": "Malware payload", "value": "369eb3007fd7d6c4a90a160ec2f45169eb09df8599ed9efb6b82a0b7d15300f99842e3731875f76b1a667823d99727e8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766736, "uuid": "f339a5c2-b34f-4e90-9da4-3742e5fd65f5", "value": "T176942300C7D19E2EAD8450B7EF24C7C440A270D3A18F2D592B6CB97D60DBCAE516E9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766736, "uuid": "02be93f6-9d3f-441e-9bdf-346e7ce7d024", "value": "12288:YEXQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8UQ:+warmMSAGMID1R5OtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766736, "uuid": "fd33e8b3-5a97-4d00-bbc0-5fae453e5975", "value": 441473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766736, "uuid": "08581a96-cdf9-4b26-b192-a8bfca7192fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766736, "uuid": "327f6150-0334-4537-ba6b-c0d1c3348f2c", "value": "0367451020030851.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a4b1fa-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649747082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747082, "uuid": "db7e2feb-33b5-43d4-beb4-853bfba4b347", "comment": "Malware payload", "value": "7e93abc303736f6363f6913c5d591fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747082, "uuid": "31305aef-b218-459e-8a28-aeb7fd2a4e91", "comment": "Malware payload", "value": "a8f2b8dd86f269f7ba8bb8cf0346cfb2af84867d5fdf7255e3adbe4afde51a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747082, "uuid": "c5f3353e-826a-4204-a1e2-914cdbf33a04", "comment": "Malware payload", "value": "55386e6f9aea93905706e76981c95b80264f6b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747082, "uuid": "315a0046-57ef-47ea-960a-068ac8a3b51a", "comment": "Malware payload", "value": "9147125a875a5abdb92812efe04d47b9b7520da54c9ed0b444449aa7c47089733cc85675e19af96fbf4708614f44fe14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747082, "uuid": "4c38c6c4-dc41-42d3-b8ec-e0f2d3c2b6b9", "value": "T1B5877C50E99B11F1EE03143186EB626F67346109C328DED7FA084E67EF579E20E77229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747082, "uuid": "2b3c0488-2b25-4fbf-bb01-50532f271f2b", "value": "73ea3051be79f858624ff9ed17c3e3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747082, "uuid": "919d6279-8950-481f-9362-3b4e75f797a5", "value": "393216:RgYkj3KgfjcOQZ6vvggBmEsTBo9MRN0XkHpIiqLa:+YkjffjcPDymEVk5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747082, "uuid": "d39a8252-2c9b-46f9-a6b7-3b163281afb2", "value": 38524192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747082, "uuid": "63cf2a7f-fcb1-4b02-9a49-29462ab39320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747082, "uuid": "2e39d672-925a-4c16-a67e-b2b4cb2eb321", "value": "a8f2b8dd86f269f7ba8bb8cf0346cfb2af84867d5fdf7255e3adbe4afde51a2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1e30c3-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649765937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765937, "uuid": "53314ffd-c8f7-49c4-a921-6a8583cd76a7", "comment": "Malware payload (Formbook)", "value": "96c7548edaca74d10a922337089b6df4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765937, "uuid": "809d5d18-09cb-4334-b200-8956a675616b", "comment": "Malware payload (Formbook)", "value": "a9bccf59405a97828f15a1b773f48e9e96c80e5b41cd74d567c39a116e2d80d3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765937, "uuid": "9712cc3a-4adb-4ef2-8947-372243c0d8fc", "comment": "Malware payload (Formbook)", "value": "40edb06f287ed4cfddc4ea0152105c2cf2361a7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765937, "uuid": "e59fc1ce-f4dd-42d6-9a8c-6aa16343d057", "comment": "Malware payload (Formbook)", "value": "fabc64cbf379aef5d54b3b37b9af1894e4390c89737f4f93198b4e4cd8db48dc45c6388ec1f5bacd7e7f9ad26cdbe8e1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765937, "uuid": "d11a1935-7fe0-4e2d-a098-947e1037abbd", "value": "T1E77422CA7512A3E5D4AF1271643723430D76ED419BAE25222E06BAAD25F0716B7ECF03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765937, "uuid": "ee901f53-7262-43f5-a7c6-01b0faed8374", "value": "6144:z5YX2VjUZBhsbyjj5wzSJZBsqeLAo1iBsGrYANuAnl7qpvEDvPqJ:z5YX2VoZ4bi7QhIsGkhAn6ED3qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765937, "uuid": "812036a0-2018-4a1f-b964-f2c3e29da36a", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765937, "uuid": "7fabde64-650c-40a4-abc3-76e3fdc98a46", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765937, "uuid": "f7b1c5a6-4c7f-493b-9435-e23ec21ba538", "value": "Complete Docs-65.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314767f0-ba00-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649727053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727053, "uuid": "55393a52-0dd5-4f94-b3ae-51ca071b6f93", "comment": "Malware payload (AgentTesla)", "value": "faa08b6e60ac730ddfc6e4814300d36e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727053, "uuid": "99771662-1c11-4f43-8ecd-eea93853bd29", "comment": "Malware payload (AgentTesla)", "value": "aaefeb4e179daa06504580ee2a3c50545ced720e723942feb61999e26679540a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727053, "uuid": "be27c9f1-ad8a-45f0-89a3-9391bddb7db1", "comment": "Malware payload (AgentTesla)", "value": "1da15eb127f6616e512c594839823374d23992df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649727053, "uuid": "cbacccc8-e78e-4528-bf85-ce3a20678841", "comment": "Malware payload (AgentTesla)", "value": "d5493b63444671839ca7b24d535921e2b930b9aea55831abc7dfb44b080e84749b9d45722ba3b5e57123ffdb3a794743", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727053, "uuid": "5855850d-9fa7-4e96-838e-f0c4e5519884", "value": "T13F44126B16FC5972CD6729714AFB297AE73B938127742587A7680F3F2C04283D409AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727053, "uuid": "917ce646-f323-4dc9-ac5a-5737e4ce41b8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727053, "uuid": "0b9ceace-040c-4e93-b826-fc9c79e11fff", "value": "6144:8Qq+035mDexQHBfX3+zZa4N6jwwzBFhVFCLG8l:TkhxQtX3u6jtPALR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649727053, "uuid": "ae6bc825-0521-4e3f-8218-34987e2f4c17", "value": 269866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649727053, "uuid": "12264c9d-b7be-486b-88d2-89ec86c1284a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649727053, "uuid": "b052a998-c847-4141-9ecf-41f58de65224", "value": "SecuriteInfo.com.Dropped.Generic.NSIS.Injector.A.045E046C.23216.30154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec2c79e-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1649765945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765945, "uuid": "89df5b10-0af9-4987-83d1-0422c37c5ede", "comment": "Malware payload (GuLoader)", "value": "d5579501ac3dfb5eeea613d8aaa42ca1", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765945, "uuid": "1bb40177-4a11-4273-bd9a-2d2d2e5123d8", "comment": "Malware payload (GuLoader)", "value": "ab3f8143524785cbddba6390ed6d4658de66b99ff325171ac01caffcac460cf1", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765945, "uuid": "a4dddc85-625f-4cf9-a2a8-7d3ee43a4ee5", "comment": "Malware payload (GuLoader)", "value": "1f7ec1e6a582f9e1025c8eb4e32a186a1a4f425d", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765945, "uuid": "ad9c047b-73db-4a7d-8e50-0fea1bd6a458", "comment": "Malware payload (GuLoader)", "value": "ad085a2d8e966908914c842adaa8e54ab77779b951e5aebf08f3987dd6ea67f45616d2fe44166be56d015b8c4786ee73", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765945, "uuid": "ed3b6dc2-782f-4bd3-a2cd-d4bd6b210e0c", "value": "T10725236303E0C90BDD461632E12502F56A98AE41D86ACF2B33D57E24FE759D08B5F39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765945, "uuid": "0b6fe805-dbb6-42ff-9ab7-b3db00b9a526", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765945, "uuid": "fb22e842-6267-434b-bbfa-6029ac9b6693", "value": "24576:lYvobEMgDVJTEcPEAePhd6ijeGHSvLD7fFwzR36GSAIs6T1R:Kwb0t8AeJdbjHSv37fFsR36GSA96/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765945, "uuid": "2694eb23-3960-41eb-9179-fb47dd482a2b", "value": 998168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765945, "uuid": "b654ddae-7db5-4a54-ab8b-736ec1a9c5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765945, "uuid": "24db6316-0d73-4613-b4a9-4b3a29c1937f", "value": "BBVA-Confirming Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd67368e-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764251, "uuid": "ceacc02a-a1e6-4c99-94e8-c1f6576cb25f", "comment": "Malware payload (Formbook)", "value": "468d952e8a4ca69f21ef70660ca48a83", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764251, "uuid": "3bae1f89-c815-4f80-a437-ad5dda6c2559", "comment": "Malware payload (Formbook)", "value": "ad47ec4507aca98278f81aad10542a81f56555dc6fc326e98dc82ccd29167fbd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764251, "uuid": "ebcddbd6-e92d-4834-b469-bcb157faed39", "comment": "Malware payload (Formbook)", "value": "105ce45608020ea0080e30fcbec7c48ff861b565", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764251, "uuid": "59754e32-0411-4f99-8764-0145d3d4b2f1", "comment": "Malware payload (Formbook)", "value": "67a57ee9249704498eaf10acc6dbcb1cf07badfe96ff1fad074cc0d764cad229b4f335a7d61711aff0b1331b5c8cbdfc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764251, "uuid": "b240b4a3-c97c-49c8-9408-6cce3d962a31", "value": "T185742214F6AC1F97CEEB13720FA5967E81F5FC7A274820102E1EB65589747B076CC22A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764251, "uuid": "82690100-d13b-4594-b4b4-3ed49b830b46", "value": "6144:MJSFyQ3fE/+L4YigEkKgHcgUsLSmmeJ/lrJlpZ9siaO+IUpQYlu:+SFyVYiznlybJ/ZvmK+5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764251, "uuid": "2b83cf83-d09d-43a2-be86-87529fc06dcf", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764251, "uuid": "bbeb5320-32cc-4ba9-8ed5-ecff672a9a68", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764251, "uuid": "df5153b6-9b90-49a3-bf81-3c9a156d3120", "value": "Offerta nr.24121.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05aaa772-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764346, "uuid": "8a5656ab-517e-421b-a584-d7b3a40cab9d", "comment": "Malware payload (Loki)", "value": "a0b837aee5e17e0e043222423ebc6562", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764346, "uuid": "bb5f6bd1-dc19-45a9-acae-a3617a32d79e", "comment": "Malware payload (Loki)", "value": "ad77e6f6b2642a00b64094ba360f73e6b63b300fa395b3f3230fef4a661dff67", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764346, "uuid": "d11de8a8-8e7a-438d-92ce-53cb7af2c7de", "comment": "Malware payload (Loki)", "value": "994e3adf0a32ccfbceb6c16073a95cb94499541d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764346, "uuid": "4cb6f931-d052-4ec4-af71-31810158f944", "comment": "Malware payload (Loki)", "value": "63a372214926a5f022a848b1e3d35517ef94935beddf9140447b5ce05c4a52739f78f3380ef6c12aaf3a329f72265e27", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764346, "uuid": "9525a993-1ab1-4fa8-bf6d-29cbd297dc69", "value": "T1DF7422217077734BC9979F3AD4B24AEABED8FED29C0454789663790304F2B9BAC15C21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764346, "uuid": "55dd262e-907d-405b-afbd-09a3df2153b0", "value": "6144:qki3IOkeKvpATBCEdKpczQ8gxza81Pdh2SS81nFvhVASwLNcE+zroPh66SJHTKUk:qk6Qp6CEwpc08gMIrFS8XvhuvNVT566l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764346, "uuid": "f05c53f6-651e-4faf-bf3f-0b45b0cc4a1e", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764346, "uuid": "d995be21-4435-4ce4-bff1-cf4e45be2079", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764346, "uuid": "b8894662-3d2c-416b-8427-e375f86d1d68", "value": "PO44798.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af980838-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649765919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765919, "uuid": "bcbbfd7a-1131-44ed-b843-827b8d4df817", "comment": "Malware payload (Formbook)", "value": "612d14e34322f0f2b37cca3fb804ff6a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765919, "uuid": "d985e88f-e490-42bf-a2a2-c8d5e5a14df5", "comment": "Malware payload (Formbook)", "value": "af4be7cad8bf116b1b1825c36cbe92fb6694ab34d437b4f8d67aac2baf6e9d22", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765919, "uuid": "8d393492-d98d-4b8b-b921-7c9a25de807a", "comment": "Malware payload (Formbook)", "value": "00a5a76bc1f49f07ccf5b0825b8e5c94143c59d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765919, "uuid": "911c1592-1759-47da-84a4-c3b5f364e549", "comment": "Malware payload (Formbook)", "value": "1fc544f865f8bbd33175b44caeb2e4dcaaaf1ea0d9b52a457f7c169c151e7d4e3169eace57b79eb79a7ce72a0382c20c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765919, "uuid": "9351a740-4eed-4dfb-87ca-6593d27d0432", "value": "T14F74122C75B87B23C3F77A3BAA0BB581ED02EC751A544215A1B9B71E0CF21D76853C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765919, "uuid": "a63deb7b-6535-44d3-b569-c4e049232fd8", "value": "6144:cqJ488TG43wwWqzE2fLxsV+WeGQ+s3swb7w+wq23LN5zaXx:htOG4gQJLx8hQ+N6yq65za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765919, "uuid": "9e567cfd-9930-466b-bb56-9fa0a695874d", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765919, "uuid": "0a8bb757-6ab2-4533-bd7c-191b324ad19a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765919, "uuid": "75b285a3-de4e-4576-a745-e0e784826b28", "value": "Approved_Bonus_Plans_2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a702dfab-baac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649801124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801124, "uuid": "28b7dbfc-af2b-41e3-bfc2-5c222dd4c708", "comment": "Malware payload (Mirai)", "value": "63c4f6173be30948d13d9a3d9b1f9d39", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801124, "uuid": "f43a1f30-9ec6-441f-b0e6-624ee998ab2b", "comment": "Malware payload (Mirai)", "value": "af5da7d5a808b816a70cb8a947609575e68ddfd12b368e98bfd52ece3d3ce16e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801124, "uuid": "72dfcced-67f4-482d-8fc7-97224d04aabf", "comment": "Malware payload (Mirai)", "value": "8358b613f2c65c3d2498f4c95827c49a70a516cf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801124, "uuid": "39467eb2-a319-431a-9266-f24accb1a8d5", "comment": "Malware payload (Mirai)", "value": "9ad6665cf82820e4efb19bc2aa82f309fd82119e96b438d307d682ac91800591f3b8d51d78ba395497c55c9974cf70b2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801124, "uuid": "47158eea-46fc-4212-a3eb-b3caef22de8b", "value": "T1D6533A03B58181FEC099C17466AEBE36D82374FE1379B19A37E4FE257D4AD211E1EA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801124, "uuid": "c88534be-e342-41de-9978-ff5ccfe99fb0", "value": "1536:BrNX6ADsOYXwSOQRzNDVD8C50IGwFyj63L:JNX6ADXkweRZeCmwFyjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649801124, "uuid": "d00a29d0-db38-4598-80b7-df44dc0faab4", "value": 65488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649801124, "uuid": "9b0959db-656a-4fb0-88d7-6d98a4a62c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801124, "uuid": "c1ed11aa-a5fb-4d61-bb89-9e95c13f031d", "value": "63c4f6173be30948d13d9a3d9b1f9d39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa584025-ba55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763897, "uuid": "09229943-3db1-4eae-aed7-5e6cccb9a014", "comment": "Malware payload (Mirai)", "value": "39358310892baaed00536ae0f06465df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763897, "uuid": "10416efe-6545-402b-86e1-b1d419b053d1", "comment": "Malware payload (Mirai)", "value": "afbcd7e34c3cb570c3fc4239e31685402dbc0a173a7718ba5a4e25bd05718348", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763897, "uuid": "cd57fe94-6670-4c7f-9788-6ba68871c3cc", "comment": "Malware payload (Mirai)", "value": "50f267d7f569afcb4c863d3a568128624137d47c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763897, "uuid": "00f25538-407b-468b-be7f-e8403cb9af2b", "comment": "Malware payload (Mirai)", "value": "5ba98b25ec5788ef8d2309238da24b4f4506a3dd727624cb78f32f6b60ee772bfee4aaf7be971fdae3bf0f19ea8d7f4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763897, "uuid": "26e53d38-ce3b-4ce6-b61c-8837f3aacc72", "value": "T1606302E6EEBAA6FBEFB14970DD184E401CF51F5033ACB41AE8A097310150584FB58EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763897, "uuid": "0b837e81-bdc0-47ea-9d46-5d3804a0da3f", "value": "1536:ryCRramkgerF02LdkkiE+F10L2FJMJmLGLyGDZNOlVf462IJqneOTX5:rFwf62LdW10L2FJufLZDZNOv46dqeYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763897, "uuid": "66c7e991-29ca-40b7-aa0d-daa42322879e", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763897, "uuid": "19fd6361-5c2a-445a-85c0-be28ec4f5462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763897, "uuid": "375f012f-8f7c-4586-ab48-12b6c41c4385", "value": "39358310892baaed00536ae0f06465df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd84168c-ba27-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1649744146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744146, "uuid": "753e74a1-2eb2-4d41-be12-5160354d952e", "comment": "Malware payload (NetWire)", "value": "c92a10cfad38d326a1d7aca026c82084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744146, "uuid": "1b8b80be-fd3a-45c7-803b-8ef46c98afef", "comment": "Malware payload (NetWire)", "value": "afd47bb332ef06bf7c4f7c4a4470cf5b6e2acb6c4db3b3e6f453ff0dfc4a63f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744146, "uuid": "29b2f88e-f50d-4a05-a5cc-d4856cfe7c40", "comment": "Malware payload (NetWire)", "value": "025cfd50d35b7b54c36133026ce0d7eef761ae4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744146, "uuid": "68f6cb1c-4c38-4bd8-9d77-6d4d846caf2f", "comment": "Malware payload (NetWire)", "value": "b0703eda63b4451c22ff4bc9fe360436005050499b6551cd2c40487a97d73e25d8de81a7d9a7166b2f86881477ecec2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744146, "uuid": "e1e42ff0-19ab-4767-993c-bca1ae9656db", "value": "T1E1F4E12D825C4D27FFF95ABDC0E142C827F1911F154FEB79A88460E4AB833B16913A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744146, "uuid": "a7b40bed-ee97-40e9-9df0-84437a082237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744146, "uuid": "9a53c639-412e-43e3-bd98-17c076cce72b", "value": "12288:oRWPT4qRLUsfQInB4vbEdrUb2TA/O2fX3skHajKQogVgzil4o:OqV5QsQEBqXXcyaeQzme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744146, "uuid": "91407a18-6bff-4c15-b2d2-4bc336917d04", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744146, "uuid": "40dbfcfd-0904-4cc4-8820-de7c5313ed0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744146, "uuid": "0640b923-ac02-41f1-83a9-63609ad67942", "value": "PO#XC7K325T-2FBG90-22-Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d5e1f3-ba0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649732399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732399, "uuid": "d1cdd98d-7df2-4d3b-91cf-6694b3f2755d", "comment": "Malware payload (RedLineStealer)", "value": "978e409358edb32206596af81644d571", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732399, "uuid": "ed882b6e-5f9e-4f32-8bb7-02e8f00b8111", "comment": "Malware payload (RedLineStealer)", "value": "b0107e7b76a8f7b5c0cd47b855851ac22afa492a8b2adb3b32fc198eccfc37ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732399, "uuid": "6504e0fe-b466-4f2c-a1d3-8e10c04b2db6", "comment": "Malware payload (RedLineStealer)", "value": "2b856b780776f9550a302cd92b344c705ca97503", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732399, "uuid": "d2b591fd-5ca7-4498-827d-3f3e6a87e804", "comment": "Malware payload (RedLineStealer)", "value": "50849694bad0960c1d95ce6fd00d23ed85a93a164411deef4a9657e050aaa28db0dc3a968a4e45d5b2f155b20e0045e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732399, "uuid": "9cfacbc5-ab51-40ba-ba8d-156bcdb609cf", "value": "T14EA47C2133951D1BE2BEB37AA475080086F2E7522633EBAE7D9801ED55F3F45C721B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732399, "uuid": "7f6e7fa1-145e-484a-91e7-61c6a727453b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732399, "uuid": "414cc937-c949-4507-a3f7-85930707abf6", "value": "6144:AA5bHRIheUlBAzRRuskS7G9qJncstX2lE4L9Ti7nMCOglGIEwWDoib1lxR3bAQwr:AAZHRIdlBAzRRuskS7GonAlEQximg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732399, "uuid": "83aa69ff-fb9e-4a95-bba0-9bef31b2781f", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732399, "uuid": "4cc9f2b3-e788-49ab-a35c-b189fd34ff20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732399, "uuid": "f4ae3a1e-0927-4035-9d8e-df5b59eb09df", "value": "978e409358edb32206596af81644d571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951cc49d-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749983, "uuid": "998c043a-c419-4958-ac70-713d7f9686d2", "comment": "Malware payload (Mirai)", "value": "11a44fbf3922bfebd59ab01e1891abcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749983, "uuid": "80d15059-4e16-4c0e-a23b-0667c66d8357", "comment": "Malware payload (Mirai)", "value": "b0313e42bd4edbc6380cffc2190953fca8877af746473e05662aabc74a2d1f2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749983, "uuid": "a79ae23e-9a4e-4176-967f-a6be432f30ea", "comment": "Malware payload (Mirai)", "value": "ea164057fdc991d8e972b5f95dd889824263ec76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749983, "uuid": "062fd35e-cea3-4c8d-a018-a56cc5c6da6f", "comment": "Malware payload (Mirai)", "value": "aa90a05aaffff4de5016c94fcb9952665090a01fc148ffa8ab6eb91262f91f7885ad30059fdaf80b553011e412eddf41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749983, "uuid": "611c6bc5-09ae-4f43-8a10-e6d501398fec", "value": "T1A4C2D16A4651D9E0C5F4657798B34EC3AF9736F8E08B78D23A3819D868525829CEA0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749983, "uuid": "0f1fe83e-b40a-47fd-89c4-ff388f33ff06", "value": "768:MscWiglXVwfV1iTQSuByb3AJCycwOgLrHFML/9q3UELjsx:U0ITiTQSu40JbGgfLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749983, "uuid": "54a92038-8f5d-4c89-baa9-7e027dcfa051", "value": 27480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749983, "uuid": "8cd0acc5-8d5f-42c5-a29a-f0680076739b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749983, "uuid": "8eead72d-0ce0-46fc-a370-0e9794d13bff", "value": "11a44fbf3922bfebd59ab01e1891abcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e423bd-ba2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649745467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745467, "uuid": "780a0032-e91d-4178-b4c0-666ffc654361", "comment": "Malware payload (AsyncRAT)", "value": "8e8fe0ec459352fcea811a941ff14888", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745467, "uuid": "9e1808ac-a8a5-4b3c-8a2c-c3afefe46144", "comment": "Malware payload (AsyncRAT)", "value": "b12ed3f10bbc4e4ade3f53856b19c7ab878eb023389a8b6c4c3c495a0ea97f86", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745467, "uuid": "e55468e2-082c-4dc8-82ed-2b435ad6d640", "comment": "Malware payload (AsyncRAT)", "value": "8133ec36f8bbc7a0d4290aef2b3134db6bd2a069", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745467, "uuid": "3e80eb41-266c-4757-a0da-18bc5f555592", "comment": "Malware payload (AsyncRAT)", "value": "9e6b16e61dce928a68abc58f5be36a88de9a0dfa5a38cdaa6215861473d2138364123dc92fc1895321426d520bdd61cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745467, "uuid": "5f102928-d5ef-4545-986a-180da4c7ee54", "value": "T153134AD6B7540B32CDE907364CF253302B77ED55AAF3EB0B588871551E73F804682AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745467, "uuid": "fad73fed-14e6-4aa4-a09d-e53f1b2aceb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745467, "uuid": "f5994f22-0ee9-42d5-8544-2d67788e9532", "value": "384:Nni/7h7+loct/n7kXHwVJffffft+SnJyXnLHHJCU8rUUvYxqS/T+zRmhmq3jb34X:N4UewcW0LHB8rUUGruTgDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745467, "uuid": "29192f51-26f3-4a3f-bfc6-99cfe4772e08", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745467, "uuid": "1af4fd32-d9d4-4fec-83bb-dd43af75f75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745467, "uuid": "504ff96d-5df7-4c7c-b23f-6f1235887f65", "value": "SCAN_00210.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6de790-ba75-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649777462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777462, "uuid": "3c8c3ce2-8630-4890-a917-f376779e637e", "comment": "Malware payload (AgentTesla)", "value": "ae7bcfcb1988e2f5d6049a69fa62660f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777462, "uuid": "39efe942-93cc-4a70-9005-a7d4e8045b9c", "comment": "Malware payload (AgentTesla)", "value": "b25050da3db1fef64eb447fdbcd2a4c2248fc32a7be362cea35094449250381f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777462, "uuid": "bbd2b3e0-6332-4ce0-8525-5751c7f823ca", "comment": "Malware payload (AgentTesla)", "value": "973086c5da21d7a88b8540e8c6c5f846c85fb754", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777462, "uuid": "f4bd6127-faca-4014-bb3e-211bd7a5f3d2", "comment": "Malware payload (AgentTesla)", "value": "a2e72761a287c5181203517dc5b9485d70120fcd574ac72ca7c94fd8cad7d0596f0f97ab90b4c6edc771516200a66512", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777462, "uuid": "cd55dfc4-c2e3-458d-b9cd-ef803d75b102", "value": "T16F15E009B6A48675D87D0BB8B438449007B67E3A5851D7BE7909B1FA2FB33D08503F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777462, "uuid": "0f382b08-6b43-478c-9514-4f47977e2a85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777462, "uuid": "06deffdb-70e2-4965-b736-6564fb65f3b6", "value": "24576:nkKX6doigqrcjPGmZmMURKu1OugVlNDoalJDRyNmvu3:nkKXkoR6oemAMUR4lBDJDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777462, "uuid": "e7e0d8a8-66ab-4a91-9231-b2939ae26519", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777462, "uuid": "cb35fbf6-7631-4c9e-adc3-e049ccd028c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777462, "uuid": "66d0f5c5-253c-4219-b1af-49cb7bbddd4b", "value": "CCF_008089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825b1d76-ba2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649745657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745657, "uuid": "a992c0f5-9e02-4705-8b6f-8cd9bc1f07bb", "comment": "Malware payload (RedLineStealer)", "value": "a5056eb48347d258dc5b2d9f8fbe18d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745657, "uuid": "261f0198-4bb6-4002-abea-3c73613a04d5", "comment": "Malware payload (RedLineStealer)", "value": "b30f1d14f3e24fbf48dc494613711e1b9f12a41c6e2c723947c3e3854d39a1c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745657, "uuid": "ce34b436-78ca-45d4-9556-b5b611e3e3d1", "comment": "Malware payload (RedLineStealer)", "value": "220212b07d6103eece77b3a0be79d053b04030b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745657, "uuid": "75c1d339-5de8-4466-94db-7d72ecbc93d0", "comment": "Malware payload (RedLineStealer)", "value": "ae31339186ff16a3c4b3682a69f0300384d4675f352527c62d9775413ad8b1a965d63a11ebaff4fe8c63a07de92f9474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745657, "uuid": "8af6a224-e466-48f4-bd34-bac32d76dfac", "value": "T10D84C010B690D035F1F726F45ABAD3A8B93E7EE16B2491CB12D566EE46346E1EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745657, "uuid": "20f0aeb6-a8a9-493c-85a2-4c09ddb7ee7d", "value": "c05c69e25e4cfe454ad2fbd0d1a9d1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745657, "uuid": "b4213b22-f370-4f5e-8ddd-7e4ba151859b", "value": "6144:dQQBcf7uIc/87li4njYjEM2C72e2SnV8jqzAeTCrWvoKRYl3Q6nt3mh/juABbzAt:2QBcC1k7U4n8t2CaeJV8qf2rWQyYNQ6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745657, "uuid": "5783e973-fc10-43c1-995c-50ea41507d00", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745657, "uuid": "937d1f1f-0a60-4b1e-8146-e0680907e78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745657, "uuid": "474f9d33-556a-4742-8228-2a31e0a0bada", "value": "a5056eb48347d258dc5b2d9f8fbe18d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5eaa668-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649753555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753555, "uuid": "6f0158cd-0d2d-4150-ad6b-f6c899325521", "comment": "Malware payload (Quakbot)", "value": "9d55bb40a88226eadad4f9feac4aada7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753555, "uuid": "15592fd1-fd23-4420-9cad-124ca3db1c54", "comment": "Malware payload (Quakbot)", "value": "b70a6731d8f54ae33443f843129bb21717c9355fea0c7fa059f85ad92cf8b8f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753555, "uuid": "b374a68b-3685-4995-803f-0b694abf6348", "comment": "Malware payload (Quakbot)", "value": "b571c49974ebe70cc09742b6cd495700adf9255b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753555, "uuid": "405b8e44-7de1-48e2-b9e5-1a3fe9451614", "comment": "Malware payload (Quakbot)", "value": "feb8228b09f84ca58f078eb5c4e7b7d0d9c905cfd586e70e59718c846cd3525aad985831fe68e1bd074dbc1d52c4e5da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753555, "uuid": "678e875b-67e9-45eb-bbf6-5cbf68eac1cf", "value": "T17715AF3AD29096FFC163BA7A6C36F180AC113DE1D614E50527DFDE4E4A397822724787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753555, "uuid": "ada199ae-da0d-44f0-a9eb-719f0b05e6d2", "value": "f335497b5901bcd9e242e896ee9878b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753555, "uuid": "c6eef50e-623a-4d05-b009-4fbddac76d67", "value": "12288:MvdyMlRePlWuktyda+/egKRuCQ1X8eLQRNGoDTStoMsaD2F1PrIGCn:GnlRxuwTI4BqMeGNruaVa6FZCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753555, "uuid": "1c460701-ac77-44ed-98bd-21e146553bc8", "value": 885504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753555, "uuid": "4cf519a9-6e31-4cc1-83fb-c287c28beaaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753555, "uuid": "df9246b3-d00c-416d-b645-2a03e0cee9f6", "value": "b70a6731d8f54ae33443f843129bb21717c9355fea0c7fa059f85ad92cf8b8f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b5b079-baa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649797209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797209, "uuid": "4733512c-02ed-4401-be9e-df0a946de904", "comment": "Malware payload (Mirai)", "value": "af450da9639e06f505d0c48f1d2a8ac1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797209, "uuid": "a0d24d9c-8cfb-4eae-b9a9-1ebb01cc1666", "comment": "Malware payload (Mirai)", "value": "b76a37d64b4cfb9a8d72fc22a366edc2d250a8bee67007d0b4e979906b77be7b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797209, "uuid": "85175f9d-b17b-4c6b-9266-ab3c1067ff4f", "comment": "Malware payload (Mirai)", "value": "279653bf12240f35103bd87994bc0b5ed6df3048", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797209, "uuid": "54fbfa64-7288-4f19-bd90-c2c633ee6e36", "comment": "Malware payload (Mirai)", "value": "ec0d1d0e1452dd4e21d0c10a42ab17d9a650be6492d20a442f8a34bfc6177f63700ddf67fca883e5a23c4105ff9450d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797209, "uuid": "5f7cba96-a5cf-43f1-a566-2e7eeeb05979", "value": "T1F6635B56FC819A12C5D012BBBB6E168C3B2553E4D2DF3203AE356F612BCA81F1D2BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797209, "uuid": "3391b902-8976-49b1-9d86-d48b52df16e3", "value": "1536:vVrmJZEPSsnP2SyQ+MNIUUmb5T2fHm+6na10:vVCJGRdR+MNFzb5v+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649797209, "uuid": "f478e703-ee09-4302-bb22-ec3940e15e6a", "value": 67980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649797209, "uuid": "63aeee63-9a11-44e1-b6d7-4f9a45292865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797209, "uuid": "75497db3-b75a-4647-8ef2-ef3c8d93c1ab", "value": "a1mb0t.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d943f280-baa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649797342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797342, "uuid": "67f705d7-8bcc-4df8-989d-25589df5457a", "comment": "Malware payload (RedLineStealer)", "value": "79b607483771af6aac0ffb113b2a95c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797342, "uuid": "4929f461-555f-4820-960a-d8512ab2109a", "comment": "Malware payload (RedLineStealer)", "value": "b8077e0188612ac0f1e80dfe7fb572fb177c9555aab732c59dd825c5166fa349", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797342, "uuid": "5ff3a928-9af2-4427-8ca6-1650ddda9154", "comment": "Malware payload (RedLineStealer)", "value": "ba638e799226133562dc8b23a4ada365cde5f8a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797342, "uuid": "333055e7-7f98-4090-9fd3-1299bfd8dac6", "comment": "Malware payload (RedLineStealer)", "value": "395a651da07afca8d65efddeda10ee56a32414dbe6338ff585f0b72e0238d6476355e23eea2e47b5e97b6c0831e08180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797342, "uuid": "51a2c508-dacc-4ed1-9675-14d24b75ab84", "value": "T1D474CF00BAA0D038F5B753F45D7987A9B93E7AB12B2095CB62D526EE56343E0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797342, "uuid": "9d3df49d-7016-4c4e-a695-4c1f6d53216b", "value": "64cca9e1e2de2d3835f36bbdd76fe0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797342, "uuid": "4bf09a01-b5d3-4694-8619-9b2bc528ac70", "value": "6144:dIhB+ekHg/gzZk+4qJlJI8PccgOXh+F4T0YTqPjuezlCGZNLU3hzHekdJA26B2as:yhDkA/gzZk+4uPrW43ePNkuNLUhHSzQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649797342, "uuid": "1cde68d0-18ad-47b9-8cff-6533866f4141", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649797342, "uuid": "c4ba7871-14ba-4e2c-8b93-bac057f61583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797342, "uuid": "041260b9-3254-404f-85d5-0f35d688e83a", "value": "79b607483771af6aac0ffb113b2a95c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e1ad49-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736409, "uuid": "e944a2df-9b19-428a-9f71-678633013727", "comment": "Malware payload (Mirai)", "value": "f083681d246fb301bf30250d988cb19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736409, "uuid": "2ffd8e6c-8686-4b59-a8e8-e14f20b6b5f9", "comment": "Malware payload (Mirai)", "value": "b8ef8af72369bed5e603a60ca280a1d83249b8f9d6886c3aacc6d1aef147a321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736409, "uuid": "5a422b63-f6e4-4b4a-930d-d64078ce14a1", "comment": "Malware payload (Mirai)", "value": "3d022f0af3373789fdbb008914fc5ee7ddb0fc10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736409, "uuid": "1efb4de4-b508-4eef-bb31-3be9e55e714c", "comment": "Malware payload (Mirai)", "value": "87b6ab385e1df509de366358c1c695d2e715fdc8bbb4a89165b98b9cbb9a300b92e490650b6be23b165fbb24292d7ddb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736409, "uuid": "9562319c-3827-4499-bc89-1fd0552547c9", "value": "T17883D849BF610FB7D8AFCC3705A91B02288D555B22B93B327D70D918B64B24F5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736409, "uuid": "47563d51-a212-48d2-9b76-45f6bfcf7f76", "value": "1536:Hm+fQT5uDTWTG0L2k4YuYkMc5QrWGsst0Zq8UUB6Xa10:Hm+fQT5uDa5yYuNXU0Fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736409, "uuid": "7b3636c4-1d6b-40e6-9daf-d02dc55de9d2", "value": 85652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736409, "uuid": "ca390601-dcfd-40ce-8bca-b0c0c35d279f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736409, "uuid": "fd055996-cdee-4c52-9aaa-bc05d3f362a7", "value": "f083681d246fb301bf30250d988cb19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93f0193-ba85-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649784404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784404, "uuid": "67e0de95-81a2-429b-bceb-9a7040f76fb6", "comment": "Malware payload", "value": "873da2f0a6484669483a21597e1ac2c0", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784404, "uuid": "874b6fb1-9a35-46dd-a044-2e0259363371", "comment": "Malware payload", "value": "b91e521a864bd5aabc0bf30b8f983adac9a873f16a7f20a8faa3e93f13fb435f", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784404, "uuid": "faf59ff7-fbc6-42a4-a2a2-66660b119f7e", "comment": "Malware payload", "value": "dbc3207af6e6ac2dc56a5c8f9992d8f797871726", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784404, "uuid": "d4923f85-e316-4757-a484-13afe3bcd407", "comment": "Malware payload", "value": "583af2a71875b33646bcb5f2c478c94b169e457e4f10b9ec8a898669f0709c6bef07015b6ebecb0444cd9f33c06913db", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784404, "uuid": "e5955410-4769-440a-9087-f69067cfd784", "value": "T11484A545F7ABFC0F50151D0C503A525BB92DAAF8B6EEC77358839237F0DA21606EB14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784404, "uuid": "9a4dfd9d-0207-49e9-ac78-157b78dcb15d", "value": "6144:rZGyW4TYpV290gz4GezrBAEAfXgKlfGEEykaZorhWZiAVV:rZGyW4TYpV290ggWb4hWdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649784404, "uuid": "623d6503-c415-4661-93d7-4a2a82d53eb4", "value": 395715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649784404, "uuid": "0aba3410-8216-41d5-9395-d7e3f6171e1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784404, "uuid": "13a3028c-9648-4e9a-9fe5-193c94054abf", "value": "Server67hm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6307cd14-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764073, "uuid": "1abf8746-9c25-47ad-a8a7-8f1d4b036324", "comment": "Malware payload (SnakeKeylogger)", "value": "e6b1cff2adfcf0bc4829299c4df5d350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764073, "uuid": "0d00af81-c99b-42aa-a063-d87b74c3a62d", "comment": "Malware payload (SnakeKeylogger)", "value": "b9565dda0bea71a0e0d98830e5671db78ea8cb54752476542d9c34ddc4613bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764073, "uuid": "4a8d91b6-c2ff-4559-acf3-ddb42468c4cd", "comment": "Malware payload (SnakeKeylogger)", "value": "471d61e50b5393b857cbae11747e6f636bc03abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764073, "uuid": "51424b96-ae19-4d45-9ac0-40fcda3970ff", "comment": "Malware payload (SnakeKeylogger)", "value": "1de3922d17207a6cc1f5afeb18d8ac8bbea961a580c5248a4583a85b0ae9fcf99781f265a5578bf52e6ce8e8217427b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764073, "uuid": "aaaa9f0a-dd36-4ab0-8119-c69773100e93", "value": "T1FC154CD1F194889AE96F0AF1BC3A943015E77E5D58A4820C5659BB1B3AF3342209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764073, "uuid": "cb1ba82b-4ea6-43ee-8687-b19e28def826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764073, "uuid": "ffb275cd-a3e0-4f3e-8e4f-2517fcfb0692", "value": "12288:IkKUk6Mm14qGhafQTWpKQEIPm6zPjwjh7dP6DxwY15gVgz:IkKX6vSqGha4TrQx1zPkoxQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764073, "uuid": "624b1941-8eae-4ea5-abda-f4e9cb367b4e", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764073, "uuid": "ec89ad8f-04d4-46b7-86ec-21f482a49db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764073, "uuid": "b2038f4c-6a26-4dbe-aef9-90370dc6a55a", "value": "PO_28001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e60bedf-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649764360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764360, "uuid": "b94ad5f0-68ed-48c9-b627-a491ed465c15", "comment": "Malware payload (Formbook)", "value": "6453102a0a1946c561c5c76c5459e3ef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764360, "uuid": "a0adc7f2-e2d7-4770-9aa6-4ff355e5bc00", "comment": "Malware payload (Formbook)", "value": "b975fa91fe743a7b4f635bdbe19bbfaa45a30727568aa80a65e71e9374465275", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764360, "uuid": "303ea2aa-798b-48eb-91aa-d8dcfca411b2", "comment": "Malware payload (Formbook)", "value": "84f4b16bc27e45e0349ee375ac28cb830d192085", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764360, "uuid": "57ccb8ac-596b-4964-9d9c-8dc5c1b823b8", "comment": "Malware payload (Formbook)", "value": "9cb8f151c17f51f42b1882e3ec9c2b9bfe647b964802a62579378b546b1fc41b384d13aec8cf4fb19b68972411401ad4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764360, "uuid": "e573849b-d621-4038-b0eb-4d3fb976ccc6", "value": "T1347423753054FA81DCB7FEF710AE86652D14FC8B1223EBAEE549311C22BA7AB8DC0155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764360, "uuid": "69ead42c-5fba-4a41-ad3f-a6e3f576f5ab", "value": "6144:xBtEJ2bt4n6FJtpghkqqj8hHrcAMOm3n+q63pg7XDgBvvC9FhgZwWcPu/jasAi3T:xH34n6FJ4sq54n163pCX8IU2sAyqN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764360, "uuid": "a2b1320a-c62d-46df-803f-98cd2b5ad871", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764360, "uuid": "12c25d38-7b0d-4fb8-ae64-fd71087a453d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764360, "uuid": "e593ec4d-2d2b-49db-a687-ee8960346261", "value": "Payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77de535a-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793314, "uuid": "95528cab-adf3-4d7f-b7ed-779a8b436ad2", "comment": "Malware payload", "value": "de17b6db980824ddbaf4a5ff7a86ae85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793314, "uuid": "bd2db1d9-566b-425b-b81a-c0c9441082f3", "comment": "Malware payload", "value": "ba59af366a944351363328241dba1a7c0212d5c95d544bed4b7c0ef5563855f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793314, "uuid": "535897ff-52e5-4f2d-a375-b3083faafc38", "comment": "Malware payload", "value": "6300b7173f1315287f676571e5d802d6369d755a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793314, "uuid": "7ad487a0-e372-4f03-8a00-44a53e985d4e", "comment": "Malware payload", "value": "4740ad2f27dc63dd98c28b6078302227fae64becd76d7e93c2cdff6d4fddcbc39c198f3a9d3cd750d61ce1637150ced1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793314, "uuid": "76ec72c2-f4f5-4c99-ac32-02118e822ff5", "value": "T1944422FCEA46E1B3A93107BE704836E5019CE5DE41BE3625E35DE086D236183EC85E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793314, "uuid": "97584e4d-2d00-436e-bea7-2c7ddac1fe53", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCnSgmQ/mqYr:mZRgUY/fsJcO1KOiXe+Qer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793314, "uuid": "bcfb290d-c280-418d-9c51-3b5111a9f146", "value": 253397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793314, "uuid": "e3664748-a9da-4ab9-835a-9d9b832eb449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793314, "uuid": "2a6b573c-2739-4104-b676-8b39baeaca80", "value": "intelgeneric6.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4590785c-ba0b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "e247ed70-8163-4477-bcc2-7cdde072b1ef", "comment": "Malware payload (Mirai)", "value": "3776b537ee301a56cbedb96faae2b892", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "b38afa8c-fa65-43cc-9036-ccc1e3bb5f00", "comment": "Malware payload (Mirai)", "value": "ba928c4e9a24850c5fcd728ebd8e86a360fc74ade208921cfef6449232866bd7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "f25cbca4-2a82-4f56-b022-9c267d65a0c5", "comment": "Malware payload (Mirai)", "value": "300d44641cb060393a86c633d371196fade55ea5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731811, "uuid": "1ac517cd-e502-47a2-9ba4-3e38fc309f6c", "comment": "Malware payload (Mirai)", "value": "bf13566a30026d99a8cf57f495df23b99c0e9642a87251593a20d1f98efe3f5030aa0d8673b17ef24a7b3769ed4c0a42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731811, "uuid": "f04fa42d-46a4-4459-bc26-8ab17dd703c1", "value": "T129D2D13294CB9671C3B48B756E35419A231727B4E7EA036612203BEFB48950A677CCDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731811, "uuid": "41bf1d32-badd-4a4c-b9ec-1ae6b10e26d2", "value": "768:CkbeT8sTgNaUkqbPBeuql5H6hZOs3Uozy:Ckbog4UrBpEBazy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731811, "uuid": "0ca0ff8c-53fa-4818-8e40-be65b8112bdb", "value": 30364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731811, "uuid": "044bba2b-6f4f-4920-ba13-e4f4e581151a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731811, "uuid": "35bf77ec-f9c9-44b9-a22f-2a186572f1fb", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d175ac5-ba6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649773512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773512, "uuid": "1e7b8f07-716f-4471-99b6-43510d4b6953", "comment": "Malware payload (SnakeKeylogger)", "value": "07503f9d8e7328f8db0430d07d8293d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773512, "uuid": "d822f10e-1ce2-441d-8191-b8dfc1b71a5e", "comment": "Malware payload (SnakeKeylogger)", "value": "bad5441e5ec020c25a64ab229b90f2643950dd980be4c7236fa950782636966e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773512, "uuid": "dcfc9646-be78-4f49-bdbb-60f969f8c60e", "comment": "Malware payload (SnakeKeylogger)", "value": "d6e04f2a9452c9a8cea5d060ce95245476033d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773512, "uuid": "4c64db3b-2fa1-432a-afd9-a6ce448b83bc", "comment": "Malware payload (SnakeKeylogger)", "value": "2980c081d042869e25456449116af683bc48b5549fe66faa1b0aa589f8665a15002062f33e4dc18780a30e47316f4f27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773512, "uuid": "0e49d40a-afcd-44c9-9f9b-3d4374070582", "value": "T1DFE4CF09FEBAC912E2A41777C4D7090403B1AA47DA27D76F368162E81E433EB9D47397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773512, "uuid": "2416f18b-5883-4037-9343-c89d09ba8c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773512, "uuid": "aaa05275-c415-465d-9228-1dbe25a54ac7", "value": "12288:2B6SiYQAT7QmVk4qfKaNg85bmNzUMY2Ire1fgik5jAJD4Pwq60LRzg2g6:6nZqHCvzUMwa147jAJEPC0LR8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649773512, "uuid": "807ca13a-bbf6-425b-a708-bb27c080bf26", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649773512, "uuid": "0020454a-68c4-4f4d-badc-08aa93a9fbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773512, "uuid": "a48d0014-4d9a-4e6b-bd6e-29007902f791", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f245e78a-ba75-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1649777628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777628, "uuid": "94938ede-b835-4f6c-ab9b-ff982980d9f6", "comment": "Malware payload (BitRAT)", "value": "710aec3ae8d77ad206e3c5281abb3e18", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777628, "uuid": "ed037187-d0d1-4c6b-bd93-d87b2bbdc791", "comment": "Malware payload (BitRAT)", "value": "bbfee23d108349db3f3bf3250eabb0215df3ef1a10c3cf2832c82f58b83b723b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777628, "uuid": "c9bea83b-9513-4690-bec6-3e502af7422b", "comment": "Malware payload (BitRAT)", "value": "2b9c6af354d700e5ccfe50ef723cf49a6ea97982", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777628, "uuid": "d2485102-900f-427a-b698-5b5fa96e63f7", "comment": "Malware payload (BitRAT)", "value": "834d55557ee728a9eee6d2a7d67e1425b570f577212afb37c0eddcb70a7d6cbd7668f87d8d2114fcbf31e04c7e2d5cac", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777628, "uuid": "928b3a32-1e91-4c8b-8212-0845d77efbb6", "value": "T1BF95F0ACB8B5F95BF4C4437BC6892CB6DB2CA540D7993D9B8E204152BCC310E5F6A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777628, "uuid": "45e1068c-f8fb-42e7-a997-9bdb06567198", "value": "49152:iF4+aLQib1yowae6yjniohdtwCMD9HKialON:iF4+M6owae6aLtwCMD9HjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777628, "uuid": "5dfbe1de-a99d-4916-939b-4bb754cdb5f6", "value": 1971074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777628, "uuid": "e697886a-9f76-4757-bf11-d3324e77a3be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777628, "uuid": "93294659-180d-4e02-9c68-df647c21a7ae", "value": "CHECK2804217.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4798a7b9-baa6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649798387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798387, "uuid": "7d037499-ec54-4b9e-865f-ad663c967ade", "comment": "Malware payload", "value": "d1e75b274211a78d9c5d38c8ff2e1778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zcryptor", "colour": "#0A09FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798387, "uuid": "5e737f2e-ba75-4747-ac72-c6796554270d", "comment": "Malware payload", "value": "bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zcryptor", "colour": "#0A09FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798387, "uuid": "3a8eaccb-af6f-4108-bef2-4b6acc8470e3", "comment": "Malware payload", "value": "d14954a7b9e0c778909fe8dcad99ad4120365b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zcryptor", "colour": "#0A09FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649798387, "uuid": "bf69969d-3b73-4e71-b90c-0a087146dc46", "comment": "Malware payload", "value": "cc09499dff6f1d14963d9a31771a8f393c27a4c1a09c21bbce4f7d3a145dfe1c199ab17d69454dde4f96b81bda0b55a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zcryptor", "colour": "#0A09FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798387, "uuid": "81f42e40-3df9-4a4c-bb44-208c5980f118", "value": "T18605BE12FAC19873E1E3017815B6A37E4C37FD21572996C397D1266989392C02F3FB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798387, "uuid": "aa7e23cb-a5d8-4a64-abdd-2948af7bdbce", "value": "7c6791cb1b3ac992063bd8ecc38e1226", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798387, "uuid": "629cda17-70d8-4662-b5a1-285f59a6295b", "value": "24576:l2RNuxIAdOx6mNoGSyGMjc6XaMAy9xg5tMZ/Z3RPpEYrTQAU:rIG+lbGuntxktM15RPpEYrTQAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649798387, "uuid": "ab2e7676-d420-4ec4-afaa-5f946129d36f", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649798387, "uuid": "c9a6aef6-3333-446b-9256-47872bf1bc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649798387, "uuid": "0eb0341f-096e-4cb0-9ce7-ab647e0fe075", "value": "bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27edea9-ba53-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649762998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762998, "uuid": "713a013a-0d60-491f-8653-a39b5393d037", "comment": "Malware payload (SnakeKeylogger)", "value": "e422b33045f528b023da052f1cc465b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762998, "uuid": "698fc405-3bca-41b4-97c6-3f799e476508", "comment": "Malware payload (SnakeKeylogger)", "value": "bc57060a3dee14a077bcd575ff50e83077e76125e005e47da21bf0dfdefcf197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762998, "uuid": "26730121-ad87-46cf-8736-ba6a0f17f7da", "comment": "Malware payload (SnakeKeylogger)", "value": "661d7818649daf0a5b19ba87dd1f3bb471938117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762998, "uuid": "4c685f2e-dbb4-41a3-9fcd-edfbe3b32ae4", "comment": "Malware payload (SnakeKeylogger)", "value": "26862526f9bd2d09ca1c2b3715b4373d8ba6a226d0ed7c63d5e02b0815a19c21363ae1b36b06bf373c18e6b81c8dd811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762998, "uuid": "a2f575ec-a39b-4471-9bc9-8c2b66f619df", "value": "T1A8250277B756DEA3CDFC927C1821BED362E192279253D74EACCC81A8B3826D857050C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762998, "uuid": "679706ba-1fdd-4987-a8be-6b84d1a42648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762998, "uuid": "51eccf13-3f31-416a-8541-694793ff0945", "value": "24576:rdBqCebfeuXVgOnZTgNoKu43pxoNykTHgit:rdBqCafeEVVZTgLDIBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649762998, "uuid": "1cf97e86-ecee-4e44-a374-e657ad7b149b", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649762998, "uuid": "9935eb6a-4713-4c33-b17e-2bd152a4e774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762998, "uuid": "56545c9d-87b1-4cbe-aa6d-e0d3b6436db7", "value": "Ref-04122022115609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d857bc-ba61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649768829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768829, "uuid": "552991f7-6c55-49fd-a594-7a1f343e82a6", "comment": "Malware payload (Formbook)", "value": "5d4fd662a91cb6f89ef88b7a609d5a53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768829, "uuid": "4aa6c5e1-572f-49da-848e-b004331bac6d", "comment": "Malware payload (Formbook)", "value": "bce2bc3a55dfecfd388b134663893b70c3830b20a8afa395e36a28097e305943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768829, "uuid": "ed491d31-ef04-46b9-861c-da8aee819037", "comment": "Malware payload (Formbook)", "value": "8f286e7c989a02e23d787f23454c325fb93ac129", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768829, "uuid": "74572280-c965-41ff-a0a4-23e38cfc4571", "comment": "Malware payload (Formbook)", "value": "e85cc8c11f4321c4c0b967e99b4425eeafd0a9f3c42022dbda6d62cceb0abf3d4c47d57eaffc59a341934406def47616", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768829, "uuid": "09ce7994-d7a1-4651-95b3-8cd5f002fb72", "value": "T157F4CF09F7A6DA23E2A50777C4EB080403B0AA47D556D72F37A1A2990D433EB5D077BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768829, "uuid": "c804ee1e-52e0-464d-ae46-ee9b357bd4a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768829, "uuid": "84dfb670-1cb0-408a-86bd-56a75f19cc0b", "value": "12288:ZGGrq4GqaO4quH7iptEQDBzFy3Dp34uDTbITsr92lypaNamliosMFg2g6:rW4GqalquH+HEYBhy3X7IuYsp1och", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768829, "uuid": "3876e9eb-fd64-4118-a3ef-d02cf06643b6", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768829, "uuid": "898e7edd-86a8-4923-b8cf-fbc15cc59dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768829, "uuid": "f4e86a41-07db-4cce-b7ad-1f22ac1faef1", "value": "5d4fd662a91cb6f89ef88b7a609d5a53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40360309-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767450, "uuid": "3f848cd0-ab48-4277-a483-af8f9faf15b6", "comment": "Malware payload", "value": "d07e0a72596cfe35a1c9e5fbfefdae8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767450, "uuid": "98158927-a12c-444d-8bba-84a949047585", "comment": "Malware payload", "value": "bd4c376ae6593e17be81b26264cb967949f92fb6053c7993009fc9072f7311dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767450, "uuid": "1475745a-906a-459a-bcb0-e6375cd9b595", "comment": "Malware payload", "value": "11709abf4be69b4f43838ed6349e2c481c51e289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767450, "uuid": "825794aa-08cd-4f4e-b1c1-398878c07b19", "comment": "Malware payload", "value": "ff6d6a83fe8523f537c944108b341dff4faf4b0f76d48a84e06613ce6da2c992f6d0779ee31365da8e86446c451cd6fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767450, "uuid": "16de4c94-4a68-458c-bef2-9d92f2fe3755", "value": "T1EDB22825BB8B9722C83C5B3688E5044027B5D3D67B37DB2FB8891219DF433EA4781789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767450, "uuid": "029b723f-5631-4871-8e5f-ff45d68b8471", "value": "384:TAClUHc7eIqIsJc4rQnJZxHmCJGXy+U7QdqVUf9vwEG9/XwJwq6uJfq2GSLwqZc1:TACCHc6jbdaLxHNgIUdqV92G0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767450, "uuid": "18e9f6bd-ad82-4487-bebd-d608502937b7", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767450, "uuid": "fd7116c1-9a92-4224-85d1-46be50cef943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767450, "uuid": "6a4f5d67-f35e-49ff-ab84-b3b2451946ba", "value": "d07e0a72596cfe35a1c9e5fbfefdae8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d316705-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649800570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800570, "uuid": "5f71ebbf-8b56-44e8-83c8-011f1760c705", "comment": "Malware payload (RedLineStealer)", "value": "aec6927ff8881a549ce3fec5e2c9ae8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800570, "uuid": "58b878e9-7366-4c14-bbe0-8e1947081613", "comment": "Malware payload (RedLineStealer)", "value": "bd4d75954458ad660b6f5efa43cf26062421e86d3cb6281de49c388d1146d698", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800570, "uuid": "0223f898-4b5a-4d15-b59a-df931b8c17a4", "comment": "Malware payload (RedLineStealer)", "value": "a4fe6e31239a14801f605caae8fc710be2797118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800570, "uuid": "565ffdd0-5283-4300-8f7e-273ee063d87d", "comment": "Malware payload (RedLineStealer)", "value": "dd174a429bd2a758366597f24c9038627e27abd1419b5ebf0c1bc2783a353913e51a1e014eff1eed01eb5643c28b549b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800570, "uuid": "1e95ead8-5ae8-4072-b0e9-171eb5abb2e4", "value": "T13C74CF00B790D035E5BB52F4497983A8AE3F7EA01B7495CB62D567EE06396E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800570, "uuid": "64e550f9-2510-4bc9-baa1-d4595fcf5560", "value": "64cca9e1e2de2d3835f36bbdd76fe0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800570, "uuid": "8d074fb6-1814-4e0a-bce1-ea44d38aeebe", "value": "6144:eUNzZ47HZDmoqqalDP+ETMtBq5s2Dvawy6UxbcQ9+XC9eb+0VrCxZLkchUJDGNAJ:xN675DmoqSEotE5s2jawkc9C9C+058ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800570, "uuid": "e3c1af89-a997-4d14-b157-22c687bda642", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800570, "uuid": "4e431272-4d9e-4eda-9d01-039c6d100fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800570, "uuid": "7484c59b-a8b6-4739-bd1a-b6b999f42e72", "value": "aec6927ff8881a549ce3fec5e2c9ae8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b063acb4-ba82-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649783100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783100, "uuid": "33310ec9-6cca-4780-a354-b75213ecedb0", "comment": "Malware payload (AgentTesla)", "value": "555dc7c218efb0502a1b4644bdb53913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783100, "uuid": "45004a39-de71-4d84-b9d8-ac6910a20492", "comment": "Malware payload (AgentTesla)", "value": "befb543b25be32d9ba84eceeb96367deb264f6d721b694ca6f34d18311b5ec6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783100, "uuid": "1ff4898f-c949-4512-8ff6-c89af251074b", "comment": "Malware payload (AgentTesla)", "value": "74a3ad80e19894f1394c5553fde2fd6cd76ec1af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783100, "uuid": "5e24b658-2c62-4686-94fe-7e35daf9f3b6", "comment": "Malware payload (AgentTesla)", "value": "c3ed79955ba7387cec060a32d06811669f703bc9bfeb87557fa56cfabb128b37327bcb6e4b64afc1164ce4678785e35b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783100, "uuid": "0d8fc45a-aa7d-44d4-b787-7e4f0e5310d2", "value": "T103D4E120F5A93FA5D46603F51830E14513B7B71AB53EC61C6DBA71DE49327C36222E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783100, "uuid": "92511208-7e48-4664-a6a5-0ad7d3bbbba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783100, "uuid": "f6712963-7e9e-4b02-a5f9-64acc16d1c28", "value": "12288:BsR4qib3FNgaX88FoL34mE4U6PfoXRSGyZn2aVQ:B7qi4ck3d+GORSb2uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649783100, "uuid": "63dcf996-25dd-49e6-9c58-a010bd5cd0a1", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649783100, "uuid": "689437bf-1987-4da4-8026-c0b48f261c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783100, "uuid": "cbfc5795-92f8-4eda-9cce-b9da708126cb", "value": "555dc7c218efb0502a1b4644bdb53913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a5d5e0-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649778069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778069, "uuid": "a7a73a0b-3a88-4bc4-8030-ac07499cc1a0", "comment": "Malware payload (RedLineStealer)", "value": "40073a62aad20fcaf8226d3ed7b7dd98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778069, "uuid": "94805965-577c-49b1-9fa1-1b52315a75f7", "comment": "Malware payload (RedLineStealer)", "value": "bf443e407476f3c013f106bb2ffc7540dac5dc5badd162b9574f13fa500604ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778069, "uuid": "d1709e32-0f6d-4066-95b3-8319bd2a9bda", "comment": "Malware payload (RedLineStealer)", "value": "c50ea827a4e6695594580a562cfd8fd31630de90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778069, "uuid": "6bc7cab6-449a-4085-95f9-d06f6b7a8273", "comment": "Malware payload (RedLineStealer)", "value": "91be83ebed6b3bb77df8351f79624be5922c2761e5eba4e4214cab6de72e125e46c4cc503955985bd88b9aef8b12d66c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778069, "uuid": "22b34d0c-cdca-4bc2-8d0f-bdbbfdfe9a60", "value": "T1FF84CF00B7A0D039E5F722F45AB6D36CA93E7EA16B2460CB51D52AEE57346E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778069, "uuid": "6663c3ca-da83-48bf-9395-d4ee8e4e77d4", "value": "abeb572091795033c85c3efeed8e2553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778069, "uuid": "89039967-a639-4b63-ba73-35c13bd6f0be", "value": "6144:B0LFyygrJxvDxOB40zdEfPTtnnjtN66kOFrTDRDyTDW:WLroBDxOB4EWPT9jzxVTUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778069, "uuid": "1a6758f1-8f36-4498-8afe-da620c883a48", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778069, "uuid": "a23550c2-f23a-4bc9-9813-9b45de3c7186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778069, "uuid": "210255ae-9d2e-40b4-a081-4cc94f6d35c4", "value": "40073a62aad20fcaf8226d3ed7b7dd98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447b6d47-ba0b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "aa19c69c-d1a3-40cc-b2e5-a9461a5cf974", "comment": "Malware payload (Mirai)", "value": "1bbc7d1898bd4ed9b0f17f55860744c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "fb151155-7b03-40be-89d8-0e4ce9047a6e", "comment": "Malware payload (Mirai)", "value": "c0033d9a47853b1e260a2a029c2ace630c418682a1eeef03734dcbeda0383192", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "223b53cf-f48e-49fd-aedb-132644a4726e", "comment": "Malware payload (Mirai)", "value": "591a715e302307dcc56da3f123aa7e9921c96314", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "f284cc51-4de6-4a85-97dc-273cd985658b", "comment": "Malware payload (Mirai)", "value": "b36f2a1b5d2817af8ee9f401968dde2b5410a400b7ffcf47895521fb20688c3fbe0ed77a8073470f077467759912fc13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731809, "uuid": "75ed0d73-b022-4fb5-b2d1-fa089823b7c8", "value": "T138D2D046C2DCC969C44F44320BEA754B0C4EE89D91E4A8EB2CF625339C4EF657F62B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731809, "uuid": "99afe010-596f-48b5-b23c-5816f8ac31ca", "value": "768:90BrHfVtS8RaQX6663Y/YzMrCZxBR3oC5SHAnbcuyD7URQRj9h:905fVt9QH3GIMrYR3Rnouy8RyRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731809, "uuid": "45139024-7055-4a07-aca4-89fe2a819ba1", "value": 30764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731809, "uuid": "d8ef8f39-d7cf-444a-ac5a-9e71012848ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731809, "uuid": "7679668d-d023-45b2-bab0-93fb02b20854", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1a0fe9-ba3b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649752706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752706, "uuid": "78375010-745d-41dc-b3a3-9b6db4fd5674", "comment": "Malware payload", "value": "e47c3184b6bc18b9d6f96525ed01c5b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752706, "uuid": "3ccd1b9f-7462-440b-90aa-37bbd48994b1", "comment": "Malware payload", "value": "c03322870cf1f9b50c13f0373cf43350d90184f94c8247eb0cb0e1e9e2e4ac35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752706, "uuid": "b8d1e36e-23fd-48b3-82d3-98ab82ca20d1", "comment": "Malware payload", "value": "f201b74884fdceea563074018347ad4a669b0935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752706, "uuid": "825d728d-4f2a-47ad-8a8c-ebfb9d663e6d", "comment": "Malware payload", "value": "f308fa0ff8171ca1b51ed91841752e1cf10592ae08138782ae7dfe29a2a5ba7b3a8165c8c3a02234c395fa503609dad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752706, "uuid": "94e7dd55-1860-46b4-8ca9-ad01624ef102", "value": "T1D7C19749A62486FBF25D8BF84C67691D3DA4494013E7017631820CCEEEB3A92F75772D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752706, "uuid": "c55872df-743b-45a6-a2b2-189c7de34578", "value": "2cbd54cec9737815d0bf8f7c0b774386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752706, "uuid": "d1b6b7a0-a5dc-4d6b-911c-76db15fe59fc", "value": "48:iJ7lVss5hzBGK2rbl06lG7ZYPPhqgT3uqMlGpy25HTcdpm/+oSBmniRuqS9:Yss5FBBQb1GSP3CGpyGIxBBmyxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752706, "uuid": "b66b17c6-8a95-432b-818b-18f068cbdc8c", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752706, "uuid": "8cbfbc28-7197-4bf1-8ec7-983dd2c1a2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752706, "uuid": "37e13123-900d-4c97-957a-89c6b596dddc", "value": "SecuriteInfo.com.Generic.NSIS.Injector.A.406352A0.4803.12888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23c7be3-ba46-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649757441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757441, "uuid": "5642403f-06b4-4a6b-8d85-ef6e53aacc86", "comment": "Malware payload", "value": "36e94b02704368d63dce9d0af95a566c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757441, "uuid": "d88d8287-e6bb-469f-acea-c0df8ef3cfb7", "comment": "Malware payload", "value": "c07afe27b4f94dbeb6a21e23deb331a3ede658975471c689226162fda28325e0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757441, "uuid": "503f7e5d-47d3-4145-88d6-16951c8e521a", "comment": "Malware payload", "value": "2e51f695d178c92f3a31f73b02d6baff455d5e85", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757441, "uuid": "da7fd17e-7be0-4829-bac1-25bff98b4f57", "comment": "Malware payload", "value": "1f85225cd07532290fdabf93d5a7bbf5ab6b133ecb93814b1320a6788ebc406b00e51cab9f814d87855b7afdffc4c628", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757441, "uuid": "687fc06b-7688-4c4d-9905-c0342ad20c9b", "value": "T1CA51AE101AE10B09F3F29F7ABC7BA721493BBC56FE228B8D0180554458B2615E975FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757441, "uuid": "df31f57c-c0ee-4c66-b7bf-21c309ef4bdd", "value": "24:8W0FF6VkWjNxHKR99WHdFUW5+/CW3UsS+rZS+6pwS/ZSKddNXuHY8CI5KDxm:8W0X63jY9QH0eh3dLXuH+I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649757441, "uuid": "c55f799a-5baa-4709-941d-9f399c799476", "value": 2473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649757441, "uuid": "ffe33d85-bd0f-43db-b3e9-74eeb723e401", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757441, "uuid": "fc7426b7-4fe2-476c-93b7-f33ae27eb932", "value": "c07afe27b4f94dbeb6a21e23deb331a3ede658975471c689226162fda28325e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb5ffd5-ba53-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649762752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762752, "uuid": "02913b34-6b34-435f-a5b5-b023c217e61c", "comment": "Malware payload (AgentTesla)", "value": "b76101c1900acf1765f263dd07959533", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762752, "uuid": "6e481dd5-4030-4fe5-bd5a-cb36a33af3ef", "comment": "Malware payload (AgentTesla)", "value": "c09a64df71db0720511fcbc521afd0023f121c2b015e57f8ddf773f0850c0f48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762752, "uuid": "55192679-11f8-4d1a-9ba5-2850557c4e1f", "comment": "Malware payload (AgentTesla)", "value": "0580283428706b31b08a70ea9e1724d776ecb1f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762752, "uuid": "89ed18e5-a7f5-40f8-817d-18ba3d79f35e", "comment": "Malware payload (AgentTesla)", "value": "374116e5a24e28f045f329c3a6a6899edcba69b43e193a08313381145d09fd706aa57ad36eb71be7666fe8f6acc97833", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762752, "uuid": "184fb166-68c2-4863-a5ea-57c25ae5627d", "value": "T149142B4DBD18C41CCEA8EA71841FF0B7FA2ABF86B64D9710E0457FC639322A15A4D935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762752, "uuid": "b911398c-3491-4546-af09-6a414553917a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762752, "uuid": "76bbf099-24a9-4938-bcae-d0c575a6bdaa", "value": "768:3t9JA9JadozBwQIswL9cu5q2C9IltBidM+Gk/iZibAp:TJMJam7g9cqodMCiZibAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649762752, "uuid": "1c953882-0c12-4fd6-bf44-a3f678afc3c9", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649762752, "uuid": "02284cb7-f313-4825-ab3b-cb913d371ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762752, "uuid": "7e8590b5-22da-415a-b6b8-ad2647a11644", "value": "ENQ_78954100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fa8aa4-ba83-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649783318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783318, "uuid": "3b0b1c5a-687f-4938-95f6-8ad0bc65962e", "comment": "Malware payload", "value": "13bd4a09264d6312d957d61d64e79f53", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783318, "uuid": "ba107180-2b5d-43ef-bb47-8d6dcfde7d7d", "comment": "Malware payload", "value": "c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783318, "uuid": "3c72a4b7-b96b-43c2-bff6-fcbfa21c8602", "comment": "Malware payload", "value": "5ebf19ba1be83ad9e15991e76e509a57aaa9e9c0", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649783318, "uuid": "156d8186-5228-499d-b2fb-c10a2c74d9f9", "comment": "Malware payload", "value": "93af0a146fefcab4af9d51be55e6cca9511beb5529857d22f4f4f3dfb1ba9dc52255738e438e54c9b29500a7ff0b8d91", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783318, "uuid": "1b29b80f-df1d-4e66-ad46-91f03722236f", "value": "T150D402567A874B33D9020375555B23D4CBB68C5887B74A13A4A5F34C1CF1BA1A3BF8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783318, "uuid": "70bcb2bd-d9e9-4d16-8ac4-da0bfb0ceda2", "value": "12288:rZzDzxF3RR3sSRogrrYW4OH5IBwBZ3TzChsL4o1U:rZzDzvvRoCBH2WBJChsMo1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649783318, "uuid": "7f3cf002-412c-455f-9f59-92f2ee15aa13", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649783318, "uuid": "2336472a-3c8c-4069-885c-aa6427352499", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649783318, "uuid": "b57a6fe7-395c-482d-952f-792888aa628d", "value": "426.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1765486-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800765, "uuid": "145e670b-e7df-453a-b4b2-7659de15f14d", "comment": "Malware payload (Mirai)", "value": "f6ac297e025d9abe990c40ac15db9cb6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800765, "uuid": "8fc7c85e-51c5-4035-b836-edc248bfecfb", "comment": "Malware payload (Mirai)", "value": "c0c4d3908598ae67c8a174100dcdd2176a5b0873b0b43773d822cb9aac635629", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800765, "uuid": "6ea4e542-6dfc-4dc8-a8e9-d5b0870d863a", "comment": "Malware payload (Mirai)", "value": "945b78031ce3daa0c83dfa830810faa66a9e141a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800765, "uuid": "7c02a56f-ba22-4a2b-acd7-c052c61b9673", "comment": "Malware payload (Mirai)", "value": "faf6a6c6f41b09225fd393f95873c0c13da837ab475bce2e2806c52210e5f07a3df2d970942d25771eba7b98f06634b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800765, "uuid": "e0987838-43fd-4c91-aecc-e8dc909ab471", "value": "T111630258E27743B18531347DAC93B08BAF93DAB493AEBB7070410B6D278550B4CF99C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800765, "uuid": "1e60e89c-2712-49ce-b8c0-dab8a76de8f8", "value": "1536:EAQm5uqzcRe1OZmaMwNZY2AIZ3oN0xLDtH1pR1iMn:ZQgzIekE4NZ1YgLpHyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800765, "uuid": "a4ae8395-1326-4bd7-9118-d9d03d2de714", "value": 69224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800765, "uuid": "d9bab76a-583a-4809-a467-e78518c1fc94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800765, "uuid": "7ac21ee1-441f-4e63-b093-a484cf463b04", "value": "BDK.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42957a4-ba54-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649763457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763457, "uuid": "852aa005-8689-4163-b499-7c1f6eca3468", "comment": "Malware payload (DCRat)", "value": "15740f5e7deeb6f5441359ec33b04272", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763457, "uuid": "62035d13-6e2a-4f3f-ae95-763ee144f357", "comment": "Malware payload (DCRat)", "value": "c0d543e1424136cf18df4def6132a46a5dbd495d562f03c6c4e9cf4591f6cd86", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763457, "uuid": "364b15fc-8ff5-4bd5-bc31-9332b6255528", "comment": "Malware payload (DCRat)", "value": "5fdaffb6b010a4a3510cf425ff2fe8c9af7762ed", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763457, "uuid": "e539b9cc-c7f4-42db-9d48-a80dd8b69f37", "comment": "Malware payload (DCRat)", "value": "3fb5620e38644472c44485193a4928c55611cf3609e97691296913c655421fdf703348c6bf3afc69137d77967a51a659", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763457, "uuid": "d094c024-d3da-4a5b-a582-39cb6d83b6f3", "value": "T1F5D2082ECF28440F1BFABE34F1B7470CE94325012A46999C32D536BF086AFE55F29658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763457, "uuid": "31ee5b4e-f226-4f21-94ef-59a88fe3ec8d", "value": "192:4MkqEVGu3XGV3YG8m0N6G3V+hl0N6G3VhehXG4uQ8mTGUVhkqEVGu3XGV3YG8m0U:GuqJnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763457, "uuid": "0d212e35-c646-4744-81ca-5b2c8ae25ef8", "value": 30904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763457, "uuid": "bc664499-a07b-4e87-99b9-4e4ca637421d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763457, "uuid": "470bf7e7-0bc4-490a-946f-f0619e631478", "value": "Flight Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abef0eca-ba68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649771926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771926, "uuid": "8665313d-c9ca-4e31-8a28-09f764574e98", "comment": "Malware payload (Formbook)", "value": "b416c05593038ca7e314f102e0dcae6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771926, "uuid": "bee8efb2-2100-4225-acfa-5658efd7f0a5", "comment": "Malware payload (Formbook)", "value": "c0d6833e7ba34a1a05310005fa4e09ad5e1e2b60edf8fe62fc42b7610913496c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771926, "uuid": "32f6622e-8d35-4204-b51f-5bb1f11709dd", "comment": "Malware payload (Formbook)", "value": "20ab9278c05a8f278a2daff13951b6d28086db71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771926, "uuid": "f735100a-02e7-4b4a-93ae-3740e6a07580", "comment": "Malware payload (Formbook)", "value": "7eed70a38e8c921cf31724a26bc31f1374f2a73cddf43286c104f8703885bebb8d5999e6257c1fc1e139918b3f6879f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771926, "uuid": "9b698437-4d59-4062-b8a1-e6c6631d79a1", "value": "T1AD34126CBAD1A49BE4B145712D7BEF65D6B79150076B110FF3B42F3E2A212C352AB083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771926, "uuid": "ec0dcf77-e078-4643-baad-74c20ba1217a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771926, "uuid": "364398a1-8bfb-4bd1-b8c0-b5d0779fd370", "value": "6144:8Qq+IGFhnXKFr8vVAaxT2vB9ROr2USDFI4QCv0S:TIchnXKp8dNxavTRZxhlQCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771926, "uuid": "946f8a00-c59f-4bd2-9508-be0b3807f037", "value": 246034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771926, "uuid": "5d3c0dc3-e717-41be-9bba-c9202584ffd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771926, "uuid": "eba3c69a-9e11-4d2b-93f7-4801bd7b2c6e", "value": "COMMANDE2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156b1c33-ba23-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1649742038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742038, "uuid": "2a0e7ff1-a305-42fe-86b9-0edb75220225", "comment": "Malware payload (DBatLoader)", "value": "38d9317afff9aa504f020a2f04852f5d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742038, "uuid": "5665d9ec-b2c5-43f6-a00f-6258471c0916", "comment": "Malware payload (DBatLoader)", "value": "c130e105a03b4d144a63a8be13f6c84aa4bb01df2a566756e022e79bec487c20", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742038, "uuid": "72fc742b-dcc1-48fe-9a2d-ff751e7c6912", "comment": "Malware payload (DBatLoader)", "value": "2a3b387e98507f93e84fdd201ff8cb03ebdc773e", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742038, "uuid": "1d220ced-efa0-4c32-85be-5d4ae4f14ff9", "comment": "Malware payload (DBatLoader)", "value": "716fb01dd07278458767880c6fd55ae898fef35d6d06445a747f944d505ef09fd99554c3f1aa64c107afe7f317cc1100", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742038, "uuid": "8e1cae23-8e5d-4126-970b-4759d946abfa", "value": "T17FF4AFA1E3914A33E6365BB9AC0B539868257F235E1C60573AD46E4D2FB63C23C2D0D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742038, "uuid": "aa0b6f28-8c42-4be4-8844-6bb40e3c1047", "value": "f5af06b48508a958fdb1d6d005cd1777", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742038, "uuid": "83a305ed-e6c5-4323-bd46-a1c98640e8cb", "value": "12288:4aD3MI91lcG+3jKWthBdrRvq3V1uzMJ7MpxBxh2lZec4qO:LjMSP+3jKWthPrRQHuzMJ7Mpxolb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649742038, "uuid": "73357822-6b2a-4a9a-8a82-2b0cf3510cd8", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649742038, "uuid": "a14aad42-36d0-4794-b73c-f9caa622c9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742038, "uuid": "f9e0f98c-9c02-4ea5-b124-9ca21ab113ba", "value": "OCBC TT USD 34,890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b555f931-baa0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649795994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649795994, "uuid": "7d16ce90-f95d-4dca-b8ae-8c149e0fc82f", "comment": "Malware payload", "value": "5226b7138f4dd1dbb9f6953bd75a320b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649795994, "uuid": "0c519b49-30bb-404c-8af2-7003137eff02", "comment": "Malware payload", "value": "c1b8e9d77a6aea4fc7bed4a2a48515aa32a3922859c9091cecf1b5f381a87127", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649795994, "uuid": "6cd9a731-c965-4ce9-8af8-6d77fcd45e86", "comment": "Malware payload", "value": "6c87ca630c294773ab760d88587667f26e0213a3", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649795994, "uuid": "e84c0bd6-27f3-4539-9232-f8a8b19f16ac", "comment": "Malware payload", "value": "523266efc85ef6fa27ae64924565c961a4d2226a21e1c8046ecda790838402242cd6030efec4f40f132cd8b60af1c509", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649795994, "uuid": "ec27b4b0-9d51-41b7-89eb-7f873d9fb2f1", "value": "T1DF9533C1581D9F7CBD4C197CC2AA0296861AB0F8CDDAA163456B34E23F34F05EDBB985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649795994, "uuid": "3a73b7a1-94a3-4ec0-bc79-92d217ea6167", "value": "49152:Or7Yrjdq/Zr///XnaSc12bxdk/JSSlwbGaN8B:mijURrn/Z9xqSvGaNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649795994, "uuid": "f4b464d7-6220-48fe-839a-fac3e8c1bc21", "value": 1972149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649795994, "uuid": "d5caa073-d079-413f-ba21-d710302cb848", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649795994, "uuid": "d33b53ee-995f-4372-8052-9ff5b042d6c1", "value": "BC_invoice_Report_CORP_46.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d592f8b3-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649765983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765983, "uuid": "c35613ad-062e-4691-950d-dcc46da7b1be", "comment": "Malware payload (AgentTesla)", "value": "66112cc2d46576767ecc35391a93a380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765983, "uuid": "c0c70a6a-8161-42f5-ab35-ca5924b8f1ed", "comment": "Malware payload (AgentTesla)", "value": "c1cdac134522476c58751ba50a02ea6028e46b921ca8da59efef08ffc555fc2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765983, "uuid": "37633801-924e-429f-8a49-48968a37b2ef", "comment": "Malware payload (AgentTesla)", "value": "5f97f3731439314ed1f1a62bdbaed0dfedbfa854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765983, "uuid": "1286d45d-0c14-4852-877b-118de3d69c8a", "comment": "Malware payload (AgentTesla)", "value": "9464a7b83c3ec77cb750295d2ea1d582465632d1cba3f154b23ac3f86bea96c8c27852f3ff6d339f545f9f28fbbe26ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765983, "uuid": "8901465b-f632-4dd7-a4ec-db1bff459cb0", "value": "T14F050150E6ECBDD2D81A83F89C21E50827A6B72B646CDB057DF3B4DA50B27C214A5D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765983, "uuid": "bc18130b-2e28-4dad-9874-b305d1f04fe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765983, "uuid": "fd8dabe3-e58a-40f7-89f8-1af80c5b0fac", "value": "24576:NpdB7xwCfHLGIF5whaXeoCoLBBhmiIlxDrDoxC:/xw4n4haXjnBhmiIXrDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765983, "uuid": "46d5800a-03d6-4c32-a9b0-5c93dfaccc5e", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765983, "uuid": "2282be88-7a79-44ff-ba6c-e5907bd7ce70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765983, "uuid": "d5a50a89-3984-471f-9c50-534207eb9a45", "value": "dhl_doc1755860002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a89bc85-ba64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649770045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770045, "uuid": "6bd451cb-853b-4d88-b456-cc29fab15e1b", "comment": "Malware payload (Mirai)", "value": "3254d364ff55514160095835e44f27c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770045, "uuid": "29587721-a804-4f04-9dbc-cd1a33eac256", "comment": "Malware payload (Mirai)", "value": "c1d18b0bc7a391027c63288657257b76ae87c872e6188e88e133aa91745f58f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770045, "uuid": "97f7b665-e9a1-4d6d-8c64-f73428987741", "comment": "Malware payload (Mirai)", "value": "1482834b098e4230673a0c2b418fae5ea7942210", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770045, "uuid": "a99958bc-236a-484c-94ab-15688ae5c8e6", "comment": "Malware payload (Mirai)", "value": "ba8b21f34414dc92f036f65f27a959db4689c8ae9e86bbf3002a2476b6c3295742c1b97132441c06a530effe47717430", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770045, "uuid": "9afb3468-435c-405d-907d-4f4996af1219", "value": "T1D2338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770045, "uuid": "88bee361-ebd3-4c18-9836-fa273dca1b3d", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCv/:jaQFwtOGBvQXxfs3kgCJt/qMF/RCv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770045, "uuid": "41c59bd2-d157-4f09-bfe6-3340aa82a1f5", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770045, "uuid": "cd09f7b5-9acd-4345-9c77-f9ce5ff0de53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770045, "uuid": "92af6e80-f407-4d33-8263-b0aef5f05f18", "value": "3254d364ff55514160095835e44f27c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51a4e77-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764318, "uuid": "450ef6d8-6e61-4288-af55-404386aa794a", "comment": "Malware payload (Loki)", "value": "9f47ed2df51c03e66997ac955a2da394", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764318, "uuid": "34467193-7248-4e9d-9e52-da50e4b7ca04", "comment": "Malware payload (Loki)", "value": "c33a65ad800583e276f909c5daac76f07b456ce5e2f6a08cd57ab6b96baa9c36", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764318, "uuid": "383282e2-14c7-4c8f-accb-13bca454402b", "comment": "Malware payload (Loki)", "value": "811e7f553ebf7a223a3364a37e6bc357eb61d4d9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764318, "uuid": "40425073-9b61-4193-bb1f-bca4fe04ffce", "comment": "Malware payload (Loki)", "value": "894c56f1b3b57697452b5f3c5c52b76ed6a308dd3e7a4a7fb72d64fbb36fa5c12673377dc75b1c1cb9e4a48450ff9558", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764318, "uuid": "b6bea268-7023-43c7-967a-9bcba81f2f43", "value": "T17C7412A472DFBFC2E31711B86C562F0D62B6EC4B235BA50DE144322FD2B5521E6631A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764318, "uuid": "a51d43c3-6358-4057-a88a-e27797ae7224", "value": "6144:ohOa8c6JlDzy/Cm7zHZ2raxs+bZRY1n6ceDGR+Wg4Y/9K1Yy2U51cWj8jvVfe:o0a8c6/8YaSwOJe6gWpU9QCc1cWUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764318, "uuid": "9e4f26af-2353-4af1-be40-a91025f5205d", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764318, "uuid": "721b1543-ba2a-4b29-819f-e2fdbd3701ac", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764318, "uuid": "d93cfd92-4089-4b44-813a-d71352628e6c", "value": "INVPO201_8610873241.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f069fdc2-baaa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649800388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800388, "uuid": "89fd90f3-3566-4473-93cd-130f441063b6", "comment": "Malware payload", "value": "b282f1d936849a7394b9a60ad41c51fc", "object_relation": "md5", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800388, "uuid": "1ede36bc-b3b8-4fa0-963f-9f8664e5ed2f", "comment": "Malware payload", "value": "c3d9164abc1c4ed6a45415ccebe55dc61a07cedecabce644d4dabdb419bcfe66", "object_relation": "sha256", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800388, "uuid": "3e611a43-a83f-4880-bc6d-d6d5ee6f9151", "comment": "Malware payload", "value": "a31a4b408cf621a260df98e0b05663bbbed76c3d", "object_relation": "sha1", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800388, "uuid": "d5de1608-b6c8-49d5-80bd-f75d899b83ed", "comment": "Malware payload", "value": "e9e0b8480e9eb3b8e886722a5896eefa574d37ef5900b0f4d89e8d92120348179b0964e85f320f927af89d122cc19e98", "object_relation": "sha3-384", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800388, "uuid": "dd11ad2d-f664-4aca-a39f-fe3c766d5e7b", "value": "T1FC83F84B9759433B0EDA4353674E62A3AFB5807C83A61239548EC15C33CA969E3FB8D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800388, "uuid": "0f5f9064-fd70-45a0-a89c-8273bfd757f5", "value": "1536:KuNDrNsomMpsS77PwsjOiEdmEPUmXsB3RUN46Iuwlj1D+GSOL/7n7T6:BrNsomM1PwsjMcB3RUN46ILJ9+GSOL/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800388, "uuid": "4902fb30-2426-402a-a227-af431fca3bd5", "value": 84792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800388, "uuid": "43991819-7151-405e-9078-682e4b9db0f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800388, "uuid": "825aa6c7-e638-4b61-832e-d440b85e5070", "value": "ousaban-decoded.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d4dce-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (DanaBot)", "timestamp": 1649767486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767486, "uuid": "3c512395-b97e-4220-b539-d30d1f98080b", "comment": "Malware payload (DanaBot)", "value": "448e479874a145608483ddeba7d1d06d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767486, "uuid": "27814f26-a5bd-4f41-81a6-bb88b4645849", "comment": "Malware payload (DanaBot)", "value": "c486771dcbb6548bbec5bfaf8de3bc0b8e3d8ddf6aa2cd5a0bd0bd4c638839c5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767486, "uuid": "04be7920-18c4-4afd-a637-9baa6daff03c", "comment": "Malware payload (DanaBot)", "value": "8cfc0ad5458037c393cdba199d243b0f16c8c7bd", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767486, "uuid": "1d927e8f-635c-46ad-ac68-a4a02762c443", "comment": "Malware payload (DanaBot)", "value": "80d880cbdae69dacd57890e2a22117ba1330b5e7c85a643c6dd79f7ec9da339f56ab1c537c2cd296d3fa760b290481f4", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767486, "uuid": "22c3f9b8-6c07-4467-9938-e3d97b01157c", "value": "T10D557F22B2C8F53ED4E90B3A4967A644543F7B31B6559C2F57E048CCCE292C01A7976F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767486, "uuid": "80d02610-50ae-4f51-9e59-2d21c117d129", "value": "f9e81afd2870aaecd8ace36b2893b1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767486, "uuid": "2993a5a2-d374-4f48-a960-e6b94783f9cf", "value": "24576:kcF2VtrZmrDEtLk7Kd/FFdf+BawXHvJbSc9W0uTR7McbtV:HzyFJ+3Sc9W0uT5Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767486, "uuid": "93dd28fe-4d37-47ec-b2ff-fba34c59c8b2", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767486, "uuid": "6b277bc2-d12b-41c1-843a-7b0c5089a192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767486, "uuid": "a3afe630-6ff0-4575-a8d5-b4f1be2fe8a6", "value": "44.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c3ba10-baa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649797207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797207, "uuid": "2cdf86ca-c97e-4de0-b37d-61dd68429e7d", "comment": "Malware payload (Mirai)", "value": "c03cc808578b72bb79abb68d7148305b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797207, "uuid": "d162f9ca-bb6f-465f-a420-bd9a6cc3f4f6", "comment": "Malware payload (Mirai)", "value": "c53247fffd7226e0f73be6cf60f32bad893dc1fe9a9c5af4a6fb6ec0d8501ecf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797207, "uuid": "0b9e5ce0-666d-41d4-bdc3-5ea75dd738aa", "comment": "Malware payload (Mirai)", "value": "1ce3235f1f12ac9544cb3aa1f467c9f4525f3615", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649797207, "uuid": "8c9858f6-da0d-47e3-85b2-0510bb3accca", "comment": "Malware payload (Mirai)", "value": "680a194333d3d6bb9f26e079b0025402b4187747aef73708b3ecec36f1f6ff7f8d790910b7948d39af6b5b97cab0c0e8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797207, "uuid": "778b1b03-148f-40aa-b520-32bed321c3c6", "value": "T1D3437DC5F603E9F5DC0279743077EF329E72E4FA1159DE87D3A49632AC42602A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797207, "uuid": "037a7842-1fc2-416e-9c81-947c0ff8d80e", "value": "1536:KTamld2bIu1xOmx5OvsO3hiMTmH63LEJJJJJJJJJJJJJJ+BJJJJJJoJJdJHLiD:wEbIubFOk0hVCHkEJJJJJJJJJJJJJJ+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649797207, "uuid": "7adb6d5f-b36c-4a96-b00e-ce42f34f3758", "value": 59604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649797207, "uuid": "f970f57d-2e63-444c-b0bb-29e2b7b47772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649797207, "uuid": "57b4cc76-1695-469b-b0b2-1d027c4d5602", "value": "a1mb0t.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce4ba5e-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736414, "uuid": "bc739ab3-62d5-4125-a60d-950e1279d733", "comment": "Malware payload (Mirai)", "value": "5d9b6b912206ac7b68f909c0f5983fe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736414, "uuid": "ec4c3b9a-67f4-43bf-82f9-5726cbab27c6", "comment": "Malware payload (Mirai)", "value": "c56850f26f89cc3d9e2309688b517eccc2e557ec9f3f99c63b9f19f48935e664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736414, "uuid": "5b235ae8-8e2f-4237-ad68-a601a11edb7b", "comment": "Malware payload (Mirai)", "value": "d51a9cd8e1bcb865fc9d1bfe513502bfadb24b68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736414, "uuid": "35477019-96b3-4e36-867e-64daf48f729e", "comment": "Malware payload (Mirai)", "value": "deec81982ee1c2f86034898b8dfa997779645aeaa1824c887e99da795f7a2d08c9a4d61b90f90b7aa37f7958f77c78da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736414, "uuid": "cf531fdb-b288-4001-b77e-8812cce6e97b", "value": "T124D2D0A2E1314DC7ECEFA87119EB93D1236D0F8953428BA630D9CB60585592BA71A8D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736414, "uuid": "44f98501-a8f1-4f35-8ebc-15c35d994ea4", "value": "768:/0BkuxttehbRqUPduCjPG0SqrYcL2x0pF6N4uVcqgw09Q:/tuAt3duG5UcL2ypF6N4u+qgw09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736414, "uuid": "3d9b1abb-f9b6-42d8-9094-b89578350d76", "value": 28732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736414, "uuid": "1942a27d-2adc-4f83-bb95-431c46198af6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736414, "uuid": "bdd2c3b6-34b4-4bca-9fd0-4854b69c5028", "value": "5d9b6b912206ac7b68f909c0f5983fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052b1563-ba81-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649782384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782384, "uuid": "7e12f57e-bb1f-44f0-9eee-155ba86d111b", "comment": "Malware payload (AgentTesla)", "value": "4c23354afbd9b66c36c8b57ab9e25c57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782384, "uuid": "0704ea3d-cbee-4dbd-9c53-dfe9bd3dbe8a", "comment": "Malware payload (AgentTesla)", "value": "c5696aa6fc5625e101276e0e58e34d0135474e47e2c9f3007a0e1fccf4375c2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782384, "uuid": "71f7e699-e05a-49d8-b9da-0364dcf3d033", "comment": "Malware payload (AgentTesla)", "value": "87b9e401b08241b9748ca47875f352613ffeb3f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649782384, "uuid": "a6a1dbd7-5615-48b5-a38e-3e354983eeba", "comment": "Malware payload (AgentTesla)", "value": "cd8a3c7dd8b00232a06595523f7c944f477c9f6bc4f69b419bc7d8978316e22638837ce8f6f0771b9c018d2a4cad2f14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782384, "uuid": "9f633a8e-02ba-41b5-9d2a-cf81238310ca", "value": "T1D5D4E120F1A86BA5E46607F55C34A14407B6BB1EB53DC61C2CB670CF9973BC36622E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782384, "uuid": "7af91712-a2f1-407b-88be-92aa3700af8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782384, "uuid": "a4eb78fe-a450-4a37-bf84-c080186869ec", "value": "12288:nr3R4qik2IZlztUw8ckTJKRlBMPaRNUUi1aOT5y2fjI/andQo3YFR:nreqiTIv8lkRACRNUzhLr4andQo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649782384, "uuid": "42fc62c1-5c8e-47bc-8f93-afe4c29abee3", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649782384, "uuid": "be803b74-2c30-4bfe-b387-45c734fbcd5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649782384, "uuid": "5ef52e34-37b2-4c04-aed9-09faa21445bb", "value": "KUR-117039_Scan_Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af267799-ba0d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649732847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732847, "uuid": "e30b936e-58fd-47ec-b75f-c07d6d8f2db6", "comment": "Malware payload (Formbook)", "value": "4ee5092b9754cb89bc81a6ab8c07e4da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732847, "uuid": "18f64a20-0f81-453b-950c-6c24e3998814", "comment": "Malware payload (Formbook)", "value": "c663442ba07c72d93cbf098eadfe1475b7bc470e361c1736ab2b457a57f2cf94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732847, "uuid": "43f5a47e-eeef-44fd-a5e2-dd563159afcf", "comment": "Malware payload (Formbook)", "value": "c40e503a8f4eab1ffd9305ce3e01116f6c699674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732847, "uuid": "c33ed8b7-751a-4e5a-91c1-b89c52312af3", "comment": "Malware payload (Formbook)", "value": "e29d4520deeb53bfd9ea4f732ac65af571ba935223a327edaa9599fdeeb752b59c6a1f5df82e96b4fc2f56fb3ce5d1ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732847, "uuid": "384cc008-ac21-499c-a888-61d8627a825a", "value": "T15734129F50D13CFBEE4A0EB15833AAE4D3BB67159428650B2F905F171E323D3E50A286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732847, "uuid": "21932e42-3d4a-4dc0-9684-d12b05159d69", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732847, "uuid": "fa573633-a8f1-4af6-b388-6c11b0e42f27", "value": "6144:8Qq+xA7cIae69pB6aIA+eMQlgw1a8U69cNKmgZKOlz:TxXu69pB6HA+zh6sbgNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732847, "uuid": "3137931e-550a-4621-85e5-bad47f4a8190", "value": 243008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732847, "uuid": "42b5b055-809b-493f-9839-5a972450d7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732847, "uuid": "187cba51-d6d5-4eae-95f8-cf01c3bcfc83", "value": "order 22HJBX1151FRR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1779cd25-ba32-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649748484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748484, "uuid": "9517513c-6578-4577-bb68-4f96237f6136", "comment": "Malware payload (AgentTesla)", "value": "e5f65dd6113457e32785b6fa2e51f8c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748484, "uuid": "6d381075-1a6f-46ef-8457-f76134c5aae0", "comment": "Malware payload (AgentTesla)", "value": "c6ff749cc548d7992cc923ce9a46429e45020fcf6990896db00ed0547f30d295", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748484, "uuid": "951fe025-cb26-42d8-ba89-9bb6e04ad3eb", "comment": "Malware payload (AgentTesla)", "value": "601b88c1c3f00ff3f12c5dcfe1ea8d4f0afff611", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748484, "uuid": "f954df5b-2ffc-4320-b0ce-8a24ae4daadd", "comment": "Malware payload (AgentTesla)", "value": "5308a2bf367b56c65c8b22213e03992957daf9530c3c2733bb45709956433e705a3d665095d8f1d0ef4a218d2c2346db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748484, "uuid": "cf547f47-f4b5-4ab9-8313-533037432c18", "value": "T101350277AB66DE53CEFC827C04217FC6A2E182239257D74EBCCC51A9B3826D94B051C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748484, "uuid": "cb1f3b63-8128-46f0-8e13-e1960db2a92c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748484, "uuid": "42c5fd28-83d4-494c-a3f0-9d1c66db1480", "value": "24576:ndBqCebfeuXVgOnZTgwzhBY/ksIGLE4lvhcm9Rn:ndBqCafeEVVZTgQhBY/tjDvhc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649748484, "uuid": "335cc3d0-0a42-4b8c-91e5-39788e1f7bae", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649748484, "uuid": "28b8b895-8014-4897-858b-a1a858e4a306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748484, "uuid": "a49d9561-44b4-45ee-b856-0b137ebe8ebc", "value": "SHIPPING ADVICE#DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e84a06-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793329, "uuid": "a163bdbd-1a39-491f-ad99-b05f56e28476", "comment": "Malware payload", "value": "c5034f3fcb4946b2caa5276c8e1e1a77", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793329, "uuid": "9be2ea90-f71f-4482-a5bd-e91d45b5b502", "comment": "Malware payload", "value": "c7163730589c30ce59773345558a7747a019e5228ce1760b46f89fc73f52db11", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793329, "uuid": "6a3a147a-e5dc-479d-aaa9-4d90c68aa7a5", "comment": "Malware payload", "value": "3eef60d78db776670c21eb99d80153387a41fb4c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793329, "uuid": "a47905ab-9e92-4446-bcb6-a5106caba1dd", "comment": "Malware payload", "value": "467d3a53b73966df7f6d393cb50d52dab7cab95a9c7ed438529c9f0041c0ab5686c51c7581507ca789888a3fb9fb9d78", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793329, "uuid": "43550627-1a74-4396-841f-4b2e10609c2f", "value": "T18B24239FF0D8EC7ACD630036E6F086BAF81417026193B2392DD456DD2945F9F7285A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793329, "uuid": "9f77526a-8814-4938-b62c-be7d66cab161", "value": "3072:vewiPdRVw7xCsN4SOkxY8Zu9gJDPMzxh6JcuB/reRTSI/oFPF326azJ3y/jcg:LiPddZVuY9GJDPoWJZ/oPKxmzJ3qcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793329, "uuid": "74012382-aa4f-456a-955a-ed2cc294d7c3", "value": 215014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793329, "uuid": "dff37dfd-df86-43da-992f-e0aca392b8a2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793329, "uuid": "7acf6190-13d7-45ee-b457-ede6df688d92", "value": "spreadsheet.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99b2d2f-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1649765963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765963, "uuid": "83375380-da53-40c5-a694-ed01aa58721d", "comment": "Malware payload (FormBook)", "value": "42f2c63ef48f61b667742768a66f32aa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765963, "uuid": "be2be700-c85c-49f7-a09a-61535d38f65c", "comment": "Malware payload (FormBook)", "value": "c73ddd4b47e7691c3655bb1aa5ac034368f865fbc40c22b20c6ab774cb23dd31", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765963, "uuid": "4f783090-5bb5-44e4-bdf9-e3e01813cea5", "comment": "Malware payload (FormBook)", "value": "e5e96aa9ecea654c89980538be63f07b070682db", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765963, "uuid": "51105c4c-2c9a-4a56-80ab-bbae72a07be0", "comment": "Malware payload (FormBook)", "value": "ddde94c9504ae45459b6080439a638cd5bdcad247eba69779fbf56a9dd3653f1e701c2f7a187b58b6b8b92d3c08254b0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765963, "uuid": "4aba1c08-ce98-4089-9b5c-533eadb7ab2c", "value": "T1B7E49E12B2B14F33CA3B2A7D4D0B579965277E136E18A2973AC05E4D7F751C0392B2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765963, "uuid": "2800eec3-cd6d-4c2d-9fcb-392f75453225", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765963, "uuid": "c24711b1-fa6e-4e6e-bb8e-635b2dd9b89b", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2vZec4qO:wkKHuoE+/vI0icJskvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765963, "uuid": "572fa6e2-97fc-45dd-ad4f-3518d7db2e94", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765963, "uuid": "c393e7a2-63b6-4648-b8ed-c18e035ccabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765963, "uuid": "e773e6d7-067d-43d4-9451-1bcac5adbd0c", "value": "DHL_April 2022 at 12.N_9B7290_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13c3d4d-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649766003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766003, "uuid": "7d90086c-0da8-4568-b141-52d613eadef7", "comment": "Malware payload (Formbook)", "value": "1704cbbf55f8851401b3e3797a0ec152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766003, "uuid": "00e20fc2-2e87-4b5e-a8e9-57282668410e", "comment": "Malware payload (Formbook)", "value": "c767db1d9bb5f369f3a2d395412c98f71de29cf829800a2494a2c0dec8e4a57f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766003, "uuid": "453d5106-1df5-4997-8962-820fcda9cbe1", "comment": "Malware payload (Formbook)", "value": "10b1e8f12b6e29b4212496cd78c7e0df508baad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766003, "uuid": "748acbdd-c4ab-4e21-ad61-c1a08669f839", "comment": "Malware payload (Formbook)", "value": "fc20c2376b3ec268f12fdced860bdf78a174afb8c9a4ff265512cbaf1a79b1fdf6eb4c78e86947108a141cf59384ee55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766003, "uuid": "b71c24cf-6539-4723-91c4-7cc87faa9776", "value": "T1F034121D31E059F7E5A21B723BBAC728C6BB8221773206573FB15E6B9A131C79001787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766003, "uuid": "0c2e01e0-b0fe-4927-baa8-86ec8d437db8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766003, "uuid": "9cc62ccf-384f-431a-bc49-b0c75fad372e", "value": "6144:8Qq+9+zqG3sXuWhZgwA/j8HbThNBk23tuVrl:T9+zqOsA/jCLG2duX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766003, "uuid": "9abaa521-44be-4fec-9c23-484e2a18f1f8", "value": 239883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766003, "uuid": "d7ead4fd-94d0-49cb-addf-edbde1e18a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766003, "uuid": "0f3e6eb6-4548-4645-838e-1762f89583d3", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15605c75-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793148, "uuid": "641d88ab-6b47-41a2-b173-9bf559dbfe58", "comment": "Malware payload", "value": "bbba9e402c07e9895f3eaa0536533e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793148, "uuid": "2c5ec3ab-6e43-4380-84a8-fa5dd3d59a30", "comment": "Malware payload", "value": "c78548ec4c057ec22c4512f04bbe60229cd805f3f8a1a0e9b0acaa7b041805fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793148, "uuid": "e2d978a1-ad42-46e7-ac8c-03edcbb1fe2a", "comment": "Malware payload", "value": "54262800d704c2db0b7c816f70498d9567c575b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793148, "uuid": "80958038-f90a-4451-a003-a6c170a43bed", "comment": "Malware payload", "value": "06282e8b9c792ae01e7d3e0b587937f7050f80f853a00a2b244591a790f24650af357152b10927681026544bffd72543", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793148, "uuid": "e2ac7a05-f060-41ed-8dbc-46b241296f26", "value": "T1944422FCEA46E1B3A93107BE704826E5019CE5DE41BE3625E35EE086D236183EC85E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793148, "uuid": "259d8a3c-b8d0-4c40-8334-4d4127e48f77", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCnSgmQ/mqY5:mZRgUY/fsJcO1KOiXe+Qe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793148, "uuid": "e574339f-e474-45fa-9285-4fa774004215", "value": 253397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793148, "uuid": "f8365b2a-6940-4813-b752-43d5de3acd2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793148, "uuid": "d7acc085-1e58-4f09-9271-9eaafd42dfbb", "value": "i386-xor-1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6a91d5-ba33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749031, "uuid": "c64c1041-e6c6-4871-a43b-a5019dba881e", "comment": "Malware payload (Mirai)", "value": "f83f373a986541f2dae29d71028a6729", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749031, "uuid": "13dec43b-f85f-4680-bc31-5ed9a036a3d1", "comment": "Malware payload (Mirai)", "value": "c7fe23873f7c93ff90c3bbe80243a667b35671c86f87f8b0e3efd3bc0bcb5ce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749031, "uuid": "77874b5d-f158-40be-a5b8-420798cfbc73", "comment": "Malware payload (Mirai)", "value": "97c6ee740cf5684d2c279188d1c57cf28514d36c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749031, "uuid": "f1cad9b3-8070-4b0e-8b32-b7fda367765a", "comment": "Malware payload (Mirai)", "value": "b8e4c7b433a642727d59986391806c4161cb5d7342d6e602bf97bfe547d5618b16991dc59562e7a5d9101b24e7dc4b12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749031, "uuid": "97935729-ce94-41f7-b346-538ac914223a", "value": "T1C4237D77C8A91DC4D7968574A12CCA3A1733D418A29B1EFA1A07C579A00BFECF1093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749031, "uuid": "80cbbe40-cf86-4214-bb00-ba234a752554", "value": "768:ya6Z21e8m0fzVhb1VQLsCWuWo3Zm9zMCYAusu/:ya6ghDzVhb1V7op30wCYBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749031, "uuid": "dbdf8a45-2379-4cd1-9c24-bbc91dddde06", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749031, "uuid": "5b32556c-f8ab-4f28-ac2b-9c6d6ebac530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749031, "uuid": "a8279462-cc4c-4fce-8410-68460fa1d3be", "value": "f83f373a986541f2dae29d71028a6729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d507448b-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767700, "uuid": "62ab2644-fcb9-40c2-9b8d-5320dfaf46c9", "comment": "Malware payload", "value": "1ee698fda9ddad43c55348323f023bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767700, "uuid": "a4ceb3f4-f033-4fc8-8f71-692da8e6fc86", "comment": "Malware payload", "value": "c8906b045ca5733129e92f9e5b97e654ee0b321b1323b316866de4e8c976a601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767700, "uuid": "3d10b79b-ac7e-4895-a686-5fe0306d8eb9", "comment": "Malware payload", "value": "8732be7921c655c9a9d2ed73c3abdea27b1380e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767700, "uuid": "52364956-ac33-439b-98f2-7dd4e224f05f", "comment": "Malware payload", "value": "3efc0f502e5c03356f1d596e423404154bed75c6d20aca6c4f84d86aa46aa2323740d29d89c47dd28540d1de446345c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767700, "uuid": "2c67b5de-065b-44f3-8d97-7246ddd9a263", "value": "T19CC5F19984041E09CC49F57746852306736E2BAC340A6B6BB464F27FFDEF2C96B434E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767700, "uuid": "08bec4a0-41fa-4627-b3e6-cd96ddcbc887", "value": "49152:KMIA/f0R+cffMYAVpVOupWXuxrQSsryV1wI0bIy03jU414nBT:K0nC0jVmw8SsrQwjZ0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767700, "uuid": "e59be696-5d9c-4a95-b2b1-1890bb01513b", "value": 2510188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767700, "uuid": "8973e942-af14-45d5-8fc5-2827cea16f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767700, "uuid": "f5b9353e-b7c1-44c0-9d20-8aa4765c22a6", "value": "1ee698fda9ddad43c55348323f023bda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8b134c-ba33-11ec-8e58-42010a9c0032", "comment": "Malware payload (LoaderBot)", "timestamp": 1649749056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749056, "uuid": "060c6216-fba8-44bf-8733-2ed770c2d52c", "comment": "Malware payload (LoaderBot)", "value": "bcaaf37e0beb6717d01b175e6bc78c44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749056, "uuid": "6df65941-b9f4-46f9-a168-f5289caa51e2", "comment": "Malware payload (LoaderBot)", "value": "c8da163b0c84637e8e40fb15add10d77ef3853af773f88bec56ff5a03c40e5ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749056, "uuid": "0313e4aa-df2e-4bdc-81d1-bf64cb696182", "comment": "Malware payload (LoaderBot)", "value": "6ed8bd63cca483dd9e8bd742fd79d76bc87beccc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749056, "uuid": "1dd6483a-6380-497b-ad1e-5804e61a8197", "comment": "Malware payload (LoaderBot)", "value": "bc876fb14b749df4f1c33b9bb361c7b38ee2a909e4de78d5f662c27a0f003eef268bf60443b5cfccd60ebb4ff837553f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749056, "uuid": "03fef9c7-aea1-4cbc-97cb-37d8c62e461b", "value": "T15406D0A1B51A9F98DE5A8BF009664220133F7D0D55ADD10D38DB3EAF76B33032251E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749056, "uuid": "fe60c91c-31a0-4210-8088-b9a607caaa07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749056, "uuid": "64a493b0-c8e3-47f2-a051-10b689371cb2", "value": "6144:HaM42OlP2GhNTi2BsCx1wsWO34xrxafUA5VyNmMpHXrvObETLiEAmg+f:Q2iNTbnWvrxasAWEsyb1EAmDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749056, "uuid": "0cab6d25-9a0d-479e-8496-5692574d978a", "value": 4008024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749056, "uuid": "5911827e-42d0-434b-ad72-820ddfaf11dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749056, "uuid": "edb07921-91ec-43cc-95d2-08d37db4a2c4", "value": "bcaaf37e0beb6717d01b175e6bc78c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bfdb26-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649741933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741933, "uuid": "ec1bf719-2921-430b-96d9-79a8630ae418", "comment": "Malware payload (SnakeKeylogger)", "value": "61f4e37e8b891c3015a1f93f5861633e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741933, "uuid": "c8edcb50-1e52-4133-aca0-8ba8c55fe029", "comment": "Malware payload (SnakeKeylogger)", "value": "c96a9145c81f5055717e5b397009f6e7ebb78558328daf06566d9494e6171d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741933, "uuid": "173f62a2-c706-42ba-b474-c9196ac005dc", "comment": "Malware payload (SnakeKeylogger)", "value": "06c97e8d4a15c37fab4e6ebff59974580c7ac55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741933, "uuid": "5eb64869-4e65-4c6d-9d2e-9aab50d7e31a", "comment": "Malware payload (SnakeKeylogger)", "value": "823945632f1acdcc45585e395a990329f80db9384ec25b8bf73e80c815cb73627847dc0d84fb1cba2322d0dff7400d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741933, "uuid": "3a8e7a40-866a-40e9-8257-f56c14736030", "value": "T1B5154CD1F194889AE96F0AF1BC3A553015E3BE5D54A4820C5699BB1B3AF3342209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741933, "uuid": "55758faa-314e-4247-9a61-e5749f5f032e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741933, "uuid": "8a7b7b3e-0a8c-4553-85d0-361c9ccbf224", "value": "12288:vkKUk6d1B4qSF0iAlc18vnj+z+lxVRS8A0yqCP3K7ds6mgVgz:vkKX6d1eqFq1cnFANPP3K1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741933, "uuid": "f60c04ee-7a4c-4fbc-8c85-629112c68973", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741933, "uuid": "79d21486-3624-461b-b30a-afcb221d1d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741933, "uuid": "61c8287d-b2df-4cc4-80cd-822348a927e4", "value": "SecuriteInfo.com.Scr.Malcodegdn30.17386.11218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da1e026-ba19-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649737811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737811, "uuid": "a389608b-bc28-4a29-a6dc-66770b3d0751", "comment": "Malware payload (SnakeKeylogger)", "value": "506c30ba8c38212a89084d500ceae23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737811, "uuid": "f93f4803-f680-44d0-b393-bbef16f3bc89", "comment": "Malware payload (SnakeKeylogger)", "value": "c980b05670bf5afdf79a65fb6e0f0e2ad6c7bf6833c23870848dcfcac3e1437b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737811, "uuid": "23ca77e4-4e47-4745-8d52-1fac2b9cd9a6", "comment": "Malware payload (SnakeKeylogger)", "value": "a818f801b6302fba30ad46915e31e9e48499a617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649737811, "uuid": "a21d5a99-a586-4c5e-8f94-23a167a1c89e", "comment": "Malware payload (SnakeKeylogger)", "value": "a12bf9b31f8219c0bba0b0d5428f814b188f3ad5755eb04200ef513e36925a8426554e737bf3f70cfc92ba0f4c3b9a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737811, "uuid": "c8a9b68b-7d5d-41eb-a1a5-351eb49a4f8a", "value": "T1EBC4E11576FC8625D6FE07BD9039019087F9732B5826E37D6E02A4CA2D633D0DA43BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737811, "uuid": "7af40695-9283-438e-8eec-0993f15957fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737811, "uuid": "18c85e40-4d59-4d64-89fe-b126b6e312e9", "value": "12288:ekKUk6SQ4qMBhF5noH1EiK6wfiyRX4CgPkXLfTevgVgz:ekKX6SLqMBhFqH1EiK60XodPk7fTzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649737811, "uuid": "5cb8cbb1-8e53-497a-94a8-2dc5402d452f", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649737811, "uuid": "7971c395-f89e-403a-8401-1082d06ef52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649737811, "uuid": "5a1998c5-852c-4dbf-ab0e-43653d3db737", "value": "Purchase Order PO-33908.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec43652f-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764303, "uuid": "af8688a5-9aca-4f22-b984-e6903fdf1275", "comment": "Malware payload", "value": "156b036b3301172e34ebf5a81c58e801", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764303, "uuid": "d4868b87-c116-480b-bba1-a0b5939b93dd", "comment": "Malware payload", "value": "cadac39f81d233701bc127add7efc3ac0cad273c3bdf6fa764540ef1447a18d3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764303, "uuid": "258c95c5-f414-4ff7-b3a7-873159ef50f9", "comment": "Malware payload", "value": "3a7c5c3a5cbcffb48aa02c83d4eebc32436a31b2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764303, "uuid": "c5b7dbf2-0044-41ed-bd6d-5088c7a1cc32", "comment": "Malware payload", "value": "1d428046cb1f48a48b54c266bead692769adc4a9fbace7c4ffa0dfd34359e9d7bd3957d85bf63c95581191cc70c66b40", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764303, "uuid": "a885e9c0-e293-4235-b466-5803184e92c8", "value": "T1EC74234B3560BBA7E095ABF5B5141703CB8EFEAD23902979441A713D4733BEC509AB0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764303, "uuid": "1cc3a47f-22f7-4f7a-b757-c0f225b6036e", "value": "6144:t7oFs+AePju6olOizmNi5yBaHryz+UnCKF2DBnPTIrteEEP3OQcDQtTFi6vyvuW9:t7oFs+bPaLlO6mNiYsyztnfF2DRPT6tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764303, "uuid": "104228a7-164b-4dc2-b2bc-0fd7339384a9", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764303, "uuid": "4420d5a3-663c-4886-86ca-7c8545796f1e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764303, "uuid": "186d176a-7d70-48aa-a07c-96b86e773687", "value": "Po-4774748843.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c971f08-ba64-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649770021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770021, "uuid": "48f8c2c1-2760-44d3-a44c-46b2a64bb664", "comment": "Malware payload (AgentTesla)", "value": "c347eec5c41f58f5b2dd0352f34b0b71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770021, "uuid": "f8f17b8f-2d9c-4f96-b57e-d3de8b9b4f77", "comment": "Malware payload (AgentTesla)", "value": "caf547df46387b2df2669cc740f45af18c8660a2132542bdd9769466947cc43a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770021, "uuid": "ae4767db-3c7f-476a-895b-bc851f892724", "comment": "Malware payload (AgentTesla)", "value": "96ac9f6d4f90b359a3f18d1c37ed09bfec6c9950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770021, "uuid": "fb8e8bc2-ff8a-402c-a84d-266dc3f6a685", "comment": "Malware payload (AgentTesla)", "value": "b7b9c9f552bd0cf1aed22246d118dbdb14a8a9a9e9711c6b2e4ccb717841ba6c7d663b0ac167fb80e588d88f4392d068", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770021, "uuid": "0c88cf7a-94f2-4f65-9da6-7c6792d48949", "value": "T194F4CF09F6A6C822E3E81B77C4D7080413B5AB47D516E36FB692A2E51F133A74D0379B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770021, "uuid": "dd3ea670-4c81-4dce-9e2a-b12048fcae31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770021, "uuid": "cf032af0-0811-4a1a-a905-7f202707a237", "value": "12288:fVr3BTq6y5j4qagVBuAQYzlTuN/HTHzCbsCZQrBYOzBaeg49rbBg6:HTQyq1XLQ4lCNf/PkeZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770021, "uuid": "78c29a23-c226-47f4-a6d1-00e2b0c7ecc5", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770021, "uuid": "d47bebec-bb86-42ad-90f6-b28a60736e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770021, "uuid": "59c6cbad-3cf6-48b2-923a-eeee5588a90f", "value": "wealthzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a158071-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764031, "uuid": "d8feeed4-cf5c-4d74-81ee-387c3b36758a", "comment": "Malware payload (SnakeKeylogger)", "value": "82475cc78d90d50f0602791e45ea9dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764031, "uuid": "fe637a20-197d-4a19-b582-5d3f6fa8f1bf", "comment": "Malware payload (SnakeKeylogger)", "value": "cb945bbfa462a45ae2d9ade1cbd8932080449284a4b56c7a38b8eabc84a20409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764031, "uuid": "77760e99-2fe3-4ed0-be28-915acdc836a3", "comment": "Malware payload (SnakeKeylogger)", "value": "a696e2443fdd1381bd96d9bf8f75b67090a2b6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764031, "uuid": "7ddbce99-51b2-4a77-a4f3-d1bca77504c7", "comment": "Malware payload (SnakeKeylogger)", "value": "7f188928b805d323944943473347973d7e69e046c8d41da8dbdeb3ba0517629516e206d2eec4582a97364da84d7f6e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764031, "uuid": "6395b48e-46f1-46df-832a-7cd108570864", "value": "T1CFC4E0147AFC8625D5BD07BDA074018087F6B62B686AD37D5A05A0EA3D333D08747BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764031, "uuid": "23c222d0-73e8-4893-9461-c870122b9487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764031, "uuid": "3d26929f-4cfe-4f62-8968-e8047bfa9172", "value": "12288:BkKUk67vH4qFPCmMzUJoGmTgSHdxkMrse1j0tiMIez1pCrbyIqJHwgVgz:BkKX6zYqFaxYJ1mTgS9/16iMIeirbyNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764031, "uuid": "7d61cb45-1039-4023-aba7-7c342af462a3", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764031, "uuid": "7a590da1-f15a-481e-b6c6-15ba763dc421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764031, "uuid": "94d6c6fc-c157-41cd-833d-dca3b495cccd", "value": "Revised Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f1c469-ba78-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649778679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778679, "uuid": "254f5803-1d39-4f27-b6fc-f253a86f5ff5", "comment": "Malware payload (Mirai)", "value": "a70b546701abac070a533788133edb86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778679, "uuid": "91c2da24-3e8c-4538-b72b-3cf95a96f1c2", "comment": "Malware payload (Mirai)", "value": "cbf414a8bf2e55f236afadea9f10b68cf2c43231c416a15a10e02b5f24e158c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778679, "uuid": "36d8476b-2132-4c49-b22a-cd0c0d6cdae3", "comment": "Malware payload (Mirai)", "value": "8aa832d7ca5a771bc3f246edacd01c3eaddae577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778679, "uuid": "507d28d8-f85b-4499-b51f-caa3b43acac7", "comment": "Malware payload (Mirai)", "value": "21863ff3703286b2a26f4dd6607b57cc24b6b32c7d342ced324082ff3291f5be552f8500da522e2812723158927aba0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778679, "uuid": "dba65ded-da2d-46af-876c-5ff34f096169", "value": "T18E338E76C42EADD8C6458734B82A4A740FA3E10891E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778679, "uuid": "3956b0f8-366c-4a6d-87a5-29e0cef027c1", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40Zdi/FyGoMuJLk3XCmlolN9aXCxW:EcdC753UlwtNEFyGoMD3X3qlGXCxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778679, "uuid": "3c8ba546-dd77-45c5-8823-57e847c572f7", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778679, "uuid": "c3c3e99a-6fd7-4691-92e7-c1a3d076ba00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778679, "uuid": "30ee3da4-6802-4ac5-9a38-8e5900c40066", "value": "a70b546701abac070a533788133edb86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaef2dd5-ba3e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649753886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753886, "uuid": "fcba4145-95b2-4053-a703-b14bf57a0816", "comment": "Malware payload", "value": "9ec8468dd4a81b0b35c499b31e67375e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ArguePatch", "colour": "#C7BD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753886, "uuid": "521561a0-44f2-4f62-b3df-abf27401eb88", "comment": "Malware payload", "value": "cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ArguePatch", "colour": "#C7BD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753886, "uuid": "7edf813e-2d6f-4aa5-b55c-ef3cefe2d32d", "comment": "Malware payload", "value": "6fa04992c0624c7aa3ca80da6a30e6de91226a16", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ArguePatch", "colour": "#C7BD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753886, "uuid": "0400f7c7-5b32-4747-b574-c80e79ee04ae", "comment": "Malware payload", "value": "fc279088671cabf2fb33942bb7f5b1918d50d86ad5aa8436bca94793b39cdabd6a3a89daec4780454c2f3e4359ac5b5d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ArguePatch", "colour": "#C7BD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753886, "uuid": "f01a0c09-7f31-418c-9d98-9c0888999380", "value": "T17BD48E617693C43AC6A220B00D3DDB6F182DA9650F752CC7A3D8197C2E715E31E36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753886, "uuid": "f302699d-a4a9-46c7-930a-eb67643acd32", "value": "469902c5413cba2b13d3e7d2e63a4cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753886, "uuid": "8705174d-0af8-42be-867a-40dbb9e8cf59", "value": "12288:CpCB9AVqhPDUHvOdO21ai1m2Y+o1mQR5LaVfnkBUxarLIN8Wah5/wodPdv7PVTFe:Cp12UPQkBUO/B5/lzTVTFH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753886, "uuid": "7342470f-29b5-4e8a-98b1-66305eb8f1ef", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753886, "uuid": "5ecbba48-dada-45d7-b4fb-3040e4e98fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753886, "uuid": "bc57c2b8-fad1-4289-a1d8-d73fe677c27d", "value": "cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a03185-ba7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649780286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780286, "uuid": "7a5c7d12-a9eb-4cb2-9be1-86d4b5d59780", "comment": "Malware payload (AgentTesla)", "value": "4c080809f852d499ae1f3193a116cb3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780286, "uuid": "7f489440-905e-4607-ab6b-202b809571b2", "comment": "Malware payload (AgentTesla)", "value": "cdb9bd0b147ba4ccde47a4bd6fa86487350cbf9b0e32ccab4e5fddb124808db8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780286, "uuid": "6e450d02-79e9-40b9-be5c-18369a51f1c0", "comment": "Malware payload (AgentTesla)", "value": "03e46cdbf46630d5c9eeaf19d59c8d54895100d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649780286, "uuid": "85213fa9-8c50-4682-bdb7-fe14e62a41b3", "comment": "Malware payload (AgentTesla)", "value": "78007bef692dd4b4b141ca03085c13b64a9581d79cc36aba4911e1cd3a1cda1cf97288a3f766554a06cfd6dd726214ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780286, "uuid": "95c3ccca-38e9-499f-bc8c-549ea5ae3771", "value": "T108D4F120F2A96BD5D4A603F50C24E54417BABB4A756DC91C2DB770CE99327C32722E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780286, "uuid": "98d173e9-91c5-4c02-997d-e75b09a2aa95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780286, "uuid": "e8daa3fd-0257-4ff9-bbd8-eaa4a3f0a1e1", "value": "12288:shR4qidNr4ZkyJmBbAwgRavkkSmINDEcgr/LVt39qHja/QBhmH:s0qidqREBSPF5GLVaDaMhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649780286, "uuid": "42e88498-04fb-4bbb-95dd-a3c932794b0a", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649780286, "uuid": "3860a134-6d5d-40e8-9932-2dbfa4678663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649780286, "uuid": "c3995176-df71-4769-a793-7a542bd2fb91", "value": "Ht8YRqC6AfIhdlT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7b4ce2-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649766689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766689, "uuid": "5fcbefae-7e00-4a81-85fa-058479a2182f", "comment": "Malware payload (SnakeKeylogger)", "value": "207a140cd2449b22eb30a967c694bfa1", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766689, "uuid": "6eefe8cb-9e7a-452b-b96c-e5f59e7a3f5b", "comment": "Malware payload (SnakeKeylogger)", "value": "cdd0917d044e094cf8f67787668dabaa1a8b3cdbb08859bcec8246df2e3fa6cb", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766689, "uuid": "a0046704-eb69-4a42-ad86-5bb0792e8f90", "comment": "Malware payload (SnakeKeylogger)", "value": "92e4a22e137ad9dc03f8de5e5255ed5263a653d2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766689, "uuid": "1e2d71ea-83dc-4f5b-a9bb-11f2d8723ce0", "comment": "Malware payload (SnakeKeylogger)", "value": "9522cf50a1aa7b63d4482178156686295719b643d45601470283d305a8c3a71522366468ad1823ebcfffd0821f9672fe", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766689, "uuid": "857d5c3c-3c2d-4f59-90a6-1cc7604d1a85", "value": "T19E942300C7D15E2AAD8450F7EF24D7C840E37092A58F2D492B6CB96D70DBC6E916E9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766689, "uuid": "c61ccd2a-41ce-40b7-9901-5e78416ce4ba", "value": "12288:zkXQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8UX:BwarmMSAGMID1R5OtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766689, "uuid": "e7016436-93d8-45af-bc96-82008cf47783", "value": 441469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766689, "uuid": "ccd5fa7c-369d-45be-8a86-968e9fd9c8e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766689, "uuid": "8004aa9b-64b0-44e9-bb55-e7b15186bccf", "value": "74403100002.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f57088b-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649747826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747826, "uuid": "4fe4ef52-ca36-4e92-bfb5-ed80ace88ba1", "comment": "Malware payload", "value": "b4bbcd9cf03852c491da072df4b19f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747826, "uuid": "2f2f5503-d2c3-439f-8e3c-b21a43970cb7", "comment": "Malware payload", "value": "ceb963d0120a17110b1e983e7926f7b15b6142f57d3d62f3d787181d4111f0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747826, "uuid": "6f82cc70-6af9-453a-9db5-487f2afcada9", "comment": "Malware payload", "value": "c47d118881c66a7b3d298973cadd105035fe25ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747826, "uuid": "77266148-38f0-4dbf-9678-5eaa9f5199cd", "comment": "Malware payload", "value": "034b5c3f34c87efeef66306a62a2490afe5ecf9878d1a57ee9bba2ce538e5cea639c8ea6e3cb7e9ee284c16bc8bd3189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747826, "uuid": "a8a813aa-c109-4b83-8419-bdae7d15e75f", "value": "T184A3028E92A4925DDE431538699F381F155FF1999FF009C0A6D9E1FC2D0C70239F6A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747826, "uuid": "6c9a0847-9ac1-44b7-b1c8-801264a8e3d0", "value": "1536:qc5JwFtZRAt0EeZMSlSYU0T43+j6qOKa/WSCsyUFHG9nYnRo+rH:qBFTRiqMf8v6D/WSCsjFakH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747826, "uuid": "fbaa3ab3-46e4-44bc-8b04-86de2afb1f05", "value": 106426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747826, "uuid": "21737775-3f6f-4f22-b7ab-e39956b2be62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747826, "uuid": "608b0b71-e77e-4e8d-84d7-4049fc0155da", "value": "pass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30c9d17-ba4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649759509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759509, "uuid": "f0f17bc6-33a3-4d5a-9d16-928ac5bba32f", "comment": "Malware payload (Gozi)", "value": "b49b83a98efff5f00dba36d77847bed9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759509, "uuid": "8413b5ed-e651-4c55-8d51-4e07328005dc", "comment": "Malware payload (Gozi)", "value": "cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759509, "uuid": "4849a5e7-58ed-47bd-843d-1e033bae68dd", "comment": "Malware payload (Gozi)", "value": "b9b38f4de57d69bf417c9bb06041161ab585f941", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759509, "uuid": "e842ffe3-7efb-4c8e-99b8-7219e8d30b51", "comment": "Malware payload (Gozi)", "value": "42c6708b7a77233699ca776d5f494de9fd4ba169b4327e7ec0defd037da47561aebf9b4eb9c7b5dab6b3e7c269754d27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759509, "uuid": "4bd88575-a87a-4f57-b16f-07c6e7752a35", "value": "T1ECB4BFE11435191ADC41C3B8C3FAEA33AAE875E4DFA2A8DF96F0AC5779474E15038C85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759509, "uuid": "2de9b742-ffb1-4847-b1c6-beb70d29abf8", "value": "38ef112e400cf3499a170514847ca1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759509, "uuid": "01b686f8-c172-41e8-a4a5-2064fb96d3b5", "value": "6144:IIQwI6a7l8kY4USNqwzw5PyRQ5ZHJjtr1RANabuFGGGGGGGGHGGGGGGGGGGGGGGN:CwIz7lG5KgPCQ57jtxRACs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759509, "uuid": "0a4329a0-775f-4c71-8f39-02770d9fc902", "value": 512032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759509, "uuid": "2ec89bc5-3452-4aa3-83da-19a4b8f4aba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759509, "uuid": "4b04ffed-4709-4f74-b7d5-f5be8ea7f744", "value": "cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfab00fa-ba99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649793005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "6983d666-55bc-4135-89d2-bbeb8633afa2", "comment": "Malware payload (Mirai)", "value": "c0c4a9a39c5cbf65583ae1768badd259", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "b534ce68-6b56-4ba0-a9d3-15c93dc4e63b", "comment": "Malware payload (Mirai)", "value": "cf7fb589a79ee4ae99c0ca9ae23e5edeab31f8c106b2aecd71e15a2c104f02de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "21f4f724-de64-4a0f-9ae5-6b39eac1430a", "comment": "Malware payload (Mirai)", "value": "1b68a415f64305d2b4ef2eff55040074c3f65478", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793005, "uuid": "9febcb8c-e424-4aad-961a-187563815d9a", "comment": "Malware payload (Mirai)", "value": "67b59d3da81594cfe8dd897ae1df7ec82dbbfcd259a4fa026636a3edf35569df6c396983925f218aacb3bc5547e669cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793005, "uuid": "1852d320-e983-4337-9c51-0975af4fa219", "value": "T1D7234DCAD687DDF9EC110971307BAF729676E57E2028EA87D3D95533E902A02E00739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793005, "uuid": "bae91df2-38c4-4c73-a5bb-345e33f82bf1", "value": "1536:x+NnuMS2VTAfsK900mJpcyIxCRJr3hJX7JJJJJJJJJJJJe6ad:UuMS2VusK90hJyy4+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793005, "uuid": "1d8281b2-034f-498e-9cb7-98c7ef39b034", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793005, "uuid": "3083356e-0c5a-4c93-ba49-f56d2479d5eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793005, "uuid": "e964913f-f702-4d7f-a305-511520f0deca", "value": "apep.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cea761-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763923, "uuid": "ab54c45c-ea94-40c5-a2e1-c2a33147a217", "comment": "Malware payload (Mirai)", "value": "8fbdf62bc089810aa8b61ec6d8c6391c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763923, "uuid": "03d1428f-937c-4682-b043-e4aa4aa20552", "comment": "Malware payload (Mirai)", "value": "cf832ef11d0fb1d28c7d52f309bce45e433c2a6d0669862969e709fb1278ded8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763923, "uuid": "fa5d6fc3-c760-42d1-a209-ff79bc046049", "comment": "Malware payload (Mirai)", "value": "8ac1b9b8002bb570d01a90ffdb675cd002e325b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763923, "uuid": "9b1090b7-586c-43df-8408-5f904d920b14", "comment": "Malware payload (Mirai)", "value": "eaf1af80d6dcfd513e569b9aacb40d4d5b916097d470cd9503bead85be6ecbc05a3fa7bb7a04b09f583a4116bcd0cd02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763923, "uuid": "25674e72-565b-4fc3-8c36-cc689ca49030", "value": "T1DA130281782350D2E3E0A03FEFA863C619ECC735B3FCBAB50774AA1982C19951578D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763923, "uuid": "a1f60b03-268d-421a-b8bc-ccbcc592d163", "value": "768:2KQ2+OXSas5oLFv54+HdqF0ogOxGsLqalobidjsv7te1JHeLs3Uoz5:2Kn+Oias5oLFv54tDrobX7te1Ne2z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763923, "uuid": "bf9b6b3d-4777-4477-886e-edb77070a174", "value": 43976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763923, "uuid": "17db9809-504a-4cba-9200-701dec5c6ceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763923, "uuid": "647e1df6-e493-4752-9601-4742e78b0a94", "value": "8fbdf62bc089810aa8b61ec6d8c6391c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7306e0c-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736350, "uuid": "532a4dd1-1195-4822-9603-2ae7cdac93a7", "comment": "Malware payload (Mirai)", "value": "6ada102984d4f414a6d463ef38a83e35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736350, "uuid": "1986e740-e1fd-401e-954c-926c87ea08fb", "comment": "Malware payload (Mirai)", "value": "cfc6d2871d5c9279e8db381f1b1414d04051dccc14d7804b312faf6cb9d958ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736350, "uuid": "a35b93e3-940c-45ac-98bd-769ac7f5297e", "comment": "Malware payload (Mirai)", "value": "c317c022a7ed67f94fc87cb9bb07d303b73bc859", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736350, "uuid": "8c97d352-4c14-4656-99f2-7aa13a9fd554", "comment": "Malware payload (Mirai)", "value": "f488dc9a3f4904c30fbf62192208cd304d098cc328b6bf767ac8cced2d064e013eeea4a5b05d44d4eb5e061c16390b0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736350, "uuid": "d41903bd-1946-46c4-9164-3b321235020f", "value": "T109E2E19E70B42687CEFA187FDEDD82BFE943B08232469F2CF7228905265524790AD074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736350, "uuid": "b11b3cc4-b49c-4bd8-9e06-6255ba78e8cd", "value": "768:4/tv3D1sZ4LKFDvljx7jphMi6Xp1bAzjy+TJ+yefBW2Q:0fD18nFDvlh0hZ2xTQrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736350, "uuid": "7d05ce43-a37f-4b7e-81a5-742dd5590f46", "value": 32476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736350, "uuid": "c83e82a2-c53a-4297-8cc8-2da8c110a051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736350, "uuid": "fcb47905-1cd7-4363-b2d5-23460522047c", "value": "6ada102984d4f414a6d463ef38a83e35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c481d4-ba4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649760024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760024, "uuid": "d3167d6d-d994-4d60-b91c-2f4c41ec3fea", "comment": "Malware payload (Heodo)", "value": "71d280008dca7a1ea7f84738b60bed39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760024, "uuid": "ed2065d3-f4cf-402b-b65c-36de8fdb7722", "comment": "Malware payload (Heodo)", "value": "d0880978cfd6507f558f864db5fad9527fc7c0a10f9e1cae88d344f650d1cb54", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760024, "uuid": "6c3c2d0d-3a3a-43e4-8129-9143d1ae8b80", "comment": "Malware payload (Heodo)", "value": "4eca4ec2cb61f39e49bfef1c2035cbb08d4fca01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760024, "uuid": "5ac242f0-f9f0-4ad4-8add-7f5701b5ea95", "comment": "Malware payload (Heodo)", "value": "2a4416f50cd0448bff0e995b471b9eccc85e563fad5f15821cd241446c69a1d84c8614e0fef35c81277fa040e4e5e430", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760024, "uuid": "5ae5e327-c108-42bd-8665-9d1b6e68e4dd", "value": "T132748E117AD1C036C26A3431451AD3B97AFD68709DF9C60BEFD44E3F2E34A52A62C71A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760024, "uuid": "2fd4a72c-7561-4d52-b9b3-68bb96428247", "value": "6144:zNn1ncsIljXkGkSeW9AdTLDSbmfOBtk1J5zwBlk3LkEqNz0yPh:zNn1nskvW98UVBqJyBlk3LqZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760024, "uuid": "97beb4f8-9aa5-473a-b22a-627a8254063a", "value": 356507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760024, "uuid": "3b5c9891-3f8b-4c66-8159-0b47e3144fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760024, "uuid": "d0af34c7-5a59-4631-9ba4-6f878d9df720", "value": "emotet_exe_e4_d0880978cfd6507f558f864db5fad9527fc7c0a10f9e1cae88d344f650d1cb54_2022-04-12__104020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b2d294-ba62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649769386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769386, "uuid": "4353d32f-c6a8-4e8b-a913-53eceae38aef", "comment": "Malware payload (Mirai)", "value": "330906be5a9bb8fef868b47daaf3e260", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769386, "uuid": "0f781e29-13b1-4fe0-9350-a7a24217a71b", "comment": "Malware payload (Mirai)", "value": "d0928742a3bd56b6910711b2b935ca1accd4a798637d83a2bb2e8c4e17f555b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769386, "uuid": "b55a963e-aa7b-4aa5-a2c7-8985dea5a528", "comment": "Malware payload (Mirai)", "value": "d5e9e77e091267ef2eb8e471ac93f268f68ad072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649769386, "uuid": "2621f5d6-4d27-4edc-bc2c-7261ed397d0a", "comment": "Malware payload (Mirai)", "value": "3121e7d425bab619bc155a2741c126baafc69dd96e32055d36cacfb4b0e312439ad9771b3a9d108b080a36f73c2a4c6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769386, "uuid": "b7984138-fb98-4bb3-8176-2449cdb16acf", "value": "T100C2E0981B4928E9C2F5C17807781B6C19B40FA6F809DC8578F8F7629C8E4B53027ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769386, "uuid": "75747c0a-91f5-431c-8195-cdd566af1b52", "value": "768:f2G214DFyosXqgvV9o1ndB08zPJgGlzDpbuR1JS:f2GdDgosaaO1ndpNVJuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649769386, "uuid": "0c525f94-2aa7-4788-bc7b-42aa299cbd3d", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649769386, "uuid": "0c5ff00c-58fd-4d3a-94d2-8772297d9df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649769386, "uuid": "fcf6d30b-633a-48a3-9ba1-77d3d0db0cd6", "value": "330906be5a9bb8fef868b47daaf3e260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57891131-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800561, "uuid": "2c03438c-42db-4273-a5c6-6963176ff773", "comment": "Malware payload (Mirai)", "value": "be6e643be64c1d6b57682a85d94df611", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800561, "uuid": "4cf666f8-6451-4186-bd4c-7f5844871d61", "comment": "Malware payload (Mirai)", "value": "d0f7ecd50846ae95050f2464246856e7ad000b8a4a5aea7142ef98e59a7f8122", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800561, "uuid": "a9770b18-c67d-4b1f-a09a-9f2754eac552", "comment": "Malware payload (Mirai)", "value": "c0bfd765839838ba1a7245eb67ac876b09273a69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800561, "uuid": "a1619f69-4c3b-411e-b6a9-9c2bb771ecad", "comment": "Malware payload (Mirai)", "value": "7c9d895557737ae962efffbbd339dd3e8b0c9131b949eb675854b2590cd6d1ea3504d15cc1110baed62dc17410daea02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800561, "uuid": "8e6f49e4-9e36-44bf-b5c9-fa674de715d4", "value": "T196634AD6F801AE3DF84EE576852A0D09BC3163C04A931F27A7B7FDA7AC720987906D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800561, "uuid": "e76d154a-120b-4fb1-acdb-78a821176e77", "value": "768:ce6n68/zxX0SzjOsjYKrnV4VtILucv5O5S1Rg9HdbKYT8NmGK5oQLDW:cRFisjlVotIScv5BRg99bKe8ZKDLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800561, "uuid": "50e9f3c4-5b96-4d86-bbf5-0e7ddf42af96", "value": 68980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800561, "uuid": "bb35bc33-a650-4ed8-a942-811eeab22b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800561, "uuid": "f2495ced-ceaa-4cf9-995b-125eca92806f", "value": "be6e643be64c1d6b57682a85d94df611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c5b1b2-ba0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649732449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732449, "uuid": "d17d55ec-2ee9-4626-b999-8e29a341577f", "comment": "Malware payload (AgentTesla)", "value": "29569cc92e80ab0426a2287c3a677b04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732449, "uuid": "26600661-79e1-4bfe-9031-6ac892c62916", "comment": "Malware payload (AgentTesla)", "value": "d1130fc195b0a91917f5ce05fcfc7863c66ae495f2ac0aa955b64376df71db1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732449, "uuid": "83d4fc22-8cf2-4217-b980-f126833d8bfb", "comment": "Malware payload (AgentTesla)", "value": "93b18ed690c42307d44f7c67774753a4a713f4ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649732449, "uuid": "aca660b9-48fa-4781-bbb8-0f613cca42f7", "comment": "Malware payload (AgentTesla)", "value": "7da8b3219ec4e187571cee8f9be08324b1a4a29e7999115808786c805bf771c96cc126d156cb32cc6c3781902f0904e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732449, "uuid": "4fb53310-2a3d-4bc2-a1b7-b8a20824c85f", "value": "T1CEE4F11536F88625D5FE07FDA43900808BF6761B6C26E3BD6E05A0D96D233D0C646BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732449, "uuid": "a994f0f2-acc1-4bd1-808e-0e18f0ce11c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732449, "uuid": "119de666-9abd-4285-998f-d60a686a8491", "value": "12288:rkKUk6ldB4qVC1oU6C8uXLZe5ov8HnaCDKHsxBiTO0iPIAkdBJ4mhf7AgVgz:rkKX63eqVG6ClXLZe5t6C+H0iSVryf7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649732449, "uuid": "9923e126-b72a-40a6-bec6-531f4d8ce35c", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649732449, "uuid": "e43b8096-327d-4df8-b475-19b8b9a370a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649732449, "uuid": "869b8663-b946-4b47-a86c-5ad6a8376184", "value": "SecuriteInfo.com.Scr.Malcodegdn34.25776.572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf091176-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800761, "uuid": "d3ef7807-d625-4d7f-8461-80b4e15a9ac5", "comment": "Malware payload (Mirai)", "value": "5c02fb77d20b51ce0e029a618551280d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800761, "uuid": "91d63f29-e221-4f17-a346-a6b3d2ed06df", "comment": "Malware payload (Mirai)", "value": "d1704597fbf127e6132ace391930427882bdfb7ba49a7d5fa1e23aa854cc412d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800761, "uuid": "78db5ed7-1423-4b70-b3bd-811e63dd4ad1", "comment": "Malware payload (Mirai)", "value": "81fbcff06e4d50482efa7eb3a42801fbdf96e614", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800761, "uuid": "36737afc-a426-4a03-a4a6-c556e0e0932e", "comment": "Malware payload (Mirai)", "value": "0131f5ba843ee510b33dfc26969f4de544c1500a7bdb2f3f479db9e6a69598f8ca6540fc242071a60a28f644a2957fa8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800761, "uuid": "f8ff287c-aa03-4801-ba5e-63fea3e2aba1", "value": "T1C023015432846831C9777F374A758ED1BE0B226EC2E032B176688122ABF767325F9212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800761, "uuid": "c185a1c4-3d77-4186-bbc4-85af36cac7c3", "value": "1536:QMe0AbEhh9EBZCXj0HF61F0stXxwFzOdIL:FAk+rqj0HcbtXWFJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800761, "uuid": "03c474f3-e978-4726-aa06-54e1c84c0943", "value": 49512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800761, "uuid": "b6f47274-5118-49f4-aa37-4ae5786eaec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800761, "uuid": "43fbd26d-1097-4932-a260-172edc0ed76c", "value": "BDK.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb9e191-ba69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649772221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772221, "uuid": "c1e833e8-7056-42d1-97e1-ea0151b08e31", "comment": "Malware payload (Loki)", "value": "eeb961d889d30082b5fc2b99b23ad977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772221, "uuid": "911d64d9-a5c9-41af-9a56-b1beff216c0e", "comment": "Malware payload (Loki)", "value": "d19b39018d752b434f68ab8d567f1eaf9a7e93934e1d8ed3737e64f9fdcec85c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772221, "uuid": "7e43fd96-5d1d-447b-9691-073d4f01c217", "comment": "Malware payload (Loki)", "value": "3824fdd2145a20360b84d32a6057cf01425a0012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772221, "uuid": "c6203b1e-3b7a-4b3e-b951-cb29af05a208", "comment": "Malware payload (Loki)", "value": "fbffbd201c0d9c41be090dc83ed65364dec391b3b41d2ed383ae320ddd1d352ae9b53c36cb639d4d8051cc4bc2f5bc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772221, "uuid": "ab710279-fdd9-48ed-b483-356741bbe930", "value": "T176D4BE09F6B6C912E2A40777C0D618080BB4AA47D926E76F37C572E91D033EB9D5339B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772221, "uuid": "544aeb9b-ea7f-4a94-a315-cd9ea13fcf92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772221, "uuid": "7f54f185-86bf-4648-92c3-5540b4dcf799", "value": "12288:FPB2IYJ28iP4qMzSM+izwCT6Rryjx8hYB2akMVunrg2g6:bW2gqMzsjCTYyjxng7MVoEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649772221, "uuid": "e0766887-f6f6-481e-b3be-b3e951e236e9", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649772221, "uuid": "26582c36-3ebb-43a5-a09d-240bea30d0d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772221, "uuid": "afad00a2-75fd-4d9c-8365-e676999599ea", "value": "Proforma_Invoice_SK20220327_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04310a0f-ba8a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649786248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786248, "uuid": "bda0f1d4-108b-4c91-80ae-ba8c2a1ee1a1", "comment": "Malware payload (RemcosRAT)", "value": "ca4b73473282b7aad58dad02f87d510c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786248, "uuid": "81a8a8a0-4baa-4872-8e77-7160e8523a5b", "comment": "Malware payload (RemcosRAT)", "value": "d230efa209c7d8ade947d5d253b8bc16df1b4aef7059c7b617ac02b435aab47f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786248, "uuid": "09b611b5-e8b5-4e7b-83bc-404aaa573b9b", "comment": "Malware payload (RemcosRAT)", "value": "89d7e8c11fd9b630744cdec3c8be6b7cb07d3674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649786248, "uuid": "b364addc-d291-4c9d-b30b-e3c4e1bea6f5", "comment": "Malware payload (RemcosRAT)", "value": "da65846ea8958acd0305d5ee417e986ee75cca9f0e1ea8315c9bb41bfc1c231e12da27f49853736d57fe37f494fd0c53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786248, "uuid": "32455730-0cdf-4392-a121-2fe0a66ecf3b", "value": "T13DD4F11073DE4F16E36F4775C472A1945B3ABD15A1DAEB0E00463AFA78B27D0E6027A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786248, "uuid": "6844ed4e-f278-4b33-abc7-2d8806781017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786248, "uuid": "72f7c510-5681-49a9-bf2d-c402d15aaae2", "value": "6144:IUTpvvQFgGnFfi3a625mbRrckh84AAwGo1SZZeXm/5pmnjT6rlDM7fmcGpVq3TD+:lwGckO+f8m/5p0eeugK7MH+3qiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649786248, "uuid": "c40a60ec-f0dc-4fb2-a3ef-74aa2eda7f82", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649786248, "uuid": "d2e2ab57-5400-4391-8852-b33055e27efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649786248, "uuid": "558e893c-4488-4c03-8f0e-cdd5c3659459", "value": "SecuriteInfo.com.Variant.Strictor.271096.5167.23264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5f9354-ba91-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649789407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "29402b7f-6bc6-4fc1-86ee-86b0b552ccf9", "comment": "Malware payload (Mirai)", "value": "1b090f5233305593ed0a2ec2fb129891", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "e3cd0060-14eb-4454-96d2-a138fea94e3b", "comment": "Malware payload (Mirai)", "value": "d2bfad029493cce58eb079c289333c3510c274c7429a9ab2480f5bda4afe0518", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "d075233f-eead-4cd7-ad2c-5764d753300c", "comment": "Malware payload (Mirai)", "value": "94c0244146ab1d15a771b920fdca484123d234e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649789407, "uuid": "87c24bed-43c0-4728-b88a-9c8f621e23fe", "comment": "Malware payload (Mirai)", "value": "2289a7251067fcab58542253d8f4d1ee52d63e6d9ac6538de27aa3c063e1b804e7cd73f6e57be52cc4814f6b3bdc6115", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789407, "uuid": "72b97694-10fe-4b10-9dd5-cc7b23ef0495", "value": "T146E2E16C2909149CFDE981F90BD1A7B00FB20F727503A80A7B50609AA5CD1F93AD7ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789407, "uuid": "4a09884d-9679-4b32-986e-2d0d002b0f45", "value": "768:66mh3AuhWk2YJUyLtnLTcCF9OIXeFJgGlzDpbuR1JA:6tGuVtnLIxI2VJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649789407, "uuid": "0b824b52-9dd2-480d-a9bd-adfd89520364", "value": 31604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649789407, "uuid": "a9344417-243b-4960-bf06-64a43054b64a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649789407, "uuid": "b4111d65-be70-460f-a988-a9b190a0c58d", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b35fc5-ba75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649777528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777528, "uuid": "256523a6-82a4-4995-ae58-398df489a0e9", "comment": "Malware payload (Heodo)", "value": "a40f802189d7f29f1e178352a17aed75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777528, "uuid": "74450f8b-0447-4b52-8791-94de1e14e82d", "comment": "Malware payload (Heodo)", "value": "d2e98a88de7202643368fa84b586ab3fb9cf12328be93c04a2128393e00e30ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777528, "uuid": "39fa0e9b-8793-480a-8fc3-7b57d3f1cb71", "comment": "Malware payload (Heodo)", "value": "39095ef034ce44c34d247cfa6465bbc8ab4f5a9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777528, "uuid": "4c0816cf-0df2-4c4f-9782-5779ea98c2f5", "comment": "Malware payload (Heodo)", "value": "b8cbaf276dd57af8a0708cb8f374ebb540a0b0da6fff5ceadf62591c520327b720b71e0b003017d3df573248ae896c01", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777528, "uuid": "2dc6282e-2673-4f14-a60f-3f200c714e26", "value": "T132D438936AC3C0B7E41F0279861A92287253D5323756E6DF3BC5D71FCA387A2AB38151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777528, "uuid": "9e13399a-bde7-4d5d-9290-0ca793ac6452", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777528, "uuid": "271df192-0a3b-41ee-9f85-366cdd09ceab", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJIOD7ZjAh:w5aYJIwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777528, "uuid": "8c584654-4f52-4171-9a7c-0d9bf4cef698", "value": 627464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777528, "uuid": "68699abf-bd51-49d0-a393-c617c7fc5238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777528, "uuid": "6d98a2b6-d705-4cde-b6a2-f6ba3ab5722f", "value": "emotet_exe_e4_d2e98a88de7202643368fa84b586ab3fb9cf12328be93c04a2128393e00e30ed_2022-04-12__153202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee518cb-ba5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649766858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766858, "uuid": "5c0118f0-fb8d-4472-8c9a-d2d04536be59", "comment": "Malware payload (Heodo)", "value": "6f9131676390540adf6d8d7086985e4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766858, "uuid": "2036faf0-9c9d-4477-84ed-d5fdf40f8236", "comment": "Malware payload (Heodo)", "value": "d517a35bea0c2cbb6b82e0a3444a9f3fa733dc9266f96a07b4fcd78fa475f210", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766858, "uuid": "fcb7e663-6c42-4e9f-bc6e-964e428dcb1f", "comment": "Malware payload (Heodo)", "value": "e6ad1bc383832ef2362a9d3d08929de990d3c063", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766858, "uuid": "397b6c2b-8875-4221-bb3a-4c32fff03856", "comment": "Malware payload (Heodo)", "value": "3d640fb2d938b8744abf62c5e5c893e2998215dcc01bd886336eb028a850db4540635f74d939e33853c44956f7e84b16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766858, "uuid": "93a21bac-af12-413b-86fa-b1269d4397fa", "value": "T132941819BB91CF76FC5E0170A8CC8B796595E83B4AA08F036FD2DA3E99B71434D18C46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766858, "uuid": "cad233d0-2bcc-4abf-bf49-dcb93c6ae7cf", "value": "e140b4188c69c3bb4852b94813f9ec7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766858, "uuid": "dfc4aaf2-5840-4898-8d97-20fe75694dc0", "value": "6144:KfUdJ9dhe5HjGo3OvwX0ddpgqjlfBtAkIeTIpkHMPtdX:aA9e3OrvpgqjtQFecW6dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766858, "uuid": "bf26b187-4cbb-44ed-8ce5-a5efa9b6ceed", "value": 441786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766858, "uuid": "37437433-a780-4485-987d-eabe2ef9eb4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766858, "uuid": "b5b4514a-ec51-4ab2-889b-549bb8bb3f93", "value": "emotet_exe_e5_d517a35bea0c2cbb6b82e0a3444a9f3fa733dc9266f96a07b4fcd78fa475f210_2022-04-12__123354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ca72f1-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767570, "uuid": "7d452003-96fe-494a-a398-9c1c84d262c2", "comment": "Malware payload", "value": "5fee360e7fcee30ec2fc5be4a4314af9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767570, "uuid": "dc4e53cb-2153-4f57-92f1-3ad7fe967455", "comment": "Malware payload", "value": "d5cc97ca4bc5e93ef38f502963fc4c3278d7172d622932f64c5c51846797f6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767570, "uuid": "619cd126-2cd0-464f-8aa0-f34cfc718746", "comment": "Malware payload", "value": "d9e5dde70e581b8b1776e1e134b13ad626c95b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767570, "uuid": "1051d163-55b8-42a8-ab90-fe5b43d7b53d", "comment": "Malware payload", "value": "3d3ada949c25036cae73c6a1ea0b1f888d67a772adeaaa0d6c0afadb1752240d292d402b2a86ab71e91a79b5f1eb63c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767570, "uuid": "862f6f7a-db50-49c0-8d22-4bb62b6cf2ae", "value": "T1AFD5F19964500A1DFCDBC1FA849D07607365B59CAEFF1BC370656932BCA32E237B1A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767570, "uuid": "3901109b-b243-4a44-8705-0cd4e5ebf857", "value": "49152:pO97ROqKk/KZaOsEr8AbcbMiJhxFmtr6eMz7tkoRhDTA7u/ArJl29o69EB:s2bZrVgAX4sr6eWfAFvwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767570, "uuid": "d7296011-6a20-4c1c-a147-a4d4c9a7282f", "value": 2757384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767570, "uuid": "142bc237-d5a0-4af2-be0e-34c75048e996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767570, "uuid": "b0f5eaba-943e-420a-b246-3d4afacfd704", "value": "5fee360e7fcee30ec2fc5be4a4314af9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1ac342-ba71-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649775634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775634, "uuid": "4c30beec-235c-45af-b883-bd5611e58e41", "comment": "Malware payload (RedLineStealer)", "value": "e6683aaec81c75deca1430a44120a4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775634, "uuid": "45fab792-3a92-4e3f-90d7-a1f1f48228d0", "comment": "Malware payload (RedLineStealer)", "value": "d62b3e5078c6a48001b59a603870348ee7babe9020d3c906fc5863efc8c7129c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775634, "uuid": "2f4458d0-aeaf-40ee-88cf-9967e7f0d141", "comment": "Malware payload (RedLineStealer)", "value": "4145aebc8a8e6bf8b15fc364fdce121521e367d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775634, "uuid": "4351dfee-c175-455f-bcc5-e397df70cb2f", "comment": "Malware payload (RedLineStealer)", "value": "2f2d6c27cc12269dbd980fd30bfd023ac21a67e1ac57ef7a0c2e26ec2cc6291b6be50730ec2aa1d1048dd312d2db5c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775634, "uuid": "4b491fcc-5069-436c-858e-4186945025c1", "value": "T19B94F112B9F3D832D5A20D704865D6A06E7FBF525263804B77790FAE7F32790462A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775634, "uuid": "76298601-274c-4de3-8761-3f6b630835c1", "value": "cc4918253c54eab1a1e051581c92623c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775634, "uuid": "390b45c1-446b-49e9-b5e9-5bbc2f441864", "value": "6144:3KLLv4gEzBcCmgmJjimt7Y8pc8/kDJhU7d7lsExbgaPjstgEk:3KLz4gEQgsjTt72WcD07VgaPyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775634, "uuid": "248c727a-4d35-41dd-85df-a641cce9a4af", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775634, "uuid": "00b7bfd3-3ec9-4bc9-b86a-78f3d24a322e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775634, "uuid": "e22f3f5e-edf6-4b37-824d-bc8dd137fa8d", "value": "e6683aaec81c75deca1430a44120a4a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb356e63-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "c6130f82-a887-4e39-98a0-a4b6f829296f", "comment": "Malware payload (Mirai)", "value": "60a6e59046da709c2c127bf81f1c962c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "5bfa6f0e-23ce-4e9a-b789-69f0a3292b4c", "comment": "Malware payload (Mirai)", "value": "d675e8e6e8c867e780e104a4a4b1d4bbe1ba5398b866fda7ccc785956d4ee4ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "6b177a24-0b9d-4484-a588-b4b5c3ddcc71", "comment": "Malware payload (Mirai)", "value": "2dbbe4943cc606cfd9007b2c4bd29773948a5072", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "744ec7e6-b42a-4497-8622-731f804b1baa", "comment": "Malware payload (Mirai)", "value": "bab91220e065f2d39c61dcc95004646d6f390836d8d1dce0a43fc180835352a7b19bb871430ff975fec4441bf0d21626", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731660, "uuid": "de3f4fbd-b6c0-459a-8e5a-835e63ed46fc", "value": "T13683B40ABFA14FFBE89FDD334AE91705259C541A22A93B757970D428F24A24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731660, "uuid": "6f757850-47a3-4316-9499-8bb99d006bf1", "value": "1536:ChAfg4PbTaBnHCXPNm4uLualCrQre3s0/6ZEFyMSfS:Cqfg4PbTaBHeiL3S/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731660, "uuid": "67463efa-8732-4ad3-8d06-e11cd653a1ac", "value": 84028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731660, "uuid": "c10d1e3c-da8b-4fbb-bd31-301d75646c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731660, "uuid": "38aab0de-0556-4c41-8d73-0190191ecd27", "value": "mipsel-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfc6b91-ba68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649771819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771819, "uuid": "7f8e4959-3852-471c-8f30-0e98ede6806b", "comment": "Malware payload (Quakbot)", "value": "022bfba36745f584c87ad97933c7ba5f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771819, "uuid": "4b771c57-f905-49e0-ace1-84468791f4cb", "comment": "Malware payload (Quakbot)", "value": "d6f21d6ff9508aa6ecb93530f0aeaab9a840c6c0a7bd3c1905ad592c3ba3358a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771819, "uuid": "03ddb766-63e9-4ac8-b0c4-65fa4d95398e", "comment": "Malware payload (Quakbot)", "value": "c38d5daf43a46bfcc66468f4f54550ce702a94e5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771819, "uuid": "27dddfca-bfe2-4342-8d2e-8034a11fdaf8", "comment": "Malware payload (Quakbot)", "value": "8e32b151ea98c6eb35764989aa9e79030636c349eed29f910e90a9cd3311012f5fbc7d3bf1c4509c0017b6326e3384d4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pw R3454", "colour": "#8380B0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771819, "uuid": "ddbb41dc-2db3-48b5-9a85-fc62839687bf", "value": "T11E151255B9C75333C1431332491FA3A44FBACC489BF24923AAA6B65C2D7176163FB8E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771819, "uuid": "5cf5585e-2644-4863-af4f-131ada400456", "value": "24576:5cODzRTjdHGBsORW3s7skJslt1slU1/BZ+Pn:5cODzRJcsOR68Yt1sOTZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771819, "uuid": "d4debe99-6e0f-48b9-afea-f3aad9c6b040", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771819, "uuid": "717a3eb2-26b7-4044-98f9-60de5ee360e3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771819, "uuid": "4e99b1b9-1612-4239-8147-23c490eea59c", "value": "305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4417457c-ba0b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "942d6ccc-990f-43a4-a418-9d4de164c27b", "comment": "Malware payload (Mirai)", "value": "ddde97f2ba1fa40556823fe480a4f1a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "784a0d47-30df-4119-b0a3-88b7ce916aca", "comment": "Malware payload (Mirai)", "value": "d79cf3b5576a1c833f89ddf49bccc82493de2a18cda3bcdafc05739395fdc0fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "c2057e2e-7025-4c8b-972a-31f9bf48e4b9", "comment": "Malware payload (Mirai)", "value": "555bed260ff87020965fe513221c95b4f5c1488f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731809, "uuid": "6f79271a-1815-4f00-8c0f-6774cd125c30", "comment": "Malware payload (Mirai)", "value": "8a3dc51fc9bd41f185fa2e3e13b0eacc58c1f0babfb1abdaf8908874e303b9d603186da59af03e4db0448561c48a3e43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731809, "uuid": "af73dd35-1e8b-467a-8a49-6190a257336b", "value": "T127437DC1F603E9F5DC0275743077EF329E72E4FA115ADE87D3A49632AC42602A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731809, "uuid": "49cd98e3-3a5f-4891-8a8f-38ea65397363", "value": "1536:KTamld2bIuPwOU3mOvsO3hiMTmH65LIJJJJJJJJJJJJJJ+BJJJJJJoJJdJHL6V:wEbIuYqOk0hVCHIIJJJJJJJJJJJJJJ+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731809, "uuid": "ff0dc437-a62e-409a-8500-0b64e769c949", "value": 59604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731809, "uuid": "ea95a31e-e6ca-4803-9fad-0180c6b6a659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731809, "uuid": "9adf519c-f1e8-4bc1-ba79-343a55036ff3", "value": "a1mb0t.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fd350c-ba6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649775006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775006, "uuid": "81adb6c7-f580-4c66-9929-3682637146a3", "comment": "Malware payload (Mirai)", "value": "17955092b70d2bbda8f319d540ba7c4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775006, "uuid": "bc15be26-fc55-4431-8077-dd9ff4aeaa0c", "comment": "Malware payload (Mirai)", "value": "d869d5b822bc2a913ec3b3f369b57e8e7fb8d7ab8d0b5d4ee0a1017eeaecb1c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775006, "uuid": "4f533565-6af0-4b0e-8551-ed5f33967123", "comment": "Malware payload (Mirai)", "value": "2f02c493e30019b964c6e70401cad9d98108c9aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775006, "uuid": "a8484229-31f5-4a2e-9b1c-20988a389a13", "comment": "Malware payload (Mirai)", "value": "96190a5dba63194dbe994b32d6e88508b7e7f866887b9f11e9ca8960cecd9fc2abdd383f633c96c7eca047933048b9c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775006, "uuid": "c790b782-093b-4381-8a18-ce09264bc14d", "value": "T1D733D79178D15A2AC6E423BAF9AE50CE3321B3E8D1DF7217CC241B047AD552F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775006, "uuid": "c2d5d119-7695-489a-a7b8-1963b318a23a", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775006, "uuid": "86293c73-5aa2-4d00-885e-7bef9adf0080", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775006, "uuid": "615bc83c-b7d6-4565-ae5e-56cbecd52a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775006, "uuid": "fd92701f-f287-4b16-89ba-c6ae4d2f4ca3", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312441b6-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649767425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767425, "uuid": "678a5780-a9c2-4b48-bb98-5a74facb8e90", "comment": "Malware payload (RedLineStealer)", "value": "ae4b768269b8d8ecbfa622dd224e4746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767425, "uuid": "672cd9fd-914e-4062-906a-9ac968ac3570", "comment": "Malware payload (RedLineStealer)", "value": "d87d068e5cb1719d523dbeeff0306d360ab4d4f4efa1ba6accf61b2c3a5516e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767425, "uuid": "3050c775-a278-4eaf-8cbd-d88e9ebaba95", "comment": "Malware payload (RedLineStealer)", "value": "3d4f29186b77f7b94543138a46f0e82fb16cd791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767425, "uuid": "0babb9b0-e6f6-4de7-b030-a2e9d460eb33", "comment": "Malware payload (RedLineStealer)", "value": "27e68cb0f0f4ddfc74d5b755936de722a91ac6ff76c0250f732d2cd94c431a7d959c5fd356e61ac53bf99a47dd699e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767425, "uuid": "5fafbf88-ce85-4ee1-a454-78668418ca03", "value": "T18285C0E387510206F167B03A901E6E2D717206315BCFB8B7B7899BFA931B2D0961DB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767425, "uuid": "09eae35b-a78e-4134-b808-3538a6770b48", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767425, "uuid": "2bfe037d-ed50-49a4-a57d-3eac45e58858", "value": "49152:3MDxz2d68OHj6qPrPghJeVOFS7fmUXVyIkT:o8OHj6qPr4hJeVOO/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767425, "uuid": "4dfafda4-845b-4fce-99b0-2db98d78b1ee", "value": 1861384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767425, "uuid": "046cbab4-dfe5-49df-ba43-b0f05cec819e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767425, "uuid": "ff10b2b1-0729-40da-a05e-cac008cd547b", "value": "ae4b768269b8d8ecbfa622dd224e4746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec71b216-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731662, "uuid": "6f58aac6-dce3-4db7-bab0-57bb1c28151f", "comment": "Malware payload (Mirai)", "value": "c87fd2aca5308ece0400511ef385580e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731662, "uuid": "afa96fd2-86ce-4359-8c05-6eb0cc427a4f", "comment": "Malware payload (Mirai)", "value": "d8a6a91a1c9e88099af791cc9117d3d7375d97b8f1a13e79f2a9ba2502f4ff9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731662, "uuid": "018de5fa-f28b-4bb8-803e-cf97e28c2eec", "comment": "Malware payload (Mirai)", "value": "3b6ad3e29b1ce8b14f88274e30f487fae66cd095", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731662, "uuid": "1ae5a7e4-b100-4250-8e98-65d230ca7d8b", "comment": "Malware payload (Mirai)", "value": "cb5f73fa42398cb14605c3678510b33eb94fd747c06671d219ada8c394cecea8e3f40b62e10314191756395c3dfd3ff2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731662, "uuid": "89d58dc6-550d-4c48-a202-3e97655dc5fd", "value": "T195435AC665C3FCF2E8110A3D34ABAF724EB7E53F6075EAC2E7995536A90C202910235D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731662, "uuid": "1d73f814-ce04-4237-a0d4-be390bc2760c", "value": "768:70UqdcWFmZkft/VM7h0Pwnj26bvoFYklK6q6DIBv4o0owDcGSg:709MZkf1VMVAk8F91I94oHwDcGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731662, "uuid": "a2267d83-92e2-4ca2-9566-fc50c36c534c", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731662, "uuid": "ee9e6e4b-c0d3-49ca-b840-fc8d18727c3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731662, "uuid": "bdcab980-e719-476d-8d1a-d822671fcb5a", "value": "i586-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a299bdf4-ba2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1649747429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747429, "uuid": "99c184ae-8576-43b6-b334-e55c81840bf3", "comment": "Malware payload (Nitol)", "value": "420de528c67606cf9424344e05fa5758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747429, "uuid": "ed11b242-adf4-4a96-abe4-2a441645aba4", "comment": "Malware payload (Nitol)", "value": "d911cad6ccf82a0aeb34278fe8446ecbee05f0022f18da1f8b92403bce2b80f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747429, "uuid": "331f6a4f-0b75-4b04-9468-1695cd1e21b9", "comment": "Malware payload (Nitol)", "value": "dbba49322957f00013006f5f5149e07307fcfac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747429, "uuid": "59b7084b-82bf-46a2-8f9a-8bf7497b14b4", "comment": "Malware payload (Nitol)", "value": "6f85dada80a339403694dacd1f5760cf866ef40726ff4f5cc4f07acecb333b17adac971d758f94eed706b549cb54ac21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747429, "uuid": "f02c900a-0ba7-4d99-857d-9df37fa7519a", "value": "T106737DC5FBA04C9DC66887F045BA57B39467AC0A37021F4B87D0F87D98361CD9E2A28D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747429, "uuid": "e2e0e0cb-4682-4ebb-8a1a-da39dc985d99", "value": "0ad3c30e73e0724c04077c22b2880816", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747429, "uuid": "504a3569-836f-47f4-8fd5-6ee6428c7453", "value": "1536:g1s/+L8V2eJkJGCBXSZHALyaqZd5RNNN62222b:f/3+JGKXSZHDaq75RNNNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747429, "uuid": "b8c46929-0563-4cf7-b4d6-1b767035a1df", "value": 73978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747429, "uuid": "a2324e32-e91e-49dc-a3ba-55d0c012f2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747429, "uuid": "74fa7060-513c-43a2-af5c-cb9de77a7175", "value": "clock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2732ed-ba47-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649757887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757887, "uuid": "5d4a0ea6-4821-4790-94b4-66808d5f7005", "comment": "Malware payload", "value": "4881859d16773434ea29af178905a71e", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757887, "uuid": "097d1fb7-ad5c-4b9e-b222-00ea4fd5c27d", "comment": "Malware payload", "value": "d92f326f71f81874ce6e1011fa2683535a3e658f862e7a644eb4b05d09b89747", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757887, "uuid": "502e65d4-30a2-41a5-a71b-82ff20783914", "comment": "Malware payload", "value": "078481efa7192def4f45679c94b377225152341c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757887, "uuid": "4d7a8647-1055-4327-9108-82ae24ac05bc", "comment": "Malware payload", "value": "17608aba9dc0ec30219e5aab1fee520966a00438f53f77fd4b0e18b78ab069e8fbf841204f791aa723b2621bdc337a24", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757887, "uuid": "b098daa2-3633-443d-9daa-88c5c4e445b7", "value": "T1FB22BFC8CD20DE56440A2ADC452821107887365FDB9E145D22FA648C7A69DF4EF407FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757887, "uuid": "6943f828-fedc-4db9-a995-6fe6f3425002", "value": "192:DjOuzE6doEf78YCt+BrJnRBWmU6GJPEZJUFIyR79PV:X7JaE4vt+1RptyPEAdR7NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649757887, "uuid": "41efd7b1-faed-47bc-9e9b-a76ed5f6f426", "value": 10053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649757887, "uuid": "194bf865-16c5-4f9a-ab5d-92a523651514", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757887, "uuid": "f736a054-8268-4ae7-ae45-6904c43f59a5", "value": "2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0cc8b0-ba4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649759664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759664, "uuid": "a90324c6-c8fb-4afb-9d8f-6bb493056804", "comment": "Malware payload (SnakeKeylogger)", "value": "b39641d2f94ac3d4d44a0a7593abdec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759664, "uuid": "d239b829-a29f-48e0-9b55-ad8612c6ff6e", "comment": "Malware payload (SnakeKeylogger)", "value": "d9439e8efa35b9ece1553ce1e77f98ecfbc148ab06b24729ae1c721c55185871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759664, "uuid": "43717545-e47f-451d-8217-2fabc68964b6", "comment": "Malware payload (SnakeKeylogger)", "value": "155c891ad1d6da1bac316f280bee0e08d32abb78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759664, "uuid": "24c7dd14-f751-471f-9625-f83cb7190850", "comment": "Malware payload (SnakeKeylogger)", "value": "7b4100a60a94eb352650d38b2e980d1a35985c79a6d2c1f8083a4a8c98d348696ba48865c4770c5ee0633c895f88d3ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759664, "uuid": "7c6ec9e8-f917-4117-8603-5a87705be2c5", "value": "T10EE4AE05FAAAD902E1B95B77C0D7090413B0AE86D516D72F3A91F2E50E433EB4D43B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759664, "uuid": "3f740860-50c3-425e-96a9-14df61eca68d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759664, "uuid": "a451ed82-1909-4fc5-96c9-45e78667ecca", "value": "12288:YeZsFQM4qVn1aXAbfQGUsKzSIG6Tkg2g6:jZbXq2zGtYGMPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759664, "uuid": "fe56ceaa-cbb0-4570-81b7-835f0b87c98c", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759664, "uuid": "dfbb3534-12d0-4e54-814d-d659b1be81f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759664, "uuid": "7595c0fe-b691-45fb-9236-2094ec4bc80f", "value": "Phosphoric AcidPR 120006486PO 120008190.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072427b5-ba65-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649770361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770361, "uuid": "eba43b71-77fb-46aa-8570-67439bd68539", "comment": "Malware payload (Quakbot)", "value": "447c1e0402d41aab4de7d3144fb59f39", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770361, "uuid": "49773436-79d7-4040-9e6a-db44d5f680bf", "comment": "Malware payload (Quakbot)", "value": "d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770361, "uuid": "75945d39-8680-4e81-9961-ec676efc99ba", "comment": "Malware payload (Quakbot)", "value": "cfe590f0a5ee761a2ce0bc4e560da1604f094d48", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770361, "uuid": "6ebc5f97-b5e7-4667-a585-4b82812a20b1", "comment": "Malware payload (Quakbot)", "value": "b7470b66297fef6062fcfa827b493250bcc4b05833c3ee066639460fe8a21a45c4ef9fd73751dd72c819f353523f25fe", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770361, "uuid": "4a61a27e-839b-4ae8-9a6b-c41470406b31", "value": "T1AE859E62AE9D4876C076363C8C1F6259A8297E103D289C5E67E80D0DCF3A7917F2539F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770361, "uuid": "e6cf7ded-7a9e-442b-85f4-b7a22f1f5428", "value": "680b9682922177224183342c299d809f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770361, "uuid": "37a5589d-3e72-4efa-8168-0a4d5bafcffb", "value": "24576:nKtpZm23yqec9S5hZqT5/ZMoK3EHBCTFvfrr+E+OLzO9AO4k17vvoA+rXBxQHKbC:nC3LoqNG0HBi1X+5OmmPA7Hj+hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770361, "uuid": "13176fe9-3934-4fd2-9e3a-e176823e9eb0", "value": 1742683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770361, "uuid": "c39bf6bb-d23f-40f6-a487-232cc7ab360f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770361, "uuid": "67b2d238-aeb7-4358-88bd-1a76b85ee9bd", "value": "d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f08306-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649765923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765923, "uuid": "5525bf91-d1a2-44aa-bb9a-f4b9e4e8fc24", "comment": "Malware payload (Formbook)", "value": "d582115e3c1ba1f56041e13a5e0b4aca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765923, "uuid": "777512cf-4d30-4abe-a920-114a9a0dde39", "comment": "Malware payload (Formbook)", "value": "d9938bc55dec6c83c1d958b7f97be6387b6bac83aa0886dfbfcb10cd1b1a336f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765923, "uuid": "a9625689-fcd0-47b4-96de-ffa1fdcc7a04", "comment": "Malware payload (Formbook)", "value": "344b33f599875fb150a4770b7e4a243774082947", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765923, "uuid": "ffcf518c-8b40-4017-9408-1b88419ab6e5", "comment": "Malware payload (Formbook)", "value": "b5565bb44190ddc134ed679c84176daa18838f4f6f9f7108babcd73f8407e5af7eaca4029f3bd5b6827d45bbabeeb63f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765923, "uuid": "0b848035-56a2-4ce0-8e9b-1562c3644aa7", "value": "T111741395FAA4AF23FA6BBAB455F910B6045E8C6323331795504037F49DBC18412BE3BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765923, "uuid": "716e137d-c807-46c4-b623-e94df65fda2c", "value": "6144:IUEef4hkD48RLz5eP5KXUMEpt++qd+gJX6/3NnRmNkyHr3Mg+MQ7ta8:IUdwkk8RRe+En+LCFncH4ggtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765923, "uuid": "18b1286a-173a-4480-832c-08b939e21b39", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765923, "uuid": "822b3000-90a3-4e45-89a9-f0c32325d060", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765923, "uuid": "0d032bc9-2602-4808-b558-55d58add671b", "value": "Order 2 April 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd286504-ba51-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649762130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762130, "uuid": "f2d36aee-e197-4658-a152-4108de4da6fb", "comment": "Malware payload (SnakeKeylogger)", "value": "baaba13d1b0c3fbd0f467b4c6b092423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762130, "uuid": "ea851964-e9ee-44ed-8596-4074105a43c8", "comment": "Malware payload (SnakeKeylogger)", "value": "da235a1f488533d96cd4d465bce1e3ffa7d7336cd5e0a97d53ae6cfe6e527a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762130, "uuid": "62ebef31-ee4f-49c7-ac4d-2b098b6741b8", "comment": "Malware payload (SnakeKeylogger)", "value": "b2f659cce8347ea9d6bbbe345c12bd9559661bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649762130, "uuid": "26927f58-8c55-4e2b-b79d-fc1579cc2955", "comment": "Malware payload (SnakeKeylogger)", "value": "4598014b2635106ff55cf5a47a5821a911a621e82a869786f2053f840f751dbbf95c9da6d72118fe23d9423162237184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762130, "uuid": "8d244b72-1b54-4964-a7f7-e5b00c12ab77", "value": "T12BE4CF05F7AACD22D2B81777C4E70A0407B5AA06D912D76F3A91B2A51F033EB5D0B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762130, "uuid": "68c41983-39c1-4671-aabe-715c2ebdbe52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762130, "uuid": "0f8442dd-d603-47eb-950c-00940fbfa6de", "value": "12288:J3NIhETQ4qomYdpbmSfllJZ8lw7gUw9uUKg2g6:BqAm8lTVP0dlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649762130, "uuid": "34b35afc-09f4-4151-88b3-5db89314c008", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649762130, "uuid": "16c8ceb6-6615-4f86-b039-be510879588c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649762130, "uuid": "11e31826-55d8-4813-aa5b-49c74228e0dc", "value": "SC_223651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf09e9c-ba6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649773941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773941, "uuid": "f08ccbb9-170f-4925-a3ab-beaca4f5cdb7", "comment": "Malware payload (Formbook)", "value": "a510a979ced0bc601f68ceaf7903dcfa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773941, "uuid": "5384063a-e1fc-4b18-b6e5-87c6410fda2d", "comment": "Malware payload (Formbook)", "value": "dae9b428901d8df2061e5a8128667549c9939785857aff255f3c5ab11812bdc8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773941, "uuid": "a2361ff7-4316-49cc-949b-089f5f7708aa", "comment": "Malware payload (Formbook)", "value": "643f5be2a6a2cd34f93a3a01c30d9d1c1c2feb99", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649773941, "uuid": "8c10f942-d025-4b9d-bfef-aa8e26e23816", "comment": "Malware payload (Formbook)", "value": "b8eb322fbfe1d9f01e7d2c8ee9c13b075868548795737e8721912a3999060aa959bd2379b485402dbd3f3646bb60088d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773941, "uuid": "5a581358-0840-4691-b12f-05f71830dc3a", "value": "T1511533EE461FC87E087C0CC52EA0663562146E0A69346B279C791DF1E7DF6713A0F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773941, "uuid": "31b89447-f8d0-42c0-8cf2-00fa91640de0", "value": "24576:MJZVnndHUsEXEfbvc4omAIvAuJRHSXdL6:sZVnnxvEUfymAIvxsF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649773941, "uuid": "188c8a75-6e0b-4013-9f16-e910c03a1bc3", "value": 906117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649773941, "uuid": "b09eaf4c-3b54-411f-b6c3-5a4aa38de662", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649773941, "uuid": "63cc132f-006d-4f92-ba6c-b412bd9fa3c6", "value": "PO#PCL2003827677#Invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427b45da-ba2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649745979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745979, "uuid": "6be8e191-c898-4917-82c2-8fdc42cc63f5", "comment": "Malware payload (AgentTesla)", "value": "1a766f0a035150ba5d083750a8eaf3e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745979, "uuid": "c3b25977-9acd-4a98-ac08-035e4b28ca22", "comment": "Malware payload (AgentTesla)", "value": "dc1fff8ad51b589e3b0c1b7bf350d6dadc30dddbd5828d4e6afdb3e4bcc4f038", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745979, "uuid": "cb7d20c9-2ea5-431f-a537-e73d6dfee953", "comment": "Malware payload (AgentTesla)", "value": "cf377eec5e915ee65e977b16e626ecfe54f63c46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649745979, "uuid": "919627ee-635e-4968-89ad-e76095e340fc", "comment": "Malware payload (AgentTesla)", "value": "f0ccc347c53d81409f8d3fec08fd006e1d9ed4442d2b5ae12db08089a42fdb5168e33a30218426ac9a3264fbfc6df87a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745979, "uuid": "0d6860e9-80ad-4549-bc56-4ac57cee9c98", "value": "T15815332ED6A62844E4F714BE37474B0DCDB36508DBB4A80BDA2F133545A1FB9181B93B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745979, "uuid": "8b7dfc75-eef4-40be-a10b-eeca0ddee62c", "value": "12288:0r6MyY5lzTP9safeFZ/eplfu34pQ2W0TDbFW2A6maYQjjPloIG1pkVnt74gwVR00:I6MyS1HfeD/eLj3pW0yg6pKpORbV/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649745979, "uuid": "1e80a2d1-ab7c-473c-9cd6-6b578fab0ee7", "value": 909774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649745979, "uuid": "7a7c9218-043f-48bf-a4c4-53c2f4157e93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649745979, "uuid": "b4756fa8-2cf3-4b65-b686-ac45789d3418", "value": "SHIPPING ADVICE#DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39b73d3-ba6a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649772852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772852, "uuid": "c490ef31-65d5-4f22-875e-5ab8f51d9ae3", "comment": "Malware payload (Formbook)", "value": "b12de0bde0e62950be3ea3905097c670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772852, "uuid": "09acc11f-c66a-403b-83de-b253d6508924", "comment": "Malware payload (Formbook)", "value": "dc209c6180c6cc71541cedb0b311499b30857b25a3e19f2ced6073b53fe55be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772852, "uuid": "f8e51bc4-82e2-48d3-85be-caa25109033a", "comment": "Malware payload (Formbook)", "value": "b29ba7c24d595ab6561c6437943270c7705fd466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649772852, "uuid": "4e663038-c63c-4a12-8a28-f4b91b5692f2", "comment": "Malware payload (Formbook)", "value": "f1455edca85ab245cc08bf20402b661d2153de4f57e858d216dcd609b558e8de40a964c09f26f4141ca66902db188004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772852, "uuid": "9a8b2022-dd8e-4ab4-b972-87145a33d539", "value": "T128F4BF15FAB6C912E2E5173BC0E7080403F4AA47D936E72F3791A2A51D133EB5E4639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772852, "uuid": "11402aca-4ba9-4792-812a-f5ec56acf458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772852, "uuid": "93cba3ed-c01f-45f0-8554-f52cd64a8cef", "value": "12288:vFxzLrRuYLD4qfgvrt/FnCkwa5FQDySg05akpYg6:P9L0qIhFCkPbtSg+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649772852, "uuid": "08689fd8-d512-460c-b482-7a4de5fccbc0", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649772852, "uuid": "a4474fd7-5a8b-4dfe-84b6-3bb4b5dc6fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649772852, "uuid": "ab37e592-8020-4c24-90b1-301d5ab05404", "value": "NEW ORDER FROM CANADA.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1168e2ea-ba24-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649742461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742461, "uuid": "eb29a213-6d6a-4318-880f-b9ae9dc9b7e0", "comment": "Malware payload (Formbook)", "value": "2308d9b0f499388c91d9e4dca8f17edf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742461, "uuid": "111a05d1-36ed-4e2b-814a-181d94c8503e", "comment": "Malware payload (Formbook)", "value": "dc61bd75488032a4e6698d3d73dfe9b0cdb8dc64526a60d2a6cd317096a1e05f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742461, "uuid": "a016785b-251d-44b4-a55a-bfd6f706e160", "comment": "Malware payload (Formbook)", "value": "56c02f80b1ff89a8743631a68b9a84184897f297", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649742461, "uuid": "dd7ff43e-0de9-4e14-8acb-7313b59481cb", "comment": "Malware payload (Formbook)", "value": "9a195914b991781f4f7b32479eb228312fc14371f7047dd94226f60dfbf274460cfcdf33f8f504c8df3df6be3a583578", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742461, "uuid": "52d40c34-defa-4171-b65c-e38147b27f25", "value": "T18A453351401AF8B3B5B72EF1432AE04023B577055B5E0F22B94BFEA85FF7AD80B95A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742461, "uuid": "ec663b21-d706-474a-80c9-7bf8f2065ba9", "value": "24576:a40XX6V+q3v73O6m0mGPVDBk/kNzFX1hHKvqbgZYMU8p85zGmAGj03B:TSQdmuG8pqvquU8p8ZVAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649742461, "uuid": "1e0793cd-01ed-4466-8801-5f6f50a43c6f", "value": 1218960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649742461, "uuid": "d474a19d-698d-4411-a174-f0f2de9d80cf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649742461, "uuid": "fa771037-9a0e-48a4-87d9-973145587fb7", "value": "RPO 6800053448- QUALCOM TRADING.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1b039f-ba64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649770049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770049, "uuid": "20a545ce-4ebb-4b08-b19d-5a91bfd9c08e", "comment": "Malware payload (Formbook)", "value": "63b29084928947bdeb4eae20cd7f1ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770049, "uuid": "9ec3280c-3d73-4271-9b84-87cac897aefc", "comment": "Malware payload (Formbook)", "value": "dcccbb97201914164dc8bed003f14daadfa300a6206b7ce835f6c7ee8b686405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770049, "uuid": "771f1f55-17bb-42d5-ae54-ca91e73afaba", "comment": "Malware payload (Formbook)", "value": "dfd7b57d94eea0573bb5ad6781f56ee995665173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649770049, "uuid": "c0dbd8e1-8e6d-4b4a-b6f5-b1b5d706d411", "comment": "Malware payload (Formbook)", "value": "fc37555346baec9d0b2d6a5fdb0da905e525bfd6bbf144e785458e7d50b75ee1b310b220beabe3b084c0f6ae96069c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770049, "uuid": "240139ec-f3ed-4c9b-aa4b-d6e1b5cc711e", "value": "T1D4E4AE12B2B04F32DA3F1E7D4D0B975959277E135E58A2833AD42E4C3F752817A3A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770049, "uuid": "ad6d36e4-ca28-43f6-9d56-22a7a1c873f5", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770049, "uuid": "58a078c0-09f7-43d3-af6b-6acc5e15f6f7", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2/Zec4qO:wkKHuoE+/vI0icJsk/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649770049, "uuid": "de2e17d3-e205-4294-a939-de36987f2651", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649770049, "uuid": "0b27f21c-0ec9-40a1-85d9-12684b116b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649770049, "uuid": "b3b17655-6284-4fb0-a6ee-d41518185f6e", "value": "Technical_Specs_and_Scope_for_500MVA_TFM_Drawings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a486cde4-ba5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1649766330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766330, "uuid": "3048aefa-1d83-491f-9faf-30c56ed86ef2", "comment": "Malware payload (NetWire)", "value": "67400988fb4215d09d3ce7e4a2d91f8d", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766330, "uuid": "4e5ee0dd-df24-4942-aded-6b98d456c873", "comment": "Malware payload (NetWire)", "value": "de054efd24e2c19222dcd14942e84342f70ad10c084a2870e09d2c2441504b82", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766330, "uuid": "1424948e-a42a-48dc-95d0-30ccf66a35a4", "comment": "Malware payload (NetWire)", "value": "cc1d081449a69149cbe7a50bb166a693b4dab696", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766330, "uuid": "86d305ea-1ef6-42a5-98f2-393c8772439c", "comment": "Malware payload (NetWire)", "value": "df7cb363c073b796558f4968bc3d7f25716ae8d6280921f01ab0691e337564203cac7359713a08fba2119d75da81dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766330, "uuid": "610cc566-1be1-4d41-b1ef-0a5b0dcd3521", "value": "T11351121E308F772866350FB6EC1B489E91B38782F1B405943A16CEEADD3516C978AC9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766330, "uuid": "15ab1768-3db2-43d5-8fe6-be5f452e96e5", "value": "48:j8X994gvWhFxv4bFp1CEzJUE31rSZ0ShWVtge1SNo0BdhlPN+D:j8SPxvqCSJUs1rSZ5ETliN+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766330, "uuid": "ff990af0-92b7-4246-a842-745df653c27d", "value": 2834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766330, "uuid": "c9ccb28b-aaf7-45a0-a439-a163d9fa97e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766330, "uuid": "5cc712e6-d10a-4c4f-aac4-c73eac8f303e", "value": "ARRIVAL NOTICE_CI0499949303.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f4c4b6-b9fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649726284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726284, "uuid": "e418ecb4-e211-4c8a-bd79-ec612b7fb555", "comment": "Malware payload (Formbook)", "value": "d0bd54f6e90647f0a469cb7e4a278a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726284, "uuid": "59cd6290-553c-40b6-ad9b-106180d8dbc8", "comment": "Malware payload (Formbook)", "value": "de730251e1e204e4ee22464f4638e2baa2c64ee9a9520180443f593497678c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726284, "uuid": "b9b9c967-5e45-4013-9b6f-92b41e2bc8ff", "comment": "Malware payload (Formbook)", "value": "5f752af252e15ed0f8383de09df63395f4a1fd38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649726284, "uuid": "d3ee2c5c-b5bd-413f-84b7-eb952398adbf", "comment": "Malware payload (Formbook)", "value": "8e8db69a0abe8eeda02cdb3d89eca70dc03ff15260afdbda748a61b74feda5b76559a911fd3fcc950737f7240bc1d135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726284, "uuid": "c68e3e22-8862-4c69-b8a2-8a785a9c4f1c", "value": "T1F2558DAD766171DFC867D431CAA89CB4FA5135BB831B520BA01706ADEE4C887CF142F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726284, "uuid": "e8f72d97-5557-4b27-9b3a-fb6e827e4c88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726284, "uuid": "cd168391-dd40-4fb8-949c-08238eeb0b25", "value": "24576:q6I7DJhuydBqCebfeuXVgOnZ2AgPzCagEOCLEtpDg:q6ejdBqCafeEVVZ21CagE1EXDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649726284, "uuid": "3f447a0b-f4fc-425a-a0e0-0f57b200a975", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649726284, "uuid": "fd8c2acc-c1ef-44d9-9a20-6f0f60f617b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649726284, "uuid": "985e47a6-a5b5-4dd8-9238-d233c4542075", "value": "Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bdc99a-ba15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649736345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736345, "uuid": "f969301f-22d8-4f14-8ba0-e614b3963975", "comment": "Malware payload (Mirai)", "value": "0e9a51f29c76974738bdb93a81bb727d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736345, "uuid": "f35b0211-ba52-465b-9b79-3d80a62bb755", "comment": "Malware payload (Mirai)", "value": "dec675aa372dd1e387f2c8d24d3d701800a732cff4e28774f99665889d3524fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736345, "uuid": "3f96d904-7b44-4f17-ae97-8b68d58a0999", "comment": "Malware payload (Mirai)", "value": "fe35dd689bf76ec99bd6ea812232fb5de2dfd4aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649736345, "uuid": "176a4601-23e9-499e-b060-9863e34921b0", "comment": "Malware payload (Mirai)", "value": "2f19e5fd455b4f9e2843bbaad0dc7f785c79c50687ad8b586e8e0c6939b9336c9732a52851d4a0fde33f0a4931d1f0a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736345, "uuid": "5ae9cba2-a804-4982-9d1e-d1a2749e0ed4", "value": "T136534A52B32809A7D0930AB1253F2FD15BBEFED111E4F185399FA74A8036E33154AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736345, "uuid": "efcd9898-b51b-48b1-ab27-db1385937fa1", "value": "768:GLIS8DXipYDi98YsRn3MxgsiSSyCgztj7oTAYckGPIv1oUHWlpDosaDbInWS8w6v:G5qDiy9hMKoNQuDDoVbIWSd6Wa10cm01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649736345, "uuid": "9d31cd0b-3417-49db-b4e6-02cdfeda7908", "value": 64164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649736345, "uuid": "21e706a3-5920-457f-a280-1b5593101e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649736345, "uuid": "94bf9657-98f8-4ca9-af32-5e2a48281678", "value": "0e9a51f29c76974738bdb93a81bb727d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b757bde-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649764060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764060, "uuid": "ef80dfa1-302f-4488-9c48-b92999f19df7", "comment": "Malware payload (SnakeKeylogger)", "value": "399339653b8993e01a90ce00f25d506c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764060, "uuid": "2e2f7c77-ab35-4361-880e-d448ba86e400", "comment": "Malware payload (SnakeKeylogger)", "value": "df0d64d789ad8833f2183b082997a3bfe7c4366ce34be419a3e79cbd254be75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764060, "uuid": "a4e727ff-6ced-4cfe-a9e3-18ee7e5ee900", "comment": "Malware payload (SnakeKeylogger)", "value": "90c5680f93c6e300002ec293ce41e4d50b8428ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764060, "uuid": "0af22bf5-ee90-4dc2-94e2-7341a99fcaca", "comment": "Malware payload (SnakeKeylogger)", "value": "defa4eb833f9e2a402cf542f69dc6d7f035160445adf826cce7a9bffee78a2db45bbcadb97245abad6c995232b8f9547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764060, "uuid": "8ebab6c7-d9af-424c-ac50-c5dcc094c354", "value": "T18474BEA65A617283D1986B72C0E3CCB03AE5B0D99219F3DEB8C4CB443FEA194D5147BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764060, "uuid": "3d41b8a1-85e7-47f8-a28a-ec10fab21fb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764060, "uuid": "87e81cf9-c28a-4a6a-a346-3bf76b72ca2c", "value": "6144:BNiXZrPZ0bPfEqYVcc7YHbyq85Gf32OMOYab49PyPzw/7s2RIzOdwRNcw3:iJrxKacVyKMOVU9IcYOd07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764060, "uuid": "f294af7e-f5c0-4df2-8447-323907af6dcc", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764060, "uuid": "85945ba6-a28a-49c2-a93f-b37985a90ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764060, "uuid": "aa77cbf5-6f74-438d-88bd-52c325efe0aa", "value": "399339653b8993e01a90ce00f25d506c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7293c76-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649746658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746658, "uuid": "1c4513b8-c260-415c-bfc0-42da04ab512e", "comment": "Malware payload (Heodo)", "value": "3c370182ee6a637101987fe93801c543", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746658, "uuid": "e75fc4b2-c7d2-4345-89d9-01f10674c8ff", "comment": "Malware payload (Heodo)", "value": "df19669f8b2ef83ee6772d783852e61a7419d6565af6a73e7f42afb8c3886978", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746658, "uuid": "575159a1-3d0c-4cf7-b015-c8406b838cef", "comment": "Malware payload (Heodo)", "value": "32cee1764af85c0cbca87d468159c4e84cadf2d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746658, "uuid": "133ac53d-df32-4b2c-96be-2e2c45b0f9c8", "comment": "Malware payload (Heodo)", "value": "68289fe479d104ed2e3ee9d9b8b8db1ac6c8c9804d4a69faa5f5a54ea6515ac96631464f6decdd4792135ebf6e023283", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746658, "uuid": "ad1ab9d2-8942-4a9a-ad2a-3673d2a6dd0c", "value": "T12F11E59FB364BEF7D90C1971094759B9F07D2638F3E101165E4444667842AF86BF7E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746658, "uuid": "401662a1-a35d-467e-afa3-c553a0e035a7", "value": "12:eVGSGafneA/JYzdYKqHzatCCDuU/MBRsC:eVGSbfnxGihzaHaU/M8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746658, "uuid": "be02770b-b8db-4363-a10c-7a1226132326", "value": 895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746658, "uuid": "47d92449-4389-40cd-8e01-69bb9c87362a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746658, "uuid": "c8dfeff6-0126-4268-9165-f55aa4f20e04", "value": "emotet_exe_e4_df19669f8b2ef83ee6772d783852e61a7419d6565af6a73e7f42afb8c3886978_2022-04-12__065735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597acc94-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649764486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764486, "uuid": "d0256280-d5d3-427d-8c6a-ae2ae04136ae", "comment": "Malware payload", "value": "96a0b90aff977a88db93f3674befdb80", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764486, "uuid": "92fdc5ee-701a-4956-8f89-842af69ffe8f", "comment": "Malware payload", "value": "df22b02f086ac431a0d5687e0b4e96bf57f854bc0f006abb0e8fc67a8d7a7107", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764486, "uuid": "245ba4f8-0127-4987-8f41-50dddaa066eb", "comment": "Malware payload", "value": "15dae32bdb5b30ac5f4317824d3ecc7ab425f73c", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764486, "uuid": "0a3320fe-7b38-46e6-b9ce-2c0c36ef1256", "comment": "Malware payload", "value": "c481fd83434b109678b225329d6926bb6cc998c2fae925b49faaf988f022b956a4ee3cffd48a106eb3acee8ea7761fa0", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764486, "uuid": "335abe89-4fff-4a3d-96dc-20e0340eecfb", "value": "T1C6D46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF760305993951FC2443EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764486, "uuid": "54728794-5801-4b5d-a78f-1fdd2749382c", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764486, "uuid": "024f44d2-a890-474d-a2b3-e33a15f568e3", "value": "12288:D0Ws7IMtR4yVld8bzbBSredLKgFK/UqW1:D0bdkX1ZccL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764486, "uuid": "f54c0910-16ce-4425-a582-4b81f133349b", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764486, "uuid": "ef10ffc2-37a4-457f-948e-c379fd1fcfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764486, "uuid": "2aef7b4c-a77d-406a-9048-c138ce710b96", "value": "PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75468b9-ba19-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649738042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738042, "uuid": "afa8ef7e-d459-4507-a82a-79c0b8f0c430", "comment": "Malware payload (AgentTesla)", "value": "9b8eb2e7545cf8df638aa2e4462f3e43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738042, "uuid": "778b9ad4-d9b1-4040-85ca-30d51c93265a", "comment": "Malware payload (AgentTesla)", "value": "df61432d145d18bbae2c09023908cf832d384f099ae6b00bfbaf22d39cec18f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738042, "uuid": "a3e07e9f-6561-44b6-b166-e0c224e090f1", "comment": "Malware payload (AgentTesla)", "value": "ea3b927668bfabb89ebc666acda2d8568784e9f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649738042, "uuid": "c43dc351-d578-40f4-9c4d-af14404e695a", "comment": "Malware payload (AgentTesla)", "value": "a81c01eb5ea5994834e3f8a8187c579fcfbb03e34bf658db662108d271f1861b17b9f8657b0b9c7ced4aaf514acac89d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738042, "uuid": "5114b22a-f9a5-4e3d-94fd-ad9770755ab6", "value": "T16CE4E02D474D4D6BD67E8ABDC0C4A2855BF2904F510BEB79A442B0F4BF423F1AA131A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738042, "uuid": "7de74a4c-4ea7-4681-b24c-d5c2cb63b911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738042, "uuid": "85827536-1776-4898-9147-3cc3a764c25d", "value": "12288:HL9y4qdMvbLYAR243SP+X2a5OGLJcmPHHLH7c2UgVgzWOf:3qdM3PH3E+X2atLJcmPHLI2/mCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649738042, "uuid": "198a53e9-17ad-4ec4-b7c7-e8c085273a42", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649738042, "uuid": "29cbfa01-f436-444f-b7b9-3fe14fbc34a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649738042, "uuid": "d83de7f6-dd9c-46e7-beda-460784e8d109", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.AHX.genEldorado.6202.13290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537837fd-ba38-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649751162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751162, "uuid": "40e7361e-e3a6-4da5-944b-2d06d6a372a6", "comment": "Malware payload (Quakbot)", "value": "ff8044d1a42fdc1ecd980766d7a6ca6d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751162, "uuid": "1680c07f-d9ba-446b-b35e-160d6a4ae5da", "comment": "Malware payload (Quakbot)", "value": "df8d431b3d7193b0d0d6667b269ef1b2431086343bf86a41c3a2a2488d9f1567", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751162, "uuid": "e8ad0645-3dac-46e0-9cf2-f874bf9d5037", "comment": "Malware payload (Quakbot)", "value": "b324fb311e8da9e494cc020afcb23a03f8c896c3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649751162, "uuid": "02150fdc-8acb-496b-8af9-65ff09a9b774", "comment": "Malware payload (Quakbot)", "value": "ba50208be4f69b9b4c8050026e7892405030832cd7cabae72cac28564d8f8a30b2fdbc40c1aef0dc95ca368aba43a923", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "P.REGO s.r.o.", "colour": "#DFAA33", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751162, "uuid": "ed37661b-2e48-47fe-a5d5-d7f124398a28", "value": "T154151263BA875333C5420236555F93E08FBD9C8C57B2092395A6B74C3DB1666A3FB8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751162, "uuid": "435928ad-e7d0-47a3-9f08-ac51aaa1aed6", "value": "12288:aZp+zFF3Ehqp1LBo/17bB4AzKAVHd9eZ8Ml6H8i4+MZqIR8MFi1nnFbbkUd:aZp+z11O1B9zKiTWTq6ZqnSisG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649751162, "uuid": "c11619e1-4448-4825-b64c-adcb2fa368db", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649751162, "uuid": "85adb735-9ef4-46b0-b303-1d315d31e39f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649751162, "uuid": "2df48a5e-9aed-4c18-9f47-5eb90c964c17", "value": "317.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02094112-ba41-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649754891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754891, "uuid": "fb741f41-e280-4f61-b7da-cc269bc62e41", "comment": "Malware payload (SnakeKeylogger)", "value": "003a69d3089386f93bffab8baafd2e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754891, "uuid": "8e81217c-c6f9-4ee6-8aa5-10bc025a4f72", "comment": "Malware payload (SnakeKeylogger)", "value": "e020049e283e4e07cbd95282a737359f5ea5a496237ddfa729b74ebfeb52ef1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754891, "uuid": "2211347d-4165-4725-9700-469412e9d523", "comment": "Malware payload (SnakeKeylogger)", "value": "e5c630a7dae1e5fde82416d6586ee7f1db681bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649754891, "uuid": "b41ed593-5412-4f85-ab0d-ab0ced0a988a", "comment": "Malware payload (SnakeKeylogger)", "value": "7c8662e45c90ad4ac7126eea4f8f6d1b0ece93d3cbc73545f8617b9cdea68447e628264dc6ac32b18275daa05e7f0647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754891, "uuid": "55b2e038-0d23-44ca-ad5f-62a318b760bd", "value": "T132E4BF15F6B6C902E1B51F77C0EB080407B4AA42D91AD72F3681A3AE1D433EB9D0779B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754891, "uuid": "2cdb0ab6-a2c8-45cf-9efd-2e5e47b70343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754891, "uuid": "be2cad27-5a25-49c9-beae-f9b0795d2d15", "value": "12288:VjzC5/hYGRXmZ4qPdfW9s4cbcSjA8PXyjWSzc4xadEJg2g6:uFfqPdO9sr3AkXE5sDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649754891, "uuid": "cb7afe38-e819-40fd-bf9f-8ddfc8f3ca3c", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649754891, "uuid": "6196c677-4993-45eb-bc20-a5afec99f83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649754891, "uuid": "4829ff0b-f54d-4ebb-bdd5-c81730afd498", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5016d65f-ba3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1649752874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752874, "uuid": "191c7176-d42f-4eb6-8094-b360dce348d0", "comment": "Malware payload (DCRat)", "value": "0f8962289856656e053fdcbced4d9fbb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752874, "uuid": "c1aa749f-1011-4faa-952d-48f6f5773d90", "comment": "Malware payload (DCRat)", "value": "e05abffc33f558efbd3a82264ac553f99935450e13d7606c9554de4a5d0d73d5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752874, "uuid": "7a87c7c9-fd27-42d6-8f3d-cefd7d8ff8a0", "comment": "Malware payload (DCRat)", "value": "f0c7a55c81c682ed519b587aa0a42bd01b89b420", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649752874, "uuid": "96d38596-35af-4d9d-aebb-64eb2ba24207", "comment": "Malware payload (DCRat)", "value": "cf9391fce9663c25f6f190a6f1a7aeb7a42e6fda4d8bd7a203baf02caffcee25705d2e31d565bb924daec7a22ea0fb5c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752874, "uuid": "0b004401-0a56-4629-94a4-56a7935a3633", "value": "T1CE557B037E89CA02D0AD1732C8EFD01847B8AD436A66D72A7E9E73AD15113E75D4A1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752874, "uuid": "dd53776d-fd60-4029-9470-bd72c0635c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752874, "uuid": "60d51af3-f175-4ffc-bb4d-1fad507b0805", "value": "24576:dQ/uxY9zm6xWaaTW3icQadL7AvlwQzZi41EzG7zBY:qoYBRZ3i4iviQzD1EzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649752874, "uuid": "fff18f5d-6ded-43a7-8186-2ade07d33839", "value": 1323520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649752874, "uuid": "50762370-a444-420f-ae9d-796d07a3bf6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649752874, "uuid": "7cd2a489-bc7b-4ba8-8c32-f905941ce730", "value": "0f8962289856656e053fdcbced4d9fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e92045-ba2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649746363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746363, "uuid": "8294c33d-3701-4ff4-a63a-8942923334ae", "comment": "Malware payload (Formbook)", "value": "0ee640b931661a4812db144f6872bbe5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746363, "uuid": "4e9f58c1-f5dc-4c8e-9919-9fb5942f7436", "comment": "Malware payload (Formbook)", "value": "e0761ce54cf38abf0debbfa48ce960a8f2a8e26f1b18aa589bab17bc624ae2e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746363, "uuid": "aa54f137-40e5-4978-ae4f-abfdd4e1319d", "comment": "Malware payload (Formbook)", "value": "3122707c693bac1798175cab74398d68740abb8c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746363, "uuid": "8dad5ab0-3563-45a8-ba69-755f4dc8a104", "comment": "Malware payload (Formbook)", "value": "9cb1b507ff60d0a9d234b1b4ab7b0f1a522be82cf4fb1b1aa4fabdc123b0715d54603cee4f7e617af74abbc4686af0a4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746363, "uuid": "690ec8b0-fe72-4b8b-8d1f-d7a5057a185a", "value": "T1481533CD1EFBBC2BC7F0AC786DA343A6D887381033051C682D095A7B1BE5469DC62B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746363, "uuid": "720ac056-aa1c-4126-831b-e022368fd0f8", "value": "12288:/gXiRidz0wdHafeArCAaLbX59eu1vCIKjz7noVZSlTSrSfqpkUget9Nypm93p4jw:/guiWwd6feKCAybWugHj1lcUVgb4eME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746363, "uuid": "5203e729-5916-481c-ad4c-ceb8fb125439", "value": 916191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746363, "uuid": "61334b16-0e1f-4514-9369-e42bbbea8520", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746363, "uuid": "17fe8376-af33-4d01-93d4-c5a55f19d0c8", "value": "PURCHASE ORDER 443726 pdf..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee56ad85-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731665, "uuid": "8ca98edc-792d-4d58-a6cc-9e27853cb4d4", "comment": "Malware payload (Mirai)", "value": "268b18393b69f782d64188ab3cc99ff7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731665, "uuid": "738d285a-085f-4f66-ae70-6c22d9dd91b5", "comment": "Malware payload (Mirai)", "value": "e13b7fd8ed64d5a3a9de58465a7fd5def000394fbe85232116cc3ea69d42c07e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731665, "uuid": "77138925-df95-472e-bc80-11b4cf138533", "comment": "Malware payload (Mirai)", "value": "758f3c8de3a0740d8494e1063ab9e0553b09201b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731665, "uuid": "f627a114-7090-4698-9c19-09638373a89a", "comment": "Malware payload (Mirai)", "value": "9f23723245dbbdc09a84403a614d07439088703581166d21046a6bd5193ac98f5d3f8319eec2ee859c0059913243b29e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731665, "uuid": "424ec178-68fc-4a81-99dd-304bb015c0f2", "value": "T1AE532985BCA1DA25C7C453B7FE1F018D371487D8D1EE3202AD285FA4768BC1E0E6769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731665, "uuid": "c615391c-0f10-4dcf-9345-49765a2b139c", "value": "1536:CNL4Si5acCiitYT1StRyT4FhS68kwsagBik02S:CNL4SiSLYRStOwzpvBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731665, "uuid": "5c42aeff-3ad7-4498-b724-7db06dc519af", "value": 64988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731665, "uuid": "7dd78a3e-ceb8-4c65-83d0-b182aaeeb442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731665, "uuid": "420f2de4-65b7-48e3-8ac6-3878d47957c2", "value": "arm-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb814ba3-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1649765966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765966, "uuid": "5a9ab658-030b-483f-a817-64e20d77c054", "comment": "Malware payload (FormBook)", "value": "94f372018055101ad297397aa18e927d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765966, "uuid": "1d885a48-08e2-4a64-bd0d-f71b098d0f46", "comment": "Malware payload (FormBook)", "value": "e19a7acadc079689e5e4f30e6007b88b2f2860d60602ec06fb123163864fcb97", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765966, "uuid": "79abd702-3d4f-41af-9bfd-4d795bd69802", "comment": "Malware payload (FormBook)", "value": "df5bcd24580f575336cea5a2f92763e067fc3be4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765966, "uuid": "c391207b-479f-46c1-9663-dee61f146c07", "comment": "Malware payload (FormBook)", "value": "242c903edc9f9fa8fbaee0cedd3a7f243bfe7906bcf2110ecc4c214a6e0232223314b2cfc0e0a85c9ac7f6576b0aabc8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765966, "uuid": "71f91c81-4357-4645-8001-fc72a528bda2", "value": "T12FD4F17E8D8C696BE77D56BDC080518927B1850B415FEFD8AA04A0FCEB52374B93318B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765966, "uuid": "42086da7-fe95-4996-b62d-308df7d0f004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765966, "uuid": "c5a42de2-baeb-4b26-983a-41a0bddde524", "value": "12288:qjKT34qr5aX9hT3bzmU3nQmC8ChlVQatx8kA6MGbnLmgVgz0di:u9qrcL/AmAzXT8dGbLRmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765966, "uuid": "4110ad4e-c9a9-40a7-a5c8-13b9e15e295d", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765966, "uuid": "c60024a2-8c65-4715-9efd-f7876cd2ca5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765966, "uuid": "e8f333fb-2989-438c-813d-7fae7861a1bd", "value": "DHL_April 2022 at 12.M_9B7290_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc033efe-bab6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649805481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649805481, "uuid": "11e12622-9c17-4029-a1ad-83b963aa455f", "comment": "Malware payload (AgentTesla)", "value": "df286ac2013afa8e9a73593b13e117bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649805481, "uuid": "b3b3de56-e181-4664-8548-1ef6dcbb7ef8", "comment": "Malware payload (AgentTesla)", "value": "e1f452aa64e8896f296e81519469247989b9a2912807df8225d3b717504182c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649805481, "uuid": "79e5f323-5c8c-4fd6-85f0-ec6b64cb09fc", "comment": "Malware payload (AgentTesla)", "value": "eaf9e5d37c64ee46b503ee338a149bc0268428c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649805481, "uuid": "f1962abc-afbd-4c00-9eea-122b723ba953", "comment": "Malware payload (AgentTesla)", "value": "01c0149d63c7fba34beb23d8324a433971f06460fb14ff4ea5b06292239c15fe5847138226ee4205dab17e5226f37a22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649805481, "uuid": "1c32d765-a435-4050-a473-e844266949a1", "value": "T17BB4D061DA846AD3D0555B74C8A2DCB03AF5B789821CF7887CB4F6492EB51C2E011FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649805481, "uuid": "e756d67d-93fc-4447-8f44-c4a0600316c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649805481, "uuid": "adb45de4-8f4e-4fce-bc8d-98fe31e2716f", "value": "12288:htsJrxNDMUnBb00E7bZ7uPadrdOj+EY05lQdVHyRfqMq:h+3vnR5tPahdOj+305mefn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649805481, "uuid": "7e18fbe3-1def-49fc-aad1-177c28a2884b", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649805481, "uuid": "1b680961-9d2d-4835-9000-0a736e125dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649805481, "uuid": "6683b46a-77ea-481b-8cd6-379ad24e5bca", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcf84f6-ba43-11ec-8e58-42010a9c0032", "comment": "Malware payload (sLoad)", "timestamp": 1649755773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755773, "uuid": "95c2051c-cefc-41b6-890a-ced8829687b6", "comment": "Malware payload (sLoad)", "value": "3299ac1d0b87f0d40e92599ffad415eb", "object_relation": "md5", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755773, "uuid": "2dd66b6b-357b-46de-a078-fc7c2e96b47a", "comment": "Malware payload (sLoad)", "value": "e26dde5cc79201401a9fa1f4f203ab28da7280088bb24f6c988c7cb0b602db9a", "object_relation": "sha256", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755773, "uuid": "7499900b-bfa5-48cb-989a-71fe89852700", "comment": "Malware payload (sLoad)", "value": "530d513a2d214ab638e9e6077b40198fc2907b2d", "object_relation": "sha1", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649755773, "uuid": "cb25905f-a5cb-4df2-b5f4-506cb32d9653", "comment": "Malware payload (sLoad)", "value": "b2a75128354ff5d8bc2942fea2043ed76004c25d926615e190da204046b450e8bff21eb6749794ba1d72500c1f4d8141", "object_relation": "sha3-384", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755773, "uuid": "ec57fd64-ac96-4ab1-ad76-4afbe20691c9", "value": "T140B36DFAD824FD96E67C2B504A3D39AF10D4F04FAFAAC2775E89405D70478A1BE9804D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755773, "uuid": "42807c38-2364-4193-8de3-8042f5754c72", "value": "3072:fDCPMh9A7u6b38/FRjQzuTdBEPn9y2FO/Umc9l4T:H9A7nA/FRjQzCBEPnpk/U7l4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649755773, "uuid": "0d4e1246-d8d7-446f-b95a-8ba5261deddf", "value": 114599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649755773, "uuid": "dc3c0388-ba49-47e0-9adf-7b32b83235c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649755773, "uuid": "65b47eb8-5a91-40c6-9e05-6de5b9263b72", "value": "e26dde5cc79201401a9fa1f4f203ab28da7280088bb24f6c988c7cb0b602db9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dc1704-ba5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649767804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767804, "uuid": "1f8698e9-717a-4589-9b98-45263756b13b", "comment": "Malware payload (Mirai)", "value": "8d3c3ef2df378c1bdcc45cd0bf3cbf3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767804, "uuid": "efe1eece-7231-47f5-8789-bcdd445f655f", "comment": "Malware payload (Mirai)", "value": "e2cea6c0284b0ce647eaca18e6612be7fed94907e18d815f5849f0212727ddf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767804, "uuid": "038bc42d-d195-43b6-83cf-5c8c6b21ca26", "comment": "Malware payload (Mirai)", "value": "e84a9370d5d8abeb75fe0786045d50c08fb8b81f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767804, "uuid": "bc70fa5b-1f92-4c0e-9c5c-4620c6f16513", "comment": "Malware payload (Mirai)", "value": "56b40fcfc9bea62ae9cf63bc69475d9c6f81369dd7ca62f57c8bcb8fcab14dcf65c0ab9fcc3201d0c97a39787392d474", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767804, "uuid": "419c47f6-e8c6-4e5d-ac3d-0221a1ad8b43", "value": "T1C2B2E199D7FB27C3C2A19336E07C4A5EE2721AC10747450A5109729FA39760E87FB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767804, "uuid": "58adb351-1d16-4127-a047-cd6328ee0ef6", "value": "768:R/QOC0Yhn6ROHWFlAcwNEFCnNBxcK8cSl:R/nihneFnwTNBaKLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767804, "uuid": "33e1975d-7851-4432-b656-31f95dbef309", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767804, "uuid": "6d2e0561-8965-47e4-8aa2-1d217b728150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767804, "uuid": "5619faad-fd6c-44c5-9027-894e8a64b496", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10dc186-ba4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1649759506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759506, "uuid": "60154b54-0896-40a0-bed2-9799c39f267f", "comment": "Malware payload (Gozi)", "value": "ce956c480e303a9f77422054365f8e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759506, "uuid": "cf6c8425-c296-4735-aa44-4b9298f69375", "comment": "Malware payload (Gozi)", "value": "e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759506, "uuid": "9a44e0c7-d6d4-4099-b12c-a9bf7c7b1318", "comment": "Malware payload (Gozi)", "value": "8e5f8b5043e92d425a3731cb2c12bec880279974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759506, "uuid": "f9963792-fb80-4088-b4b9-0b30d2a4831a", "comment": "Malware payload (Gozi)", "value": "f5928bc8f608c9a5e0a5bd246cdfa80caba378d381a9c9c4fe2dd69b7c962b19dfaa21390a92029c062ac11063d1087a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759506, "uuid": "02ebc872-86e7-495b-8396-a2138d76467f", "value": "T105C45C00B692E03DE8B731F94FAE912DA51DBED0172050C753C51BFA9B366E07E3166A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759506, "uuid": "dd3a557b-ec7e-4c2d-a3aa-cfac4fd5bf03", "value": "3743526d94457fb013584724635b7f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759506, "uuid": "cf5bfa95-d411-41ea-84f3-32868a26cc48", "value": "12288:Jt1GYxq+AVzmKoXmysHMZmaOeVIKjoiUBZ8TOXXGN93Wa:JtQkQmKoXmysHMZDVIDWUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759506, "uuid": "35825a81-0e34-4f06-8fa1-775f843dcc33", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759506, "uuid": "72accd47-693d-4500-b7b6-f9530e1b1eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759506, "uuid": "2cb72d3e-5050-4313-b25f-38c5f4d5aca6", "value": "e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f71e40-ba4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649761205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761205, "uuid": "7e8dd380-b281-4cd3-9585-389f596f897a", "comment": "Malware payload (Mirai)", "value": "bf7a2a66dd0c110b89a74e3c26e3d9cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761205, "uuid": "b5e34a5c-2e23-479a-8f32-285cb10b92e0", "comment": "Malware payload (Mirai)", "value": "e40ec1e29b3da064ad7386711172d4a53b12e768103870eb55c593ea76c085e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761205, "uuid": "4671eb48-d85a-47a3-9886-697493bfacba", "comment": "Malware payload (Mirai)", "value": "77c941b513af7b9b20f8757a8702f22421cb4264", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761205, "uuid": "1c94958e-3cf2-416f-82c5-b333621fbc34", "comment": "Malware payload (Mirai)", "value": "da4e6f6a57fc1698d32743cb4889c1663e10a2d691e34db4b2244f48e264c99bde74a4e70c278b556d75e74b942177c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761205, "uuid": "4acc3d0d-4c2c-44fb-89c4-610c12b3d993", "value": "T14A13F24178225092E2E0A43FEFA863C615ECC729B3FCBA751774EA1982D1A552538D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761205, "uuid": "c951d705-4b77-4108-a1d1-af0250585218", "value": "768:2KQ2+OXSas5oLFv54+HdqF0ogOxGsLqalobidjsv7te1JHHs3UozO:2Kn+Oias5oLFv54tDrobX7te1N6zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761205, "uuid": "1881d21b-88aa-4496-bcd9-3fcce83bc49e", "value": 43976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761205, "uuid": "7d5b2736-22de-4c58-a914-eaed6f94da5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761205, "uuid": "27c0ac48-a10c-4a1b-9e35-e52665440ae7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508e81fa-ba30-11ec-8e58-42010a9c0032", "comment": "Malware payload (XorDDoS)", "timestamp": 1649747721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747721, "uuid": "b7c53177-75ce-40b1-b84b-0eb62ebcd027", "comment": "Malware payload (XorDDoS)", "value": "a1c68c2ad7f6a8e2b284d7fec954bff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747721, "uuid": "3d898072-f5b4-4ca7-9836-2cdb3d7c7eb0", "comment": "Malware payload (XorDDoS)", "value": "e41250c9429d8da27b2222fae2fdc3aeaba07113d5f966e411151d0a17deda46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747721, "uuid": "d9278180-83ac-475c-a4aa-c6c1ffda6d67", "comment": "Malware payload (XorDDoS)", "value": "6fd8ddf18858dbed161e43024fb317bd051c0dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747721, "uuid": "4d102984-589f-4619-b767-9aac41b0e258", "comment": "Malware payload (XorDDoS)", "value": "e76a98eee00d1b3535a1742f36807f6a1d26ca547180217220c080f8484c4903ba4259c6df47a06794d1a3498ab312b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747721, "uuid": "fdd753fd-6189-4fb1-9329-d842cba9a485", "value": "T15F93025DC2F0F2E06E36896D645075B523ECE65EC61E37C0BB11900CE77BABA8D80356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747721, "uuid": "955cf99c-e594-46c0-b92e-bd9f08b9643a", "value": "1536:hbFSJxF7Ha/H295SVm1r5KB1yu0MV2ugwd2M9he8A3Vq5uSIFsM5yDiwOtcSkXZY:hbFSDF76/jG5KBwu0gUU2M9MhsI6MpaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747721, "uuid": "eb7ad39e-68db-41a7-866e-3789195d5536", "value": 90167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747721, "uuid": "16dbad42-031c-4aac-8ecf-4abc20975058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747721, "uuid": "da8a32ce-6b2f-4818-a0ed-8735c8bd63e8", "value": "intxor2.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e568770f-ba47-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649757849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757849, "uuid": "6f46be28-d9d3-441d-b573-9650872b00a6", "comment": "Malware payload", "value": "c6091c43994f68bca3f742c6f9f2bf9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757849, "uuid": "a718672d-94ae-40b6-ba61-6e86274e6391", "comment": "Malware payload", "value": "e496644568a2f83a9937a2e38540b1ea9995942f0d7be528ea6ca977af603f2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757849, "uuid": "444748d4-9fcc-4041-adba-d8d56382a7b4", "comment": "Malware payload", "value": "ae5f2904f95b9b0e5a55be41450f0e0487294104", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649757849, "uuid": "48979566-0aa2-4376-9504-0e9cbc0cc3d2", "comment": "Malware payload", "value": "b82f2063e15e60868ca795642326b7a5cf2170f79caf5ad037fb6d2a6796fd46fd7280cb4591ef59683b6648ea6f35bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757849, "uuid": "49b50651-55df-4296-8427-ae85eabcd888", "value": "T1C3142A2638EA80D9A3A3BBC36FC7F4FE56BFF5B7552D21B611800A0907D1A548C12776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757849, "uuid": "8cbf68d7-d65d-447d-a679-1fcc321d20b5", "value": "768:gUUUUUUUUUOUUUUUUUUUmUUUUUUUUUQUUUUUUUUURUUUUUUIUUUUUUUUUAUUUUU1:tVMcNYz8FOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649757849, "uuid": "9efa5a30-a9c8-4df0-8efd-cf3b7f34ea41", "value": 190370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649757849, "uuid": "bbae915d-8781-4d13-b932-2fc88a3d877a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649757849, "uuid": "787adfff-479e-4ba9-a594-048d01b24aac", "value": "Done.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b330b6ae-ba85-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1649784394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784394, "uuid": "0d185598-adda-465a-8207-707ae54a194d", "comment": "Malware payload (NetWire)", "value": "2d761de5722859df540fa809849d1318", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784394, "uuid": "2ed923c3-f391-4d26-a970-49b355bab52b", "comment": "Malware payload (NetWire)", "value": "e4fdf5ead09b850c4e9de74f0a4bc7816e57a6ae1f8334f3222d46b0ac9bff15", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784394, "uuid": "928f2cf5-c9b8-432b-924a-d0d25aabface", "comment": "Malware payload (NetWire)", "value": "2b3b25c428fb1bd08e4410d692be9a6b1f2143fa", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649784394, "uuid": "2b437482-0347-4cb5-a17a-3b04ec9a941f", "comment": "Malware payload (NetWire)", "value": "43265ef10ba86192de86cd6d9cd844c5b979930bbd4f199ae94cd78d96de18ef757948ac5958f0d9f3ad9b2116930b02", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784394, "uuid": "221c72f9-4bc6-41bb-b1ed-edba5ebddb3c", "value": "T18E018ED155B48DE3BC5B083518EDE15296EE0CCBDF65C751258894DA0D744E6481D3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784394, "uuid": "0b3bc13f-38e1-4216-aed7-0b925c529ce3", "value": "12:+v/rBV7P3i2v/r+usSqXyv/r+usOSZChG5QNkGN4GvJKJTq6E/UpTYqvAg+HSIna:QtpMS/BN3N616UpTPAPni5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649784394, "uuid": "b35470eb-6a95-44f7-8d5d-b1ef04f919d8", "value": 782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649784394, "uuid": "1757d518-bb45-49ed-a8bc-582ac4c7c78d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649784394, "uuid": "7d360efa-2855-4ea1-b863-f8b839d56093", "value": "OGBEYJQPLFWNSACXAJPBOA.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5479a668-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767055, "uuid": "82fe548c-2efe-435a-89a2-55798ca6706f", "comment": "Malware payload (Formbook)", "value": "cae3dd5fc06dbffa48ba5ef80058792b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767055, "uuid": "dbf2e739-ae6f-48d8-bea3-8ea317696eea", "comment": "Malware payload (Formbook)", "value": "e515ec1d3a9ccc443d006bc100a43d2c5402ab3e74d4079aae9c2f110d496b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767055, "uuid": "88c32d73-5fe8-443f-a8d4-276725c11f4c", "comment": "Malware payload (Formbook)", "value": "5976bcab40b01049222f35a344fa83f88d824fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767055, "uuid": "83286a81-a003-4968-bb73-233c5fee906d", "comment": "Malware payload (Formbook)", "value": "f4e5e9c880bc3070f1742de1375406af107bb90ed624c79cdaedb5cbb5577ea83bdb29b82b58f8b00aaf625297ab1187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767055, "uuid": "6fd17fb0-b2db-48fe-9db0-4fa208679ae8", "value": "T1D074DF4730EC81DBE0AD1DB01C29F72D266A6F7225208D06BF51FB4A653A94351FBA7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767055, "uuid": "0b6c3066-ffc2-45ff-a83e-78e5d0f54ed9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767055, "uuid": "d09ae4a0-179a-4313-ae6f-107c581457c8", "value": "6144:QNeZKwzd7EqLVf6VjombYhus/XbgkDKL3ChMMHdwB:QN/wx7EqLVSFo73XEkDKLEMMHdwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767055, "uuid": "d466a984-0b46-4687-a5d6-40ad14202d82", "value": 358496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767055, "uuid": "188bb5f4-d466-4bd5-a269-a0b955d8a669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767055, "uuid": "5e01ad36-f6fb-494e-aa96-f81cf353c280", "value": "cae3dd5fc06dbffa48ba5ef80058792b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5431ccf1-ba67-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649771349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771349, "uuid": "dcde5e1b-2bb4-4a2b-a942-83c790df2ff5", "comment": "Malware payload (AgentTesla)", "value": "0fd60723c16cd1b415ec7a44d34f913a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771349, "uuid": "4fc6e3d4-e346-404a-8bcc-11e73ded4230", "comment": "Malware payload (AgentTesla)", "value": "e531fd29383f5ff3aa1296136df7907e681f5e46a8de1591388da0de2c75f6d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771349, "uuid": "1684f6bb-81c5-4bc1-b092-734df1d1d470", "comment": "Malware payload (AgentTesla)", "value": "3718e6f054c68e6bd191d6c6d8d1948db7c2191b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649771349, "uuid": "d5904efe-5d2e-49a1-acdb-71acd913b926", "comment": "Malware payload (AgentTesla)", "value": "5d5ed51bf0ec2dbba645752afe29e08cf999f1bcbeb2b0cff9872b85facc981e9bc776e62ce7c591c998560edd81eb4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771349, "uuid": "1cacb7a1-1ab7-478f-bc0b-715f402a5d37", "value": "T1C44412683570C1E7D1B22F311E3BA7296FEB992528B4865F03705F1FBA32A42E50E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771349, "uuid": "a027cbbf-77cc-4fe4-8e2e-a5933844868b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771349, "uuid": "72307210-abb1-441f-8da8-4cd996517a8c", "value": "6144:HNeZmlYF0Ky49+AwfisUC8+DGPRn808sGwLBu8KUsfHryyWp7b1t:HNllv1PUl+DgZJGcBu8jsv/W1pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649771349, "uuid": "93d4b606-e528-4bbf-9c38-d2bcbdc42543", "value": 272924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649771349, "uuid": "a8e979f1-b07c-4f22-adf5-3b640cecd80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649771349, "uuid": "4efc7429-ff31-4625-8c16-ea406c61529b", "value": "Shipping Document_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640d7083-ba48-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649758062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758062, "uuid": "4816fbb9-5043-423f-93dc-bea26d04a2a3", "comment": "Malware payload (AgentTesla)", "value": "df7fc85d95cde61f73184009da133317", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758062, "uuid": "dfa6d5c7-5bcc-4fc8-bcc6-8c0cfeaae5e7", "comment": "Malware payload (AgentTesla)", "value": "e646d3583ef92b40ec7abb0667f6385374497c765cb33078a6c2d3b78353dca4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758062, "uuid": "d42a60b7-5164-4494-9808-940fd97e6eee", "comment": "Malware payload (AgentTesla)", "value": "2862b672dcd3cfda78b798e35ae507b050270cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758062, "uuid": "a371699d-1015-4b61-84a4-507b45dcb1b0", "comment": "Malware payload (AgentTesla)", "value": "66ee9f561a099a5ab04f4ad5df287d5211d6b9b9d5a1f15f64e54283a76ea4ba77664de6e869624b807a235d43807ec1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758062, "uuid": "ba56e2cc-6780-48a7-b847-fc2e3277ef65", "value": "T16335F173BB56DD97DDEC86780461BEC6A3F18223924BD74FACCC91A6B3826D857010C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758062, "uuid": "83271bbc-7dff-4f0a-b144-d7ea13f16925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758062, "uuid": "8d2fc376-d502-40b1-9b32-445703c203e5", "value": "24576:XdBqCebfeuXVgOnZTgpMWKcRTKzXL7ptxKXAKZ2:XdBqCafeEVVZTgpRtT8XL70XTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758062, "uuid": "25a89931-be1a-4c67-8e20-8906564f7ca6", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758062, "uuid": "3d5ccbb1-7bc8-4742-998e-aadbda549f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758062, "uuid": "c2bdc8b9-a3bc-4ba1-b28c-ee89e7cc251e", "value": "220412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c10cfe-ba4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649759990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759990, "uuid": "fe773bdc-23b2-4c63-bec0-4c8a96340431", "comment": "Malware payload (Heodo)", "value": "94c9819babe102635d8e5f6e3cbc2eb0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759990, "uuid": "5c7cca01-dae6-44ea-ac86-7d12105f48e9", "comment": "Malware payload (Heodo)", "value": "e75b8d52219d033d5820bdcc6915ad08b0c9217d52df0f045fb60362b8a46785", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759990, "uuid": "429b976d-5f58-4cb1-8d08-662f28b7d900", "comment": "Malware payload (Heodo)", "value": "d7db18b2852fc1d2acbf2d4635bb5e054b4b6c05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649759990, "uuid": "d8f1b3f3-866d-4b55-bab7-76f653aea6c2", "comment": "Malware payload (Heodo)", "value": "07f87090bc7786711355e8d598478dda248b93d4bd9b53263e81c2af6423c324f6d47b475149be55e32b546a38f9f59f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759990, "uuid": "b56fbe9e-1ca6-4bc3-bc8a-bbe4f2ffdb03", "value": "T17894BF40B1DAC476E5B62A30957243F25A79FD02FE38C28FB354BD8DBD316408A3576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759990, "uuid": "511d5ccf-0c66-42e3-891f-a75ae801f44d", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759990, "uuid": "ef4728c8-9170-455f-9aa6-e59068cf8dea", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYqq/9CwUS:3Qw+CM2n9+6qsRlSLhIe9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649759990, "uuid": "80ad8ddd-76d7-414d-a4db-4291dc55b088", "value": 409740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649759990, "uuid": "6dee0d68-1b54-460f-b1a9-146385dd28ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649759990, "uuid": "803cea71-2a50-43f1-9f12-ff5eb7dc19db", "value": "emotet_exe_e4_e75b8d52219d033d5820bdcc6915ad08b0c9217d52df0f045fb60362b8a46785_2022-04-12__103946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbd11f4-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649767686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767686, "uuid": "b6e6575a-19b5-472d-80e0-0438ad0f5840", "comment": "Malware payload (Formbook)", "value": "8c3fe5b3177bdef904c64cb1b65d1009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767686, "uuid": "620001bd-1254-451e-bdb5-bc333b235714", "comment": "Malware payload (Formbook)", "value": "e9a5fa1e217bd7dbbb5b055250c3818d3372a77cfe3cb2f397e251583accfd6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767686, "uuid": "a0fbc9a8-1020-443d-8df0-83192ccf41fb", "comment": "Malware payload (Formbook)", "value": "24a3a9a3162eb2e0ddebad5979abdcbcb7702918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767686, "uuid": "83700407-76b9-45fb-8eac-312158eaa22f", "comment": "Malware payload (Formbook)", "value": "d7c336f92f208edff2bef242be012b3d10dfb51d6cacf0473e74dcf7906afc83bb1cb8e797a32c53ca777b3681bed2db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767686, "uuid": "3cb02161-5034-4056-8331-4d36e2181b46", "value": "T1EFF40154E5AC7EE6E51E03F9D864E40827BAB31B642DEA082DF2B8CB50723C27551D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767686, "uuid": "068772e7-b02f-4558-9fa0-641cad730d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767686, "uuid": "c5cc1094-f208-4a24-b321-122aff5165c1", "value": "12288:7M0OdqVp+Yq9zHZaWyrwo/87GJX0/b+eSB6cwcU0Wx+rMCGZAq0zZp953V4qv9Ys:wCEoE6il2dVM+UZANLLF7vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767686, "uuid": "bcfe472e-ff52-4812-ad1f-ec2f8896b0b6", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767686, "uuid": "d61c82ac-5e27-4bf4-901e-6c725a3d5eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767686, "uuid": "b20fe6aa-19df-40b0-84a3-91b1bb0e4397", "value": "8c3fe5b3177bdef904c64cb1b65d1009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2372ee3-ba60-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649768474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768474, "uuid": "370ee5fd-c4a4-4617-9469-3e79c983ba3a", "comment": "Malware payload", "value": "313b2ed7de81ad804a7cb86b392428c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768474, "uuid": "53e8935a-6e6d-4646-bf8d-056df215bd31", "comment": "Malware payload", "value": "e9ad445291d4bd723c3d078a7137af48f3d375a25138b776eb4625ac07d6c1cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768474, "uuid": "4b07a68d-457d-4ecf-9c25-ac2ab2770d37", "comment": "Malware payload", "value": "87c9f24530dc4da28593464d58ad2b88671fca70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768474, "uuid": "668d1fbd-659d-4cc8-9365-120c78bc105f", "comment": "Malware payload", "value": "a4aa24999b20ac0e9fac58321ec8965b4c7b4125fe85bb25973ef81ec49ecd359ab776a3e584d5b4e6482c1effa6c8fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768474, "uuid": "7a267ec6-13a0-4266-92c7-dd66ee597d86", "value": "T194B47C117573E171D422C9B08D7CE99A751DBC680B39AAFB73EC262C6D752C05B32EA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768474, "uuid": "8b0fedcd-e47b-464b-9030-f8df0bc1a829", "value": "99f15719fda7d5325839c5d213a20b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768474, "uuid": "01f16bfe-710d-4b0a-bd61-7c9058eea50b", "value": "12288:qQ06YXH+OeO+OeNhBBhhBBRsQVoqvc2jzbAVTTAPlbPxIMxjHNivhFg:qQ06mstfzQAPlbqMxjSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768474, "uuid": "37cf8a45-59e0-4066-bdc8-1cec1d3928dd", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768474, "uuid": "b3d1d6d2-5b0c-43c5-8869-e0ae8e79f0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768474, "uuid": "e9a93ee6-424a-4e1e-8d3a-18ca5bc6d108", "value": "e9ad445291d4bd723c3d078a7137af48f3d375a25138b776eb4625ac07d6c1cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f1bf03-ba9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793233, "uuid": "3e871ef7-4a28-4eb1-b8c5-4fc4e7f5aaa1", "comment": "Malware payload", "value": "1ee605d40d2d63d56d5448d6ac7a6ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793233, "uuid": "07ede752-77cf-4e4a-83b1-4c64b50afa6e", "comment": "Malware payload", "value": "ea48219b9373c0b5a7a440f3b9a382aead6b28b846403890a039c5e712695159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793233, "uuid": "e5ef8c07-9397-4268-b26e-97f09fc80ba8", "comment": "Malware payload", "value": "afff8d9202d28e7838ab1937b8500e41448b9f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793233, "uuid": "d0850e9f-89bd-4741-ae5e-2183992bc405", "comment": "Malware payload", "value": "3493f9f2eb2ae9c6dbca0b6c9dc008a3b9ce4033974f9a72b5a49fbef7885cc1759da3509706410a23a34df8c9ac289e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793233, "uuid": "a6950c7f-3f63-44c9-879f-c59e74722b1a", "value": "T140759D127A44CF02D06A9733DDDF861497A8AE912A26D71F7E8E339D15413BB9C0A1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793233, "uuid": "10f8d18b-59db-4e03-8a96-e14a7115ec97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793233, "uuid": "b7cfecde-9cff-4d92-9daa-44c0685f943e", "value": "24576:w1X0albgOkFzcg8Wf6uQYQvmANsh6S6TBO6Y/IMgDdvRsSnk9LA2GRc:ipkF+Qfh6TE49RbnIct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793233, "uuid": "e30cc17f-2c9e-40e1-848a-18373c826904", "value": 1595392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793233, "uuid": "dc176df9-3c88-431a-92e0-5d9d860a8e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793233, "uuid": "b079b614-e1ad-46e3-adec-b118e32dcf5e", "value": "87NJZMK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1f852b-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764353, "uuid": "426fc057-b033-4521-b35e-6789a18eecd1", "comment": "Malware payload (Loki)", "value": "973b2532027e535565e6ae75ff9743f6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764353, "uuid": "ca09a69f-e259-48d6-8953-a827056804ef", "comment": "Malware payload (Loki)", "value": "ea4ff1d33cddab558ac2deb215c69cee53622f6b1e1611aa4bb817e60d0469a1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764353, "uuid": "b9ed91a1-6dd8-4fb0-aa99-490ce627409a", "comment": "Malware payload (Loki)", "value": "a55c6bbfa6963bf2f77ed2945feb722fc2371e61", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764353, "uuid": "f2df731e-f1e7-44f3-b410-d077e7460138", "comment": "Malware payload (Loki)", "value": "48094d235bcf4e297eef882da54877ff291dbe3ecedea1f47bbdab8d0c61141f65dfcc60e55af379983bbcefe0f99121", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764353, "uuid": "f8fe3dbd-de90-47d9-9694-e74f90a14c65", "value": "T18C74230CBF516F1BDE2769F7D4CB50A51368CCA823F45F4658523F2AAAB27F02581227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764353, "uuid": "a89fc242-7d76-4e74-96f4-b84b9a7a5ef3", "value": "6144:01QYZ2ZoQZqUhRHX1ZwHKGBsYJAv31Z5xTx5Cv4qdVB8Hceaqm9N6eLDAvHO:01QxZbV8jiIAv31ZnvCRdX9eaquNfLDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764353, "uuid": "5cd15fc5-44ef-44ce-8bdb-b5a1d3b7e4b0", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764353, "uuid": "44e04d73-308a-459b-bb94-b21b8c5a3155", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764353, "uuid": "52cba0c5-73c9-41b1-ab59-9408fda381e6", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87b7315-ba1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649739789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739789, "uuid": "bad5ca56-b86b-4937-b5d5-9f2e1ebcaccc", "comment": "Malware payload (SnakeKeylogger)", "value": "697c985cb7f119265f0bb49de543ab34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739789, "uuid": "11bdf354-022e-47d2-bbb2-450a428e0849", "comment": "Malware payload (SnakeKeylogger)", "value": "eb3210b628ab723969c0e007b910b1b3898c5e901a28fb7ce99321535488bd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739789, "uuid": "71c1646f-6e7c-4a5b-847b-f1afbc4d4f8f", "comment": "Malware payload (SnakeKeylogger)", "value": "1f713b0459f2bcbb141110b055378347413e537f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739789, "uuid": "6ea5744e-4282-40ff-af5f-712d387ae729", "comment": "Malware payload (SnakeKeylogger)", "value": "f7042d95124c8d149f1f6c8c791bab2ba442f1b354c942b19acb06aaa48a38ca53095f2bf46df3eb1de01e641ca247eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739789, "uuid": "6c838f5a-fd93-4a89-b114-34f754ce42ec", "value": "T129D4E0117AF88615E5FE07FDE47801804BF676276817E37CAE05A0D92D633D0DA43AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739789, "uuid": "8cc5367a-4e53-4760-a3a7-0c277e689617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739789, "uuid": "c894811c-70c2-429b-af26-4a6b0e682e61", "value": "12288:RkKUk6/m4qCuQs991tosrXPpAyhCROsnDxCcfdgVgz:RkKX6/Nq7316sjphCROsDMcfem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649739789, "uuid": "7ee6aa20-d4d6-4551-8f4e-e4158ce57f0c", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649739789, "uuid": "af8533f9-1ade-4374-8818-40d20e97e6f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739789, "uuid": "bc84abc5-44f0-4f15-a63d-99ac45153bb4", "value": "FYI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4b36a6-ba45-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649756921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756921, "uuid": "50f42b63-2b93-4221-b29d-a634235b5d0e", "comment": "Malware payload (Heodo)", "value": "44ad445b63c1036284e62b37ebd8905d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756921, "uuid": "880dec40-c325-4d69-a39c-b2b0d6858625", "comment": "Malware payload (Heodo)", "value": "ece2f55e61fd27e4c7d7b30b45111c1bf9fb0f26d8d62cdbd61463e6cb828fa4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756921, "uuid": "873e6aaf-a5c3-4083-8995-d6c5a55ea89c", "comment": "Malware payload (Heodo)", "value": "f37542be4c94dca2b23e79b966a9837511ad7d90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756921, "uuid": "8b709752-cd98-4326-a163-fe9bc839bcd4", "comment": "Malware payload (Heodo)", "value": "126ff6b6471c9e40e1cd1408156a01cdb1702f10e4cff76b9f3926bdbd3f6c123be62144b6de45fa9445325524bb49c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756921, "uuid": "640d0572-adfb-49d7-a3f1-a27deed700eb", "value": "T19EC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756921, "uuid": "9b7610d5-7050-4ea8-8866-12397392e5cd", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756921, "uuid": "839c14f2-d145-497d-9439-60a0f2e53a6b", "value": "12288:S54yM33d3q3Z7BogxreNmF+U/9JckIAGfUeb:SKh3831BobN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649756921, "uuid": "c621d479-79d2-4f75-a48c-04328153b71b", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649756921, "uuid": "f6b7a0ef-191a-4797-9e83-911c1e64a775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756921, "uuid": "ba464610-61b1-4799-a021-a5a67c4d5f73", "value": "emotet_exe_e5_ece2f55e61fd27e4c7d7b30b45111c1bf9fb0f26d8d62cdbd61463e6cb828fa4_2022-04-12__094837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2060076c-baa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649796603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796603, "uuid": "58ad94cf-213a-4852-956d-5956b9f22401", "comment": "Malware payload (Mirai)", "value": "73b37996a181685f71182626584bcc85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796603, "uuid": "e717996f-6547-4a45-8e1d-862c868d4b1c", "comment": "Malware payload (Mirai)", "value": "ed37249ec93ab9c6a1f5ebfdc4345216586114a5815a1a70f22f8f41a89b3956", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796603, "uuid": "1713c153-346e-497e-bcd7-1261d970af75", "comment": "Malware payload (Mirai)", "value": "392d8f94a892a12239e89eea80903139f95eab22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649796603, "uuid": "89ced8cc-3e2e-46df-a9c0-7a521c64b850", "comment": "Malware payload (Mirai)", "value": "f8ec9597e801318654d0de74d50ceed721311e03a5f8acb3bbbbf18d82b6af391cf5d26979b0df6ae0ac8903aa638ad7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796603, "uuid": "2bfda5e8-b8cc-4d78-9356-30d7397c8348", "value": "T1AAD2E1F8EF689B8BD0D1A73E4D5D9C4E71ACBD671AB6E5190B420D222039E60D5ECCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796603, "uuid": "bd4d638e-c684-4430-9cf8-f2290850c72f", "value": "768:XN8fWlfoQmQAXV7E/QciiRcrHKOu3Ltq+:dMNXFl76Nnhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649796603, "uuid": "d136151e-968f-4a00-871e-0aa53a0848b1", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649796603, "uuid": "c0479c28-3b4e-4ec2-90e8-3b4f14e2d36c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649796603, "uuid": "8d6599c9-47fd-40b4-8093-2ab1bf2bccc7", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43097b9a-ba4a-11ec-8e58-42010a9c0032", "comment": "Malware payload (sLoad)", "timestamp": 1649758865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758865, "uuid": "3412daaa-283a-45f4-84bb-1dac256569b3", "comment": "Malware payload (sLoad)", "value": "29a2e0e22dc7f75fd38d8e5e59cbc666", "object_relation": "md5", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758865, "uuid": "003af6ff-211b-47b8-a71c-cb9535d74279", "comment": "Malware payload (sLoad)", "value": "ed37f9f7ef42a2475a9e1a501844090121e45810e91c0d782f0cd9d6c5059e05", "object_relation": "sha256", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758865, "uuid": "85d061ed-1807-4bfe-bb5e-d0b5f3736bd6", "comment": "Malware payload (sLoad)", "value": "df8fd602d6fef450d8f07a5e2b6f43317c2742b4", "object_relation": "sha1", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649758865, "uuid": "06325b32-ab94-404e-bbc3-d1b8c7c5338b", "comment": "Malware payload (sLoad)", "value": "f5d87f4b999c5939148ad6e2acf024ce5eec1062828d439e2607693d528d8f9616a0cb39f390156cc003277d388fe1fb", "object_relation": "sha3-384", "Tag": [ { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758865, "uuid": "6363494c-2cb8-4308-b209-7c315eb994ef", "value": "T1A304EAC259CF90CEB2829F1517C9BDAF00DBE412551E36F421C29C969376ED8D6A0EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758865, "uuid": "46815030-2d50-4bde-93b6-79992be8e40e", "value": "1536:XguZSFjtL6g474qKHIZQ+J/0jPUsp6zeD17RtlkkPftQFxUHVpoStrWXNs2ULR/H:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649758865, "uuid": "2d715fd0-46b6-4d69-bf6b-36af8dbda9df", "value": 175830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649758865, "uuid": "0b91f92c-979c-402b-b36c-36462ea6fa6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649758865, "uuid": "b1bd841c-12df-46e1-988e-57514cbb9c7c", "value": "desktop.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefa402a-ba21-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649741544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741544, "uuid": "da5a1495-2eec-4689-8fa0-44e2c4b11a49", "comment": "Malware payload (SnakeKeylogger)", "value": "650fdfaf9bb245338496a8edbb07c53f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741544, "uuid": "3695ec6c-5b2d-42c1-a68f-cf2a15cf14a1", "comment": "Malware payload (SnakeKeylogger)", "value": "ed9098ec3a00a20f211cbf4ea01657c3b245de8d576b6abe6413a8297d83c222", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741544, "uuid": "723f4b13-a484-4baa-bc14-ff85944e684d", "comment": "Malware payload (SnakeKeylogger)", "value": "d344dcd0b65078c79ef5d4087e4edd8428ea77a0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741544, "uuid": "ab2fcd53-79f6-4168-a2d1-7944b96ab4d2", "comment": "Malware payload (SnakeKeylogger)", "value": "dc7c3fd698cf9a663f3e8c8dd4f5e5c16fad3beb2c7ed476a0f54f96d80a54b8ddcd9dd4b7ac5c3d1bf31771af65371b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741544, "uuid": "ae020aa0-4d77-4381-87b5-f0954c8cc394", "value": "T18FA423C440B7F96AE857F2C364F9BC85F5F2DF67B82A5AC901910D843419AD8285C3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741544, "uuid": "d83f1fcd-554c-4ede-8fdd-f57c5f0b8ddd", "value": "12288:uOuGb2dMd7BHtdGF7xgtf/QpF1QKf1BUUMQZlurKGK3kq:9um4MlhTGF7xukVf1BU0Zl62V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741544, "uuid": "0f9d879a-aac1-4b27-9cdc-51ebb3a72e27", "value": 454392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741544, "uuid": "a5471d54-11d8-406d-b1a3-105f1985d742", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741544, "uuid": "d9706985-5982-4159-a229-75e94703bd04", "value": "PurchaseXOrderXPO-33908.pdf.xxe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e295390b-ba8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649787480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787480, "uuid": "6eb26981-8348-414d-a8c5-19cd415fe869", "comment": "Malware payload (AgentTesla)", "value": "7d9202090a349ec423d85c71b6019228", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787480, "uuid": "3264f8d5-d3a7-4592-98bd-56a1943ca007", "comment": "Malware payload (AgentTesla)", "value": "ee62dc596e4b4fe76f8e015ac250d696a483f656ebb02d02815520b3fd560e30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787480, "uuid": "263a83e5-951d-45af-9105-4e67dd6f36d9", "comment": "Malware payload (AgentTesla)", "value": "38367acaf5260af2c9251f205ba65ce56673fa8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649787480, "uuid": "5a100316-5bf2-4b7c-8f26-ac754ee10e7d", "comment": "Malware payload (AgentTesla)", "value": "ae50d934d875ef30b3e38e28ad2f9d3d227b3b79904a10b152eacaff077889d32497b62111233cb7c6c263f0d5c1f372", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787480, "uuid": "eb84b615-15b5-4782-827b-d46691be8671", "value": "T159F4CF1AF7B6C922E2E41B77C8D7090417B4A742D516D72FBA92A7940F033EB580736B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787480, "uuid": "f9853b22-c35a-41a5-8552-04e03ba59990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787480, "uuid": "569a566c-58e4-4210-bbca-43a107d75d3f", "value": "12288:4wSqtpx4qmgPw+G2Z/mIfMKITSLRZ47hdsVsqg6:KqyqRI+G2mpqRWhGsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649787480, "uuid": "a1b39d63-115f-4349-9953-24883eab7826", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649787480, "uuid": "55b751ff-7bb3-497b-8906-203f0391a82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649787480, "uuid": "f8e3269f-effb-4cd9-90ef-647680159d53", "value": "Scan_Pending Purchase Order Attached.pdf! (1,755K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc0eb4e-ba9b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649793833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793833, "uuid": "adbf320f-1246-425e-95af-a56f6eaf4165", "comment": "Malware payload", "value": "255c137f9eeb69ebe44f0274ec804372", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793833, "uuid": "923f8280-e0fa-4232-a52c-bd6d8909cea0", "comment": "Malware payload", "value": "eeecc2bd75ec77db22de5c47efe1fbef63c6b310d34bac6e3b049eef7f86c90b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793833, "uuid": "24c00f6e-8cf9-42dc-bfa2-79efbf7b964e", "comment": "Malware payload", "value": "fff0b981bbfb3afd7add79fd673494f05a06327e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649793833, "uuid": "0a76eea6-9189-47da-bd60-41cfe2a0a4ed", "comment": "Malware payload", "value": "7d445cc00b4990fffc68c75bf6827e0a7ee00cddf15e9491cac4c5c35ddd695042b535c39e61aaf523565695b13b9a11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793833, "uuid": "540bf7af-3697-4f59-a9bb-c9210f4502c6", "value": "T1F0F49B25379DC8ADCB6F56E8F09B6F15972060F3C6828F0E2DA115B5CE2B9104C86EF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793833, "uuid": "97fb6b06-792c-42f1-86ea-b0b9123270fe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793833, "uuid": "ab755bdc-7f2a-4a41-990a-4cdc21ab3020", "value": "12288:IX81kOQow8u9oMBWPyYe1h5wSav7CzGdFW0W:ImkOQT/BWPyYeWSKK83W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649793833, "uuid": "46ac509b-5e43-40d0-962d-3bf1d4f7b24c", "value": 741377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649793833, "uuid": "591a4bd2-90c0-48d8-96ff-699b78fbedf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649793833, "uuid": "1caa81f9-74a3-4105-a7cd-f9084718680a", "value": "9af342fe404749aa973fcec40fd4ed44.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdc3e23-ba2f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649747498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747498, "uuid": "f038e928-ca92-42e9-bae3-d49a5b7a5212", "comment": "Malware payload", "value": "bfd66a2e2f4374eb623ebcfba7e6cebc", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747498, "uuid": "af9f815d-1cc7-4c40-9dd6-e83b8b758208", "comment": "Malware payload", "value": "ef5a5ab3173bc061f271acb502debdae575ac3e185287d11fba67a8e7d4ee5ac", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747498, "uuid": "2bd55df0-f00b-40fb-957d-26c11e93addd", "comment": "Malware payload", "value": "1704d702bee25b7e4979ca0dd536f5d2ee6cced4", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649747498, "uuid": "e55d2356-d5a7-4542-b1a0-ff667a971b9b", "comment": "Malware payload", "value": "a2911943a958d7d31faa5ac2465cf379e4a18a2f7d7a0d4c6fcc9aa75d100cb8ffd318df4fd48e4e3a18c2db914d7204", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747498, "uuid": "f9202a00-fdb4-4b3d-9397-710485555e68", "value": "T115336A298235E4C7F6D725BC60AB2BC4F5E385C533ADD2116D86DB3492F4C86CD48E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747498, "uuid": "9b13c8fc-af2a-4dd6-a0d4-5d7904dbb01a", "value": "a64e048b98d051ae6e6b6334f77c95d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747498, "uuid": "91f6b07f-fc36-4254-8eed-22fdf02fd908", "value": "768:2MCraL1qGYLcxBro/cONWfvioe7HlsC5iWT23qSCDfzgh/zJLGL/1H5:2MTIDLcxBroWviHFsMTjPTzgVzJLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649747498, "uuid": "8b94741d-8e40-45ca-9396-8a84167f4113", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649747498, "uuid": "42bd82aa-2889-44b3-a437-b6089c78856b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649747498, "uuid": "cad0e049-0e94-493f-92ff-f870591f97d7", "value": "downthetoilet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b774451d-ba96-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649791702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791702, "uuid": "bffeb421-1eb5-4dca-9f3f-a372d2197a12", "comment": "Malware payload (RedLineStealer)", "value": "7c3087da7a35e9b2b636b9db368e4784", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791702, "uuid": "17fa421e-afa6-4828-a273-1b5a41ae0b0e", "comment": "Malware payload (RedLineStealer)", "value": "f0036fec9f08df07e5dba7e7263649749459b5592f49c60799d69a8f94036b89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791702, "uuid": "6cca087d-e825-435a-961a-5f25e8b0417c", "comment": "Malware payload (RedLineStealer)", "value": "50c71ce3248e078d8d079b48473e510628377a7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649791702, "uuid": "b02a2ddf-fdb0-4e34-aec9-3d523f1f6368", "comment": "Malware payload (RedLineStealer)", "value": "f4bb6e28adf2ee4f75a6bd39e54716bf25c2b1e05ba774aa0a2bd095e5278ba89329a0f9e5237c3baa399b6b5901feda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791702, "uuid": "3fe4e5bd-1f04-4c56-955f-136d947d6417", "value": "T142052255B2A99441D48E3B388D338DEC2E217DB0DB58878B1538769F3A723D11D0EBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791702, "uuid": "9baa0618-6e92-4e95-8389-c4402ab29d5b", "value": "560be869eea9e6b2de5a1a5feb09ba4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791702, "uuid": "34975a23-ce98-439a-9160-7d2538c1ea11", "value": "24576:9OoPBS1bMYb/Fbij1OvVcOEgW+y46j3QKkf1J:9jAftijiAj+ypj3hkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649791702, "uuid": "bd985292-12b4-4079-92ab-51ed4606da6a", "value": 829520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649791702, "uuid": "6c4d3740-b11c-42db-8750-7bf9f171aad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649791702, "uuid": "c0266936-8af9-4457-8766-97c927cce509", "value": "7c3087da7a35e9b2b636b9db368e4784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad59bc3-ba56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649764140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764140, "uuid": "da30abe7-31b7-4421-a9cc-c5362e748fdf", "comment": "Malware payload (Loki)", "value": "0c186c239777cf4ae9c9b3664eb9df18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764140, "uuid": "289bfa7d-b489-49c2-be9e-5cd3c72b4d4b", "comment": "Malware payload (Loki)", "value": "f03dd3fded0cdfede3ebfbb37b7c22ce48c39c639646bcc45d62b96b1f048cd9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764140, "uuid": "12041b9d-7687-4263-885d-513c68646882", "comment": "Malware payload (Loki)", "value": "d20b97a0aa7aa64ee6b05be67033a577b7d89769", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764140, "uuid": "7968559b-e817-44cd-bebc-5d22d7ddfbf8", "comment": "Malware payload (Loki)", "value": "3fcf12754e39a7dbaf168f84865438565f54f4a6c4165bf64ba1976b7362d846e3ddbeac21a10bcebab0186f6ee00b64", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764140, "uuid": "71fae45c-7ad6-454d-b66c-2ef079003c66", "value": "T1D47107206A341CCAEE0758B2E1B5FEEC03F9FE5608CB8644B1AEF39113227549DB6850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764140, "uuid": "30c5d1a8-6aa8-4a2b-a0cc-92552837167a", "value": "48:KWgUPc6OqDSVMt6wiGBHgBqz3Ikt51v7kMZSbSUoIHyLIkbIwOT5xGVaFq1R:KWgU0xqO8nABqzB51veStIwbIwgc2iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764140, "uuid": "c5ad14b0-95a7-4db0-94c0-07e9272d0053", "value": 3691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764140, "uuid": "ec141cb2-a991-4f89-bbc5-f62c4d171148", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764140, "uuid": "8b417fcd-f63d-4e1e-a6d7-41af5701b803", "value": "PAYMENT COPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a295f5-ba3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649753573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753573, "uuid": "f27b1b16-1bd3-41f7-9ebc-f3cca5749ed2", "comment": "Malware payload (Quakbot)", "value": "e9a84043024e8106967a2494a20e1fb2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753573, "uuid": "418aaea4-02e2-40d2-b7bc-273d2a479e32", "comment": "Malware payload (Quakbot)", "value": "f123fb36a39ff6cf0ed49197fe00a0d3c244e57912371c007b2012f2da445e71", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753573, "uuid": "cbdafddb-38be-457b-8b71-1eebdc297669", "comment": "Malware payload (Quakbot)", "value": "a48c632233edf80fee34ed023425733ea939425f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753573, "uuid": "c4bb43ee-e392-4305-9547-2705f9fc8d33", "comment": "Malware payload (Quakbot)", "value": "580cfccf98c5d17368d52de350d8dbe31bd47f3ef6b6ff63aaf87ec65c954294ffa57875419b9b686674eb369b9680ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Prod Can Holdings Inc.", "colour": "#CC725B", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753573, "uuid": "93a34452-fccc-476e-b553-42e14e12210e", "value": "T1B015AF3AD29096FFC163BA7A6C36F180AC113DE1D614E50527DFDE4E4A397822724787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753573, "uuid": "1311361a-a069-4126-a3b3-9958cc5aee11", "value": "f335497b5901bcd9e242e896ee9878b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753573, "uuid": "f751acf5-d8f6-47c2-b4d6-ca53453ed8c8", "value": "12288:MvdyMlRePlWuktyda+/egKRuCQ1X8eLQRNGoDTStoMsaD2F1PrIGCn:GnlRxuwTI4BqMeGNruaVa6FZCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753573, "uuid": "b660d423-2384-4e29-ad36-6c1c6f8d5f55", "value": 895566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753573, "uuid": "c02addc9-5ce8-4518-b057-31f9575cb6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753573, "uuid": "5513ddcd-3229-4258-a01a-46bba59e477a", "value": "f123fb36a39ff6cf0ed49197fe00a0d3c244e57912371c007b2012f2da445e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b557bf1d-ba4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649761204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761204, "uuid": "02b31e13-72e5-44cd-9a71-47c8b95b5873", "comment": "Malware payload (Mirai)", "value": "320e70d99ebbd4abfc9280500e00e5b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761204, "uuid": "707d7330-f430-4fdd-b7f5-dcf386d402e9", "comment": "Malware payload (Mirai)", "value": "f158c2b287205a1514522519670fc942cbbd0872f648ee505b5d9df29b84adac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761204, "uuid": "a8b7a32b-75e5-4028-8363-d90498c5a1a0", "comment": "Malware payload (Mirai)", "value": "85b380ffced79d097b6aa69b3507d668eb83d88d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761204, "uuid": "38c349a3-bda2-4e5c-b272-b4a05b0e3da7", "comment": "Malware payload (Mirai)", "value": "571765f7860b3d930b1716ed10748d35ff421a3afefaa8ac61913c014ea96464a5a81b832ce62ec972ebbe2b6a9496cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761204, "uuid": "8171ce91-37b7-4c6d-a024-77fd6780b968", "value": "T178F2F2A2E05EFA01EBA872BBC4DCFB2979109596DD1DC0A7414965B2D072FC40D2D3D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761204, "uuid": "e0166f3e-9bf7-4cc3-b394-415ea08e8de5", "value": "768:KysvFEeyLxKmQSTK2O6McTvdf/HxDxNystL0mv58nImLnbcuyD7UHQRjq:KFEeuxKDb4X5xc00A58nnLnouy8Hy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761204, "uuid": "2adac410-66e9-4f5e-911f-88f0a3da38a6", "value": 36104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761204, "uuid": "8bd13339-6a82-4835-99ed-1198841447d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761204, "uuid": "dd80c835-71f9-46f0-bdef-6d5aab894685", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab330a8-ba57-11ec-8e58-42010a9c0032", "comment": "Malware payload (QuasarRAT)", "timestamp": 1649764461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764461, "uuid": "2bf4e53e-4d8d-4531-af5d-8492a7147ed4", "comment": "Malware payload (QuasarRAT)", "value": "b5e5b0e5a13586f3bb601711aa15e41f", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764461, "uuid": "6bc64666-4d9c-4d3c-b73c-41b39ee13a92", "comment": "Malware payload (QuasarRAT)", "value": "f2833315c599f86d9a2f1d020ae68f39329c8b43401b8e03eecca32c5bf014ea", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764461, "uuid": "0f0a813b-3cb8-438a-ab2b-c7b04e0fa40f", "comment": "Malware payload (QuasarRAT)", "value": "195c23e37d4d293b7b70dacb95a76828de3134d0", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649764461, "uuid": "9e3e88b9-99ef-46eb-9d3d-6e132f67bebe", "comment": "Malware payload (QuasarRAT)", "value": "bf901d444caaa9b2ffdf8ba709e25c54959b38b1ccba6f4766fcc88e32ce7dfd128e8ad52b62a8b75d1d23a1e213ffd7", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764461, "uuid": "992d2a8f-68dd-414d-a7dd-a46202c8b16c", "value": "T1DED5DF7292A3FCCF6B7F0D44A9142C638C841D5B83A14258FAC527EDA5DBC10EF694B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764461, "uuid": "a59d6723-298b-45a5-ac6e-08d4a5014659", "value": "49152:Xcq7Do1hLo7a1Az5mR17eUD/565MDjt/W:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649764461, "uuid": "1ef192a5-137b-4e85-8133-3453b070a3e3", "value": 2795474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649764461, "uuid": "44de2cf7-db5f-4726-a691-2a92a1eda808", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649764461, "uuid": "2bb5d7b6-79ff-42b3-b28e-007c8885045a", "value": "Quote_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437cb978-ba4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649761013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761013, "uuid": "92707cda-5159-472c-b973-ee3448d27720", "comment": "Malware payload (Quakbot)", "value": "0935126f164f7e80eda4b907c76bdf29", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761013, "uuid": "d2741b70-b7ee-4520-a418-8e87a45e77f3", "comment": "Malware payload (Quakbot)", "value": "f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761013, "uuid": "61e82153-3916-4bd3-b41f-463ab710dbf2", "comment": "Malware payload (Quakbot)", "value": "572b71758bc7681f1be919792b6b3e5a475399ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761013, "uuid": "230005f5-8a8a-47bb-bef0-f0e50f14452f", "comment": "Malware payload (Quakbot)", "value": "1089165655c56bb9565b8f79ee585d8eebd61cc128b31d4058bc4cedfba7ed1384567011984b31224fbc9cd8910b8b93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761013, "uuid": "15ad1ef4-e5f0-4209-b12c-f35c89321617", "value": "T19445AFFC76047DD6E66F467BDE96ACDD13B626329AC7A4CC806477C30963362EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761013, "uuid": "acaee1fb-d0bf-4909-bea6-014012d8f045", "value": "b18e67cf395fc2f9d1d9dd12d529171f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761013, "uuid": "30829f9a-bf45-4575-ad66-0c1b900abe83", "value": "24576:dftEDK1snL/1mofDWHI/NeOmF4wblkilHTduRrirdAL303I13UqWSQewPE+RI8zc:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761013, "uuid": "b9cf367d-c932-497e-b4dd-e10f6992a760", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761013, "uuid": "ee76b819-3f0c-4402-a448-afb6a6cca5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761013, "uuid": "d47044ed-f90e-4db9-85ae-8da64f6e3ea9", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc97895-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "21a32140-40cb-45f4-aa8a-9df9307d4f7c", "comment": "Malware payload (Mirai)", "value": "437eb62bfa75f4f089fd19a3f3d9253c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "7157d89b-b85b-46cf-a0cc-5818f4127776", "comment": "Malware payload (Mirai)", "value": "f32cb3279d8c1620f4825e3b3d46f6af2ffe9b41f91d16ed831e7a48908be443", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "ab0bc2f5-3c07-423b-b803-72255eeccbc4", "comment": "Malware payload (Mirai)", "value": "3424df6622b56c226f93f02ca08e465c300b2335", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731660, "uuid": "c3c34a45-0da4-490d-838d-84e06feead92", "comment": "Malware payload (Mirai)", "value": "35376e1c4c2a2f9bc312a3a08495353f9cbe7a22a6da6aa84b414d436055076e43524c7f7525eb365bb4c246344f1624", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731660, "uuid": "50ac37ae-ccdf-4ff4-af39-0c9933b4a5c6", "value": "T18683944D3E318FBEFB9C82394BB74A21A64823E626F1D5C4D15CE9052E7034A741BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731660, "uuid": "7dca142e-3efd-492e-a94a-692789fa5407", "value": "1536:0YxYHQ7QM598fjb+jbXVjb0nHg6i9nLzZk2CHtubAiWyOOPMKfosExSA:XiHQ7Lyf09nLzZLdbAiWyOOP9g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731660, "uuid": "e73780a3-fe53-4072-948f-74c0685e2c03", "value": 81420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731660, "uuid": "d19eed9c-f23f-4448-9111-932034964568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731660, "uuid": "0cbaf87d-6b81-437c-ac57-72b20849a18b", "value": "mips-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede05410-ba55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763876, "uuid": "8588b8f2-64f0-486d-a451-723bf17d1e8d", "comment": "Malware payload (Mirai)", "value": "51120ce234de2b1334e2204c7a1086a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763876, "uuid": "81dd361e-8024-487a-8bd9-ee30457101b0", "comment": "Malware payload (Mirai)", "value": "f3986ef3fbc1a569f765ca163666839cd4d3040d21269b76d8c22e23de71e5c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763876, "uuid": "e99d5b8d-6f6c-4b39-a165-2e043e44a5f3", "comment": "Malware payload (Mirai)", "value": "32da192a9df057ecbcc6bb004a32848314815d7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763876, "uuid": "3e4df56e-c1de-4720-828f-67979984db80", "comment": "Malware payload (Mirai)", "value": "2dd3068139837d63a407ead1f1c5ec299db4167e8a6ef9b6592333ac193b4ceb931206f641bb90a15957b59e805f3f3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763876, "uuid": "4537683d-60f3-42cf-b0cd-92809709bf94", "value": "T1A723F1DDB2703C86CE296539A19A94F6588433D573AF1FC99280BC8D8136ADFB58D039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763876, "uuid": "3eabe327-95a4-4374-b6d0-2a5f95836e6a", "value": "768:vKXFkWQeAtP953ogPKDCSjQiydmM1CGGhs+r+LnL7wSdFGdAeNWl:v4A9TdS0t0MMdh1reG+eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763876, "uuid": "a749b6d7-14f8-49db-9c7a-2aceefa8fd21", "value": 46668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763876, "uuid": "41669b0a-9496-4bc4-a31b-55e40c4b75c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763876, "uuid": "fbb80526-d6fc-42b3-b37b-dbc6fc9658ee", "value": "51120ce234de2b1334e2204c7a1086a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6175438-ba50-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1649761743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761743, "uuid": "f4742aa9-49ed-491b-aff2-806621bb8635", "comment": "Malware payload (BitRAT)", "value": "68a83e9af97152d32792dc67cd6c65f3", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761743, "uuid": "99b721f4-64f0-4981-ad92-640a7c500f45", "comment": "Malware payload (BitRAT)", "value": "f41ea364ab7098e4aa3b20a468604f0e7ce447d96fa05fa13400196d413a7253", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761743, "uuid": "5beb960f-5733-4e67-90f9-ea59d4d9f08b", "comment": "Malware payload (BitRAT)", "value": "725d75f04c4a6e84df3110b816ccdf541d3a3886", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761743, "uuid": "e639f005-9b3e-4580-b906-2aa40375c8c6", "comment": "Malware payload (BitRAT)", "value": "d84c40cf1b82f391c583751bda452317c2d46a38b6eaaa85ff6d41eb9ed8cce73a696aeb4addee7b679e2fb1d02deb39", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761743, "uuid": "2f07dc6a-163d-47af-ad8a-adb2cef5aeba", "value": "T119428D9811720D42DF2F93E3D236F42501E7F1920AEEA5D1314ECA771762BB1DB9E846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761743, "uuid": "a3742027-d5c1-43d2-985c-1a729068b6a1", "value": "384:E1u386JTyG0KseexanW/m+s7XzYXPi2g59ckfyPmRf:EI386JuG0DexWO+s7XzYEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761743, "uuid": "933ee35a-1ae6-4506-ab4e-975e774a713b", "value": 12318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761743, "uuid": "f68c84fe-6a19-4945-b074-2fafa96d4eb3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761743, "uuid": "ddd5d963-db48-4814-8436-48dc7e34bf6c", "value": "Inquiry 12 APRIL 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20a7d97-ba5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649765897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765897, "uuid": "ad57a2bd-a8c4-4000-9c8b-936829f02e83", "comment": "Malware payload (RedLineStealer)", "value": "2c99b322294e3bdb7d4847e7a3d3aa4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765897, "uuid": "460c600f-da0f-4a23-8dfc-12cf2c8f7525", "comment": "Malware payload (RedLineStealer)", "value": "f43218dafaae05d7aae7be5decbfba881ed422e4e14273181cd8bd13f0ed4ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765897, "uuid": "9841a6b9-53ed-4aba-b219-1c26b7cdfd81", "comment": "Malware payload (RedLineStealer)", "value": "935b4415c1428599ebaaa3147263d40da59c3f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649765897, "uuid": "96f5801c-12d5-49c3-863c-a314393c69b5", "comment": "Malware payload (RedLineStealer)", "value": "112a6a3958ce6bc5dfb7bb358801ae7209f7b5629ef661e46fb5d756348b6b350aab0e9f1eb0ed8571dd0ad5c76556b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765897, "uuid": "7e71b2b6-80a0-45be-af20-18287643b168", "value": "T1AB94E03135DCC439C49715318C21E6A15A7AF8306965A9473B9827EA2EF0F8C87F63DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765897, "uuid": "df21e877-4fd0-43ae-9279-cb8765005d53", "value": "44ee62a4400af83b87d8ba40d9bab42b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765897, "uuid": "17b79f21-513c-40a2-998d-ed85b99d726f", "value": "6144:CIAYGo5yCRIla63jXEec3pb7f+Wn9X/8+RQkgisuzbgwu:U2/RIlNTXSZbKWxEZkg/unn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649765897, "uuid": "c98c41ee-4c6f-466d-91a2-6cc839431ec6", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649765897, "uuid": "ad11d2b0-38e1-447d-99ce-2b35dc1e5965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649765897, "uuid": "9b3e6f56-45da-414b-ac48-b75fccb66d8e", "value": "2c99b322294e3bdb7d4847e7a3d3aa4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb1d9ee-ba35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649749968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749968, "uuid": "c4823a69-a097-4590-aec9-bd721402fe8f", "comment": "Malware payload (Mirai)", "value": "e68fb8ca6e2bec36da719f1a9cc45043", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749968, "uuid": "352ff8ea-a1a4-47b7-a052-2c59f9059940", "comment": "Malware payload (Mirai)", "value": "f4970a5b0d552ee9c0bc00204290c6d804a6987891cecf3996082b821021ca21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749968, "uuid": "bd66d325-3a03-468b-8b92-1975c9994f5c", "comment": "Malware payload (Mirai)", "value": "40633f060a3e7eb507cf82cf1b7648c5910a3180", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649749968, "uuid": "7d9c8aac-a81f-4c52-a187-5e4ccdefaed1", "comment": "Malware payload (Mirai)", "value": "6c0753489d3091a959b4af8e6b30343dda5c314a3f0ac688bc3744ed298ff954a8f6d6920cd6fced2bb63d4737fe407f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749968, "uuid": "04512899-0c97-4667-85ff-cd4d1f052526", "value": "T1FCA2D034B748DA34CAB09D78DA68A1CA70611EF5FCB33AA5210C4B2537D9547F3F9096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749968, "uuid": "ada17825-bd93-4e8f-83fa-7765eb5bc5bc", "value": "384:AXdEbHhQQabhnDjHQB836q7TCiCvtFLiS7XPXHYnCuTlqWiX9IxbgAhymdGUop5K:W2aQabRbQB83h7TCiatFLiS7XPobiNIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649749968, "uuid": "3fce7eb9-fa27-4c57-9d7a-2af79f67f089", "value": 22460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649749968, "uuid": "7b9292c5-47a1-4109-9347-406162702f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649749968, "uuid": "1c28ab76-d5c8-4ef5-88db-9f49991bb2e9", "value": "e68fb8ca6e2bec36da719f1a9cc45043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed16302a-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767740, "uuid": "2e0898cd-84db-4017-815f-d92c5f757924", "comment": "Malware payload", "value": "30ddadb3368023628a46f5863b6bb5f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767740, "uuid": "9d7c7ec3-8341-443e-a38d-ce07540d49c1", "comment": "Malware payload", "value": "f50bb932b348c0682ee51dbedcc1da90c917be5461f79b5608899750fa722b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767740, "uuid": "ac0355b2-f267-4b13-9253-b8d0fa6e9a80", "comment": "Malware payload", "value": "3b61bc5e1cdc3527902232af6e5170b049d927b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767740, "uuid": "fecd8c38-bbd3-452f-befa-47e1877cd559", "comment": "Malware payload", "value": "1be2b2a97997d9f87acf0bba27f3a5bfccd0c2d323b53282fba479d275d2b534fb036c27a421fa29ad8d58288a5214f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767740, "uuid": "21d0e3db-6f4a-4486-b381-d79a71a32eef", "value": "T19E64F0749848EB41CCACEB7A94E2F88D16AEDBC247C3D30275D318D4047576B929EDB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767740, "uuid": "5ed0b8f1-fcac-44f0-b7b2-ed4829116bbd", "value": "6144:HSb/nCYSfYWkqTglRqAfGq4Ls11RzLWrTzvSPaQZidwxAXXxkO4v:HSb4rMlRqAfks1yAaQsdwxGxk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767740, "uuid": "081f8667-2133-485b-ae97-a3a31a37592f", "value": 317973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767740, "uuid": "cac04a1e-8a64-4878-b54a-a5f23f8f804f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767740, "uuid": "3d0dae17-b532-4e0b-b769-82a34b835ffd", "value": "30ddadb3368023628a46f5863b6bb5f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc03d2c-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649777994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777994, "uuid": "94dea5b5-795d-4545-ab86-e1ed4fd36ce7", "comment": "Malware payload (Mirai)", "value": "ca97961277fc73778827f2ae4399ac27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777994, "uuid": "d2a87e64-91ee-43a6-8e39-0dd918a8a73e", "comment": "Malware payload (Mirai)", "value": "f5967450c95f87e6b84ffc43a552c1bf06e8aa35eaeab309115efd27e7af97a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777994, "uuid": "38327707-0c23-4195-868b-86c470f36fa3", "comment": "Malware payload (Mirai)", "value": "98ebef5ed11b90ddfc7ede4e0aba16e080cc65af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649777994, "uuid": "91478cf4-151c-4b11-8bda-4e15bd8413c5", "comment": "Malware payload (Mirai)", "value": "4930946b9223703f1ef42a60c6769d857e1f2d712526d2cf72a5982642e6e532e8e78a40547ab88b9b53d09af214d22d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777994, "uuid": "2a720852-2237-46b1-b1a2-933a1003a271", "value": "T146431A96B801AD7CF94FE6BE94234D0DFA21335051930B2B67A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777994, "uuid": "9e3f8f75-4644-4b42-9c1d-df2328d5a19f", "value": "1536:oFMAMFlwZA9UwTrPE3wqyIE8WhibBqKpnzK:zTFlwZSUwTYlfqjKpzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649777994, "uuid": "321431f3-357e-4d6f-900b-cddc39148ed5", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649777994, "uuid": "f5e0e4be-6136-43e4-92d5-3b6e93ec824f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649777994, "uuid": "2b1f1c22-3f4f-42e0-8ac8-3df2da05af20", "value": "ca97961277fc73778827f2ae4399ac27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fcc96e-ba1c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649739159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739159, "uuid": "9008392a-dbe6-4c3b-bfcf-ecc51c21a53d", "comment": "Malware payload (Formbook)", "value": "417787fd1e701e07833eef51b3303bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739159, "uuid": "df523e78-03b6-4c31-abd5-a48bc365eb12", "comment": "Malware payload (Formbook)", "value": "f5ccaf537972b3fdedebf4dd772643238c9f370ae2f39237b2ed7bfb945be0f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739159, "uuid": "78c72c95-dac8-4555-8c8c-b71ad4dfac5d", "comment": "Malware payload (Formbook)", "value": "6c136af4af4201286a257caf5a2fa9f2d3920cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649739159, "uuid": "4a7c4206-f780-46ec-87ab-306d5f8ac15e", "comment": "Malware payload (Formbook)", "value": "e0ae3bf0c9b847373014de43ab8726d97f204a5ff4e0f8fd91d802c47b6ac866ec540e94570b0757c656b9d3f9037240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739159, "uuid": "f1094dbb-3788-4b4b-b235-c9e5acc2d105", "value": "T193350273AB52DE97CEE8867C0861BEC1A3F183235257D74EACCC92A9B7436D45B011C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739159, "uuid": "c0f32950-46f3-456a-b8cf-a7e0bcc5b3d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739159, "uuid": "3fd80d5a-33c4-40ef-9284-31b46d8a1578", "value": "24576:/dBqCebfeuXVgOnZzuCQUd5xih/i3KFdsPgHUcB:/dBqCafeEVVZzuC5o/TsPg0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649739159, "uuid": "e5d346e3-5741-471b-8e86-3b1c923a476d", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649739159, "uuid": "69e8a5ab-c68d-41b5-afee-aecdfc595201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649739159, "uuid": "ab6afb6a-3e0f-4f29-b388-c016389f05f4", "value": "61901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c831abe-ba2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649746909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746909, "uuid": "c25b8607-145d-4d9b-a089-cd5da4ab71c4", "comment": "Malware payload (AgentTesla)", "value": "ef280962b243a60441b2e9197569857c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746909, "uuid": "f304910a-0a8c-4d21-8192-fe3861224dff", "comment": "Malware payload (AgentTesla)", "value": "f5cf5e1d41419e2e2283e3548eb60ea029fa7d24344f3af4536ba8b2363dafda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746909, "uuid": "e44a4b96-ef1b-45b4-880e-80b46fe4b471", "comment": "Malware payload (AgentTesla)", "value": "17852ba8bbcf6d29b29b6d46eee714ba19dabe43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746909, "uuid": "21616eb4-aee2-4b7b-976c-8536406e4606", "comment": "Malware payload (AgentTesla)", "value": "a30af861d1bd75348279140de1b147fd243c480b5d29c466b1a2149117401ae367b1f0d21ebe6c6afbad8f653467cf89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746909, "uuid": "a3596868-30ef-4867-a33d-78e54e7ce9b5", "value": "T14955F172A781ECA3CEE889791D16ED7053E2ADA9D206D75D28CC3DAF76F65F106001C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746909, "uuid": "7b98e5da-270c-4a9a-83bf-ea12320be736", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746909, "uuid": "187bb286-73cd-42a8-8ba8-54d0f422e630", "value": "24576:AdBqCebfeuXVgOnZTg0sR6O7xRfHDOAwxVz2iD/MMMMMMMMMMMMMMMMMMMMMMMMp:AdBqCafeEVVZTgfR6mfjOJhD/MMMMMMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746909, "uuid": "9fe58253-d12b-44b5-a555-944d5cb95bc6", "value": 1382400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746909, "uuid": "df6002e1-81cc-42a1-838a-c62984638823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746909, "uuid": "7232a176-f026-4421-8079-283bec002ed5", "value": "Overdue_Payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d710f82-baab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649800544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800544, "uuid": "4a7bdbcb-c5d6-41d1-b25b-31dc498c0d69", "comment": "Malware payload (Mirai)", "value": "8371cd1cae8c07d7a80a0b17c6f32be5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800544, "uuid": "3ced5060-9d62-4c9e-87b1-3ce505e0460e", "comment": "Malware payload (Mirai)", "value": "f5cfe49c817a0ee4d3c4eae634ca4717b870b44075a470899b45cbe2e8f7fed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800544, "uuid": "851ca406-7005-42ad-bafa-e119a5b8c8ca", "comment": "Malware payload (Mirai)", "value": "61bd31b48bff248725f9a3f5a0e8d41dc0dc2359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649800544, "uuid": "bf8a6795-35d5-48fb-ada7-0ce7dac92b8c", "comment": "Malware payload (Mirai)", "value": "6e1a04d4a9711a2802038314e08f21e439482a3721a8d0ac3e6f7b8e07a64c99d224602c2debc751364aa1cba336ca3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800544, "uuid": "ac5362d8-0a15-43a3-b3b7-2144927c52b3", "value": "T1F2434B65F9828A3AC1D0137ABA6E569C373163E8C3CB3257DD641760BACA01F1D77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800544, "uuid": "c23d4259-eb47-464a-9589-1a5d4b9988af", "value": "1536:zpUJkNZoczXJSL7IEMjlPqRoWy5j4xxsa10:zp5bXm0jlyR7y5cxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649800544, "uuid": "6ce39d7a-f2b4-4ff6-b920-3ae20acaee13", "value": 60044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649800544, "uuid": "94ddff26-802e-4aa1-9461-02ccbd19a510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649800544, "uuid": "4d92fed4-5f4c-4b6a-a267-6a4070e5a076", "value": "8371cd1cae8c07d7a80a0b17c6f32be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3069ffb1-ba26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649743372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743372, "uuid": "6652051a-a089-40d7-90b0-792ca94aaf3f", "comment": "Malware payload (Formbook)", "value": "f313805f51a4f4d9231a174317ffe94e", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743372, "uuid": "31c8db82-f127-47f1-9d0f-def13d7ba402", "comment": "Malware payload (Formbook)", "value": "f62ebe46c37a4166f3afbc8256a08fb7451e513325e7b777299c261afabcf9f3", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743372, "uuid": "13295691-48ce-451e-8251-353d8f498adb", "comment": "Malware payload (Formbook)", "value": "c2eeadb337da1dad2800fb3741e58864d020c8bb", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649743372, "uuid": "3f6bbb4b-e629-418a-84b8-e98c8c7ef6c2", "comment": "Malware payload (Formbook)", "value": "57fb6382ef58c1b7cf1ccf97e9b4364ca5ed6044bbe01fc7b4e0402ae3bf077bd7e5854d7aa7a6e4c4412ef55e595a84", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743372, "uuid": "1b714964-6dd7-4feb-bbf6-3d83e8ad6b7f", "value": "T15FB4235F4D6EC3FAD02D279688E115EFB66F6EDF5298A2E7C083D4007CA3910166E478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743372, "uuid": "be413247-b901-46ae-b210-f9ec3e072312", "value": "12288:mergjCzFecJFKElg05D+yNYimGZm5IlHH0bdOsxJ:zrgjCzFecpg0BnNHH0bdOsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649743372, "uuid": "80170a77-5622-4ab6-81af-67aefd47025d", "value": 501574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649743372, "uuid": "9a10b2f3-c6e8-4168-9d2c-d15c2df4e939", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649743372, "uuid": "da5b36ba-933e-49af-9d38-98e776cf6b76", "value": "Tracking_information.pdf.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9e1e1b-ba70-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649775335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775335, "uuid": "9405bbba-5349-433b-9f1e-e0d50104d239", "comment": "Malware payload (Quakbot)", "value": "288d263dc2e6640869ad85b17c797919", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775335, "uuid": "9d01e5bb-3234-43ef-a172-28506c5adf02", "comment": "Malware payload (Quakbot)", "value": "f6e7187a8e0aa202fe89008b5a5cc5e99dc5c3aaede7213283cae41dc7cb3ebc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775335, "uuid": "54c3f81b-1f3c-410a-a25f-474ebc8b8ece", "comment": "Malware payload (Quakbot)", "value": "315cb5c182fd646da511c541ed4e0893c92a6e74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649775335, "uuid": "1b1e228c-c54c-478b-8d2f-4b7e3e8afff4", "comment": "Malware payload (Quakbot)", "value": "b1cc55d13d00dc2416da5b354eb5da9578689f6ac3254526e990d452b43f7fba95a6eda04f8b99894f6d20ac7dccc80b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama175", "colour": "#BD17D2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775335, "uuid": "0ff7bf10-575c-4259-a6a8-e604c71ef59c", "value": "T137F4AFB875047DD6E5AE467BDD96ACDC13B62773C9CBA5CC80647BC309A3326EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775335, "uuid": "9333c23c-6a5f-4a96-b79e-4e9f1ed6ada7", "value": "1af479bde1363d7983f378908d494d95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775335, "uuid": "27c53534-9d80-4d02-b6c7-33e537dd0104", "value": "12288:b1WOAct8HDgwRanGvLXO/s3kJvOjRir3NtttKvMK3+9Uy4+fXwo53Z824cH:b1KO8jgwRaGvDO03ktOtixtfKvA/fwov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649775335, "uuid": "ccb20b1a-2beb-4a2a-9acd-09d41e8056e4", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649775335, "uuid": "2b96229a-4017-415e-9aa8-95273e9be8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649775335, "uuid": "d26eca53-062d-4250-aac6-85600d43c10b", "value": "288d263dc2e6640869ad85b17c797919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7015dd80-baae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649801890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801890, "uuid": "844aca63-ba13-48ef-ae49-6deba95fd745", "comment": "Malware payload (Formbook)", "value": "7593a66b27031a35972f464bee299137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801890, "uuid": "54591700-75e8-4746-abcc-0e5392e1d306", "comment": "Malware payload (Formbook)", "value": "f74b69ddc37f4347e5dc0f89a10d81f8c3b28b0c72a45904206579b8490978b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801890, "uuid": "46198f52-879e-4311-9253-dd90b605dfe7", "comment": "Malware payload (Formbook)", "value": "9297cd969fe1e2218350d22d623dc971f4718aed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649801890, "uuid": "df942eaf-90cc-440d-9f97-321df71af222", "comment": "Malware payload (Formbook)", "value": "c00193344a1e535e905fcea872a9b55b2f738228910f19ef86c3afe47ade7ffb91fcebd8c5c973d3aceb40df19a77abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801890, "uuid": "2248b99e-9fbe-4c8f-a380-7674d87f950b", "value": "T189B4CF91DA503AD3D0544BB4C4A2DCB036E9B38A811CF78D7CB5BA492EF55C6E110FAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801890, "uuid": "33bc6f2e-1972-40f2-a720-1f7f8b754738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801890, "uuid": "879b71f7-0bf2-4717-9fb7-81c36ee0e4b7", "value": "12288:C8yJrxE8k/OsQAD/7+eNNQR4YBj+v/cDK:CF2YADlnQR4YiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649801890, "uuid": "0001bba7-bef3-4a7f-9912-4470fa52cd85", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649801890, "uuid": "7c20aa40-dedf-47fe-892e-fefb3f5261ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649801890, "uuid": "06c543ff-dae4-43b7-88f0-f558ee414542", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf7cecb-ba5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (PoisonIvy)", "timestamp": 1649766475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766475, "uuid": "0d4209d9-5ae8-4c50-a95d-982cb1cc7dcd", "comment": "Malware payload (PoisonIvy)", "value": "a55f565cc237fdf77f30eeeea74a38f8", "object_relation": "md5", "Tag": [ { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766475, "uuid": "f3513bdd-4dd2-4960-b59e-82ab48a1d08d", "comment": "Malware payload (PoisonIvy)", "value": "f74fddab404e8ea4b99143cef693822b21f069633cd5a458e9fa49692e29ae68", "object_relation": "sha256", "Tag": [ { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766475, "uuid": "7870cd26-1881-4e6c-8863-732172607683", "comment": "Malware payload (PoisonIvy)", "value": "483e665a2984d7e1cfc1ba328996aa039a3ba29b", "object_relation": "sha1", "Tag": [ { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649766475, "uuid": "e6a94b4b-4908-48c4-a214-3456fb927041", "comment": "Malware payload (PoisonIvy)", "value": "b41002e0a21f246f465f9c803be897f2aabf3227c745d86143eaf18218b32e30955fdfc291f5a9f25e383bc7f9c6f035", "object_relation": "sha3-384", "Tag": [ { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766475, "uuid": "7a84cc29-4fa7-4a0e-8556-cc65d4f6047e", "value": "T16F04F8F22A7D4B80F67B9A63769FBA541132B56BDBC51E8003FCD5200BE97437D48988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766475, "uuid": "752de847-ea38-43ef-8001-ae49f8e59ec1", "value": "3072:25wpOrbbIb1nAHRsqNK+uGdGaqu2scDpMzAJA:2/rbbc12TmGdGaqu2scDpMzAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649766475, "uuid": "1a1a4cbc-34a4-41e5-ae83-4f6390555ec2", "value": 184079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649766475, "uuid": "bdc7ff1f-fa96-4c6e-8178-aeec9cf7a764", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649766475, "uuid": "8f0cd80b-b7da-4028-83d4-5b5c7a3864be", "value": "vbs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e95f0ad-ba60-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649768468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768468, "uuid": "264d6267-4d04-4934-9b4c-64d447815ea1", "comment": "Malware payload (AsyncRAT)", "value": "fdba2e5b005de29f9f26c9df07ed0342", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768468, "uuid": "2dc566b5-30bb-42ff-b146-1e50b5e24b03", "comment": "Malware payload (AsyncRAT)", "value": "f8546d4051c50ef7e38897725dca47b2df4e1d5125e22bcb3b19d1a44008279a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768468, "uuid": "bef3ba06-4dd8-4c5b-9a67-47f8f7ddc9ac", "comment": "Malware payload (AsyncRAT)", "value": "090f975728e874675e3e7a51a51fe2213e7d13de", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768468, "uuid": "f8de12e3-61c5-45d8-b474-8f2bb9099e05", "comment": "Malware payload (AsyncRAT)", "value": "dec42869d5c0b31559ee962c57b9d8f0970f581fe2a3eac839499344eb7a4decdbcd3e4a721cb52e79c77213b75d479f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768468, "uuid": "b09b0968-cacd-40fb-bc2a-08eb369f1be1", "value": "T19593C81DCF54382E97FCEB74E9EE86446C03C21FA056465C34D269EE062BBFA2334965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768468, "uuid": "afee5101-9819-4539-94e1-88acedb7dd47", "value": "192:JBNBFBvBlBqBLBzBgBABLBqBgBpBLBEBVBiB/BLBgBqBDBmB6BVBiB/BLBgBqBmL:i5/Vp+iJuE2Jnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768468, "uuid": "bdf58438-3f6b-4c3a-b14a-c224f772f8ea", "value": 92824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768468, "uuid": "4d365a9f-84d2-4ca2-aff0-4e8cfb15ffab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768468, "uuid": "ea0ee098-fda3-47cd-8a91-a9690cd4a9f6", "value": "Nw PN #23069746XVNXH8W630HXFRATQH.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a813d74-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649741644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741644, "uuid": "9173b50e-7eb7-463b-95c7-f8a7370e23bb", "comment": "Malware payload (AgentTesla)", "value": "2e3f37e38a3ed7d5eaa56b491c8c6689", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741644, "uuid": "30a7d1d6-3f0c-4d85-8a4d-1a64df8471d6", "comment": "Malware payload (AgentTesla)", "value": "f965c51825b3de818f81dd4c5f4b93c6e5d0a8b035e02be55a070013c1f24519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741644, "uuid": "db92cf31-0acf-444b-8f4e-aea51c593603", "comment": "Malware payload (AgentTesla)", "value": "4bdf4a3f62f07467ea4c0ec4e42a7af3dc90b7f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741644, "uuid": "68dceea0-ea62-4b1e-afcc-80a109cb8175", "comment": "Malware payload (AgentTesla)", "value": "4685a51ae868f806b0d8cdbc33a4c1b9b6cc5907b27e0e559b5cb85d0bfac49c22bf72a28d4ba2daa9057c44980d4fc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741644, "uuid": "2b87825b-6faf-45fd-911c-150da5f5b434", "value": "T11825F273BB469E67CEFC93780811BEC1A3F182265247D74EADCC91B5B382AD916015CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741644, "uuid": "739a850a-f810-4467-8f11-a22d381f9f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741644, "uuid": "6e515692-264b-4dd0-a879-79a3a7aadadd", "value": "12288:52P61UwXYNROXwjZ0afeMSkVeN2Upol4JaZEKr85sxBY6IyRp/FXgoNAQMZpLwly:JdXwO0vfeMdVe8HZNg6rBdNAQaCEKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741644, "uuid": "984d9ec0-803c-45b2-961c-bc3a8ccb76c1", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741644, "uuid": "d2fc3d6d-e790-46f8-a302-7af67248f09e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741644, "uuid": "f38d8a79-8421-4b0e-9e57-f08cb77677e5", "value": "VEL-P01225013B (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30f5109-ba76-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649778005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778005, "uuid": "56702d53-36be-472a-88ca-228a8f13ca37", "comment": "Malware payload (AgentTesla)", "value": "d1e545672e21fd378dc649ec449c7cec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778005, "uuid": "076224ea-775e-4fd8-aa2b-be01cccc260e", "comment": "Malware payload (AgentTesla)", "value": "f9a3872603bab9d16727daf3e24705ff94100d4bf2838679b5e9288aa02bd32a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778005, "uuid": "23cd981c-e271-451e-95a3-5252b6522ad0", "comment": "Malware payload (AgentTesla)", "value": "374008f35519558f4d086b89744b4ec44f1e5cc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649778005, "uuid": "0497fb9d-90f8-4195-b556-21a0dc31ab2b", "comment": "Malware payload (AgentTesla)", "value": "d7e31bd361bbb36fa7384a68938da79ec2f86bfd8425feff99f2cec7dd83660b8fbb821207b42c0a228dd3c60fd8aa4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778005, "uuid": "bf3b1950-b76a-44fc-985e-7dc1638b3aa0", "value": "T146F4DF19F7B6CA12D2AB1B33D0D7080507B0AA46D516D76F3791E2E99D033EB8D0A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778005, "uuid": "cc98542d-cae2-4d4e-ba82-896e1929b307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778005, "uuid": "d71a175f-0c1e-48ea-a75b-474ee7ead0fb", "value": "12288:8jpd6G14qngMEAl9NdpX9caqocgyxrXoO83RmWtZog2g6:AdlSqndEAl9N9cJsvO83RmMzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649778005, "uuid": "a93103d6-d7f9-46a9-bd43-05d142a047ce", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649778005, "uuid": "6e1a9cdd-2c0a-46eb-94e9-b0f7f6103f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649778005, "uuid": "7f3c4ed5-14f1-47ae-b13b-689dd693ca08", "value": "d1e545672e21fd378dc649ec449c7cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bf66f6-ba2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649746206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746206, "uuid": "52cd27ab-5e24-4daa-9eb5-add91308d1b5", "comment": "Malware payload (NanoCore)", "value": "10f33eb2a035240c98d19e5a28859072", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746206, "uuid": "1fef55b7-ce86-4aaf-a679-6d7f1bb8df24", "comment": "Malware payload (NanoCore)", "value": "f9c4697eee79a2fbf56d6eec2b25abb45180fc0194a5b6832a6e9bb18aa37d01", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746206, "uuid": "0a33c115-c9bf-4c58-a10b-4ce4d4f02a7f", "comment": "Malware payload (NanoCore)", "value": "7ead93be0fba1f308c8af5bd3c7f90cffb556e23", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649746206, "uuid": "86f53a53-cd16-439c-9aaa-c55e838d9b98", "comment": "Malware payload (NanoCore)", "value": "42860a7e493f380aed34d079552caa77932147d55351399a0cb1ad514883279c850dcf5b3dbb549cbd54de2d1ee618e1", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746206, "uuid": "f5ed6251-68a8-4251-8af6-ba453e270d73", "value": "T1E34423E21EA6C2A8E96F92DB6C611FC4FF506CCC0251626D65107B86C679C4ACED3F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746206, "uuid": "b7f84226-741d-4c95-be25-08735025d7e2", "value": "6144:hgoWHyJbp8hI1sLpcfGYVpuOf26Z0MYIP5397csRXbXpx9BTAuENH1Da60f:QSJbp3SLFEuOfmrIR3mgbX7fcV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649746206, "uuid": "b0618dc1-9f9a-4529-b901-8d10feed591c", "value": 277005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649746206, "uuid": "9ab5f16e-3805-4df8-b6d1-0127ec5f44f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649746206, "uuid": "fb28cbe4-5abf-4d88-9a4f-7c1fc97a472a", "value": "new item in 2022.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af8f805-ba61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Paymen45)", "timestamp": 1649768703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768703, "uuid": "8474c510-b276-4d92-9f98-e959ba7fceb4", "comment": "Malware payload (Paymen45)", "value": "152810665e8cb6bcc1c61230b6e929d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768703, "uuid": "cc34766a-cf75-4e53-b027-9ab156ec466f", "comment": "Malware payload (Paymen45)", "value": "f9dc9848892b3c1ca620a7a69cce4ff5bbf03cdfd0ad12f348973ea76d4d125e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768703, "uuid": "987d010e-44c9-4fe1-8dee-90c4e9462e76", "comment": "Malware payload (Paymen45)", "value": "484c0eeb4837d306ed80ef0ad2b852a10d27bfcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649768703, "uuid": "2274e321-7adf-4be3-a768-c2066b1684f6", "comment": "Malware payload (Paymen45)", "value": "af7b8a207db71674f892b03913e0fd6c898323b29914b28d3dbf8bd959965e22e41a204d2c058f5e8f3514c58ee3acbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Paymen45", "colour": "#1D6AE7", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768703, "uuid": "8f5468ea-8d8f-4eea-a586-8a849698911e", "value": "T1CCA4E090B6E0C5B3D17B19388C61A3705D76B8A72E7095CB73942F3F2F212E056A635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768703, "uuid": "d10d4033-3bb8-499b-b761-cfcd2496f5ea", "value": "b0bfeedb11847031b5705f17a793633f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768703, "uuid": "5a4264bc-6ff5-463c-ac9a-872848b5e5ff", "value": "12288:JdKU8XwX94klvytV52xB3S7H5NdyZSlxUj+iLxJuCeNJ4u9:HKbwX97+56ib5XYNj5zjeNJ4u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649768703, "uuid": "c531002f-4bb1-45a2-85aa-234ff1d33ff7", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649768703, "uuid": "8dec83b2-9337-41ba-b072-75dc6ef4c393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649768703, "uuid": "675bd582-41eb-4ce2-bf4e-31adce0fc0d7", "value": "f9dc9848892b3c1ca620a7a69cce4ff5bbf03cdfd0ad12f348973ea76d4d125e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06772d4-ba27-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649744124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744124, "uuid": "e8d6b956-1414-47a7-aa8c-76367fed1383", "comment": "Malware payload", "value": "0ac355d5aae8a8aa3fe2061a44da44c6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744124, "uuid": "42294239-e1b7-4171-afa2-79cc5146932c", "comment": "Malware payload", "value": "f9dcd291edb0e229ab621846438553ffe5e3171f52464db2c278ae5ca8ce7da5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744124, "uuid": "bc58f8d7-1b0b-4e47-b417-2d6e4b77cf0c", "comment": "Malware payload", "value": "af6f649e33a6d7a94e31c27071be4212a80a2072", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744124, "uuid": "b29b757c-b52a-4444-8085-bce91ea6832a", "comment": "Malware payload", "value": "1bfc2f053373ba9ad24e8aef44b2180dab5f5c980b40ddaeac1be3933730e7f48c239cae18c37da994965dca9244481d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744124, "uuid": "323e3a0e-045b-43e7-bee1-3bed5e4dbdb2", "value": "T17604121B8FACE50E005D2D280ACAE33D63D5A95A7DE85A6706CD07F05B799C8EB001DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744124, "uuid": "b995db4b-3ec6-48cb-94b2-eb24afc92135", "value": "3072:9NtAbhXcigucCdBP6BCBpIFqhKoFoTtiwvrUedzS2M0Y4WrQP1FopravWE:eYwnPUCDH5oJiwzzdZMXS/mravWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744124, "uuid": "7ab5a52d-3f15-4b5e-89cf-1bfd8006e23a", "value": 182024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744124, "uuid": "811856b9-7195-4fd2-8462-79845966d465", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744124, "uuid": "2506481e-ff67-4621-95bf-69710f14e41b", "value": "BOAO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50130248-ba4e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649760605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760605, "uuid": "d0809c99-cf0c-4f2d-8c68-6b97dcef0774", "comment": "Malware payload", "value": "1510f3735faecc0560189fc5d11fbc1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760605, "uuid": "7e34636c-0434-456f-8785-3cdc9f69c285", "comment": "Malware payload", "value": "fa420c2b125b959822296652ba7e720b4789da006bd50632bf52a2c61ee3524a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760605, "uuid": "a4a77f63-36f5-43cb-85ad-03e424d42a75", "comment": "Malware payload", "value": "a753826a7f2c2846ef98fb3f472a098249e53889", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649760605, "uuid": "5680e1f9-538f-4eeb-b4c3-ddca562b6225", "comment": "Malware payload", "value": "84d8b74d8216a7ea25f09b22597667c3c122d3a44962abe5eb4a621165bafce9d8218605d9c9ff2b0259bed6235c1dcb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760605, "uuid": "d5362ecf-8e77-4a3e-96b2-44b484d436ab", "value": "T19423F1495B825041CE914D37C9EE058F27421FF8A9FB71F0AA781BB2F94A19D95F83C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760605, "uuid": "c26d2f27-e549-4c9b-b85d-ccfae4e566ab", "value": "768:GxSmdEIYXrnFSjvkYewk4rsxgWbGhxO8WBfDiwUElxdfDWk6thuQAVlD+YhphJ7z:pmdEIioDewxr7WhD1Dxwk6jdiDLhfxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649760605, "uuid": "68e2bfb8-fed8-4be8-b515-2bb6d20f1d01", "value": 49728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649760605, "uuid": "57531c3a-faa5-4540-a3d3-9ee73f299fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649760605, "uuid": "a7ddc6b7-cda4-4eec-8957-3982c2b5e067", "value": "notabotnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6672a31c-ba44-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649756348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756348, "uuid": "21dbbf95-b014-4181-94aa-878e0e60e99c", "comment": "Malware payload", "value": "395d005180d3283fa8fb895bc4ebe9f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756348, "uuid": "e72a8e76-ce29-4cb3-aede-be204646b1a3", "comment": "Malware payload", "value": "fa64447c03442b4318f5be308c9551489a452435fe29632ce96b787a9e3f7b42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756348, "uuid": "3ec0d089-f218-49cd-b08b-c5efde9aac17", "comment": "Malware payload", "value": "95c57e71d253bdd3513107555fc7579f3738f153", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649756348, "uuid": "bd36a028-45e3-4ef5-997f-dacd41e482c4", "comment": "Malware payload", "value": "7dff8b6828e5d45e36362fa0aa5fd3bdd92c139a485388d1aaa681e1d47f0108f09c474bbd0298989db188da1fe7c04e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756348, "uuid": "ad03372a-050b-4675-bd41-88372494cc2c", "value": "T1FFF29A1F8766F5F58FF185076B6FA2608E904F0B4D09A8E869BBDB0CD15A43F926D084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756348, "uuid": "cf82c7e3-6192-4512-bd2b-1574c44e3546", "value": "384:3LoShemdkMzBtlYXZXgnt7DKS8vggJm9QJ43U8f2/8aeRshEltaaQoTPFyqMHkou:bnDkM5YJXgt3SyCGnha/EJXTgHfFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649756348, "uuid": "e8f4c713-2f43-47f4-a215-6ea6b87bf365", "value": 34286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649756348, "uuid": "7933bdd3-8eee-498c-9424-70b9d58191e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649756348, "uuid": "645315f7-e5b6-4a4d-b76c-58957600af4a", "value": "fa64447c03442b4318f5be308c9551489a452435fe29632ce96b787a9e3f7b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8e165c-ba29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649744711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744711, "uuid": "6b9c3db9-2c51-4178-849e-ff932beb00ca", "comment": "Malware payload (Heodo)", "value": "c78784264a694d41ce95e0367ffb2a8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744711, "uuid": "d7912150-12aa-4891-8aab-102a0c84c608", "comment": "Malware payload (Heodo)", "value": "faf1f9a85e9b952344259b8107f81b4f8b907de982b1c91fc5090aefd0df5a03", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744711, "uuid": "471ece51-8eff-43a6-9467-0508b839c2fe", "comment": "Malware payload (Heodo)", "value": "7edacd022e7f59b1be5a8e419003d05e0f156bce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649744711, "uuid": "81ff6de2-8aac-4763-8dcc-07c9b145dde2", "comment": "Malware payload (Heodo)", "value": "6eece1c2da262979e59e56bb73c0fec7fe56fa2af0dd12bc1ac6e595addb1cadf7566695829aad4b62380acae8da031e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744711, "uuid": "732e889b-f567-441f-8fd4-2cb9abc916b6", "value": "T1B3E4CF4331E0C27AD3EF66304E62AB7A77F1BE944F7599C7A7405E2D0D729C28639224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744711, "uuid": "0173658b-4c79-4708-a922-fe610908555f", "value": "de41e9174ae62fc0386daea226fb733e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744711, "uuid": "4285100e-62bc-426b-a758-7c6faad60f14", "value": "6144:y6T4JYKGSks53WzWGZp+hsTYEq5zasBP2cVc//FXhMm7DzMaIkqxsUZ6KYRdu:y6ILjk5qGZp+8YEODBeck7xBqx9o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649744711, "uuid": "a932d97f-114b-43d3-a01a-5118733cfc30", "value": 678742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649744711, "uuid": "bac67575-72a5-4c7f-96f5-334f9187d792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649744711, "uuid": "d2edcb47-b7d3-424d-87cb-cd632661ed3b", "value": "emotet_exe_e5_faf1f9a85e9b952344259b8107f81b4f8b907de982b1c91fc5090aefd0df5a03_2022-04-12__062505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a322433-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1649767574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767574, "uuid": "453997cb-4b11-42d2-9efc-dd563b1f99c9", "comment": "Malware payload (DBatLoader)", "value": "17663c8c9dba7b65bc2467dafaa66a63", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767574, "uuid": "c4893f14-85ff-46b0-85ff-5e9cf92b4caf", "comment": "Malware payload (DBatLoader)", "value": "fb1585455a00f739a0417c47ac5b948fe9df597f8fed63ed3584931031bdfcd2", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767574, "uuid": "73d7250c-2205-4ecb-8fbe-045d4cd99d92", "comment": "Malware payload (DBatLoader)", "value": "b57d1838aa0c816099c608d8c952b70f63fee389", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767574, "uuid": "956832b5-6a72-45cf-82e1-2f411a445385", "comment": "Malware payload (DBatLoader)", "value": "55851c1ed4f049a078238d20080d29f294a7c373596377349e0b60203758e104c4493460d532c01b211e297c3499a54e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767574, "uuid": "156e5ba7-b944-415f-85b5-d14090650d01", "value": "T1C1E49D02B6618F32D93B2E7D4C0B9B9D59277E532E18A2D73ED02E087F751C1396A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767574, "uuid": "5416f538-89c6-4ce5-bcbe-cbe6c33b695e", "value": "5d5050040f4c4e416770aa091e077eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767574, "uuid": "ef6cdf03-a798-4f16-8017-c8606b85891b", "value": "12288:hCUTK74suoEON+SvvkDnzg545S3JsDh2mZec4qO:wkKHuoE+/vI0icJskmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767574, "uuid": "0d7d6d20-af48-4139-aaf3-47e8ac3b653b", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767574, "uuid": "c8d7dac1-cfba-462c-a3d4-b7139b8bfd09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767574, "uuid": "fb7b739c-87e4-4638-8a19-2020cc12ff6e", "value": "17663c8c9dba7b65bc2467dafaa66a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be5ce35-ba5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1649767067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767067, "uuid": "98e86db8-2d71-4b59-b90f-3d3cb90f1340", "comment": "Malware payload (AZORult)", "value": "837547af8d2a1f60f8bbe09066f0ffa2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767067, "uuid": "3b716e2e-fe57-49fa-a57d-14f0d77be8bb", "comment": "Malware payload (AZORult)", "value": "fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767067, "uuid": "06f33267-e19b-4fff-a22b-54cd5bcdc660", "comment": "Malware payload (AZORult)", "value": "727421a8ea79d0c0562870c33d055224c7c9a4bc", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767067, "uuid": "67a0e1c2-58f1-4388-a28b-3387e9cb49ff", "comment": "Malware payload (AZORult)", "value": "a8ba2bcf91237479fab0a0774ff1e29ec0d44dbbd9921fd2baf033817257872c63e43d83138941b6b63738f80caf9307", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767067, "uuid": "1e56f766-68ef-4316-aa85-708d139a9d8b", "value": "T1ADE4021D4DBA0373F20A467127D284D4577EACA7399DE85FEB402E882BA7D1102477BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767067, "uuid": "d9c5aab8-012b-4bd6-9b15-bfcbd40ecba1", "value": "17b4b1fe70fbbdccbba7c09889838934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767067, "uuid": "b2681e05-7c9c-4097-839c-7b3880dc8990", "value": "12288:M0sFGCY9CJFLnrZlZ7f0sFGm45w1s16RlXz2UOFoJjjy3Mkx2lXz2UOFoJjjL3MB:M0F9EFBl1f0uc6TsFodydx2sFodLdxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767067, "uuid": "ad8a33b4-efbb-4989-9e58-f57bcbfb4740", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767067, "uuid": "0ca8b7bd-085e-430b-97b9-5eb9c86b0ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767067, "uuid": "9cd6254d-f549-4ba3-b18c-d9079ac68ee9", "value": "837547af8d2a1f60f8bbe09066f0ffa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bb5f06-ba5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649767461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767461, "uuid": "089d6d70-0ad9-4372-8c8e-d6d2d97c5df4", "comment": "Malware payload", "value": "6e58d11ebd4fca157753f1ed8e83bdb6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767461, "uuid": "b987afde-a0fc-452b-992d-01199951c020", "comment": "Malware payload", "value": "fb7c3783bf20424691be840df52115e40db6ce9bac2d75563f8aee7444422d82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767461, "uuid": "c576d32a-05f7-4ae6-ba10-b232fe7b59c8", "comment": "Malware payload", "value": "41f1f4db7ba83ec56ecc69d53c3dfe68b096d922", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767461, "uuid": "5c2d62fa-e049-4d5f-b554-9f495a8de7a7", "comment": "Malware payload", "value": "2566c45fdff2f9839c825c6b087864be65b6d6d9cbc36d6cf0e4dea8fa0a50b01801146ace753492e11978eb89e845ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767461, "uuid": "50663def-807b-4973-816f-745c648fb3ce", "value": "T180B5389C36A072DFC86BCA72DAA81CA4EB60747B531F9207941311ED994DA9BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767461, "uuid": "f5e1bcdd-9943-49d8-9485-5b775860b597", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767461, "uuid": "3a183d7b-7caf-41b1-9bae-da1fffc5ca0f", "value": "49152:Vuc39txr47OQuplwJAwyAs2F9J7u2LkSH:V/3pE7Cplw39J7um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767461, "uuid": "33a60b3c-c6ce-40e3-b837-4b7f7dc89e95", "value": 2386944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767461, "uuid": "44eabb98-962b-4bdd-b018-3adc9d3621d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767461, "uuid": "8e2c91c5-9673-4c36-9247-934d6dcdcbc4", "value": "6e58d11ebd4fca157753f1ed8e83bdb6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4faf705-ba55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649763888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763888, "uuid": "a857820d-eb74-496e-8fa5-4cb562162c2d", "comment": "Malware payload (Mirai)", "value": "c0a7a2d8977015e664d6df9b625a7a05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763888, "uuid": "af601674-38a9-4f94-a20b-f5352d315b3f", "comment": "Malware payload (Mirai)", "value": "fb7d311fc10a1e0cc7ccf52374634158a5d7b1c9505ea44c0b5cb4fa04a47540", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763888, "uuid": "27d272c9-5f5e-4f86-9e43-45de00751361", "comment": "Malware payload (Mirai)", "value": "b86203b5cbbdb4b30a303719c750d5981ef5674e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649763888, "uuid": "158fd717-531c-424b-b26d-f13a4d979774", "comment": "Malware payload (Mirai)", "value": "ca10a2305bf187d2ab6eddb5bdab83aab9dbb5188759e459c77be97704acda92727bbd08cfc12dfe36e3198d3bf851ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763888, "uuid": "07d39510-2b0e-44e8-92b4-d24b5b88d95c", "value": "T11123F16F5221EE96EABD1BF032E1074036E11F916092CD4B2F2867D3AF44680749AFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763888, "uuid": "5d55e001-a5b5-4b54-ae67-b1eaba66f03d", "value": "768:HxEdg7w5FofmmnSxXB1x2dUTzQs/f82J2ioy4OA1+SmAbeSeaGpwckJgGlzDpbuz:RcIwLofmiSxXjK4zQ68m8OA1XbecGSVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649763888, "uuid": "f21a42d5-573f-4c2d-806b-40296fb52847", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649763888, "uuid": "d43beb28-470a-4637-866b-6fbdac15622d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649763888, "uuid": "6721cb97-0e2d-4074-a9af-14cb4f98625f", "value": "c0a7a2d8977015e664d6df9b625a7a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda3eab4-ba0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649731664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731664, "uuid": "ad7cde11-ef32-4fed-abf1-176453cddea5", "comment": "Malware payload (Mirai)", "value": "251666699382e4e9934e2016814f87e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731664, "uuid": "2715e67d-29d4-4d7f-97de-d56a7326f703", "comment": "Malware payload (Mirai)", "value": "fbb13704d4e0f20d43499f1ed32e77643cb5d00fc6d364eb5814d0dd073b8fd3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731664, "uuid": "557b088a-32a8-40ea-a6a1-0105ac1097a5", "comment": "Malware payload (Mirai)", "value": "fae69ba53ac76f5e4e43eda8c7303df87e969333", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649731664, "uuid": "b5e6ee44-b82c-49a7-98a9-98e28ebc2a0b", "comment": "Malware payload (Mirai)", "value": "fba1ca8e829202371825e1f4bae8df0f5bb12b6a5002630914d13d209a2d1c8b966e6b5e996a3008e3f692490beec126", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731664, "uuid": "99ec840b-df04-46af-9898-6fffda0343a2", "value": "T1B4634B47B58581FDD0D9D1BC52AF6532C822B97D133AB18633C0FE2B3D19E606B2E589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731664, "uuid": "821896bc-c8de-4d0f-9857-a02a32d5502c", "value": "768:+Kn+DYhXkXtcQcW5ONKNhBVSAOw2nvw/PA6AazVaa51QdEMNsrE8040oELWSX:o8yX6W5ON+OTwWLdkawIstl0oELWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649731664, "uuid": "82d8ac30-2627-431b-a84c-b83107087929", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649731664, "uuid": "a64410ab-dfc7-4c58-9408-ade6c387df0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649731664, "uuid": "fa39fbc7-4c77-4184-ba60-10d5f2b3fd9c", "value": "x86_64-20220412-0247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8b6780-ba4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649761242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761242, "uuid": "034586a2-8f6b-488d-ab96-b407b64bd124", "comment": "Malware payload (Formbook)", "value": "aeeff697990668c7f8c110495fe6cdc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761242, "uuid": "e4c288d2-6938-466c-8e57-25ba8bf0118a", "comment": "Malware payload (Formbook)", "value": "fbcf4ee29500a0213f0afb0877088e0dc85bfa74f95c80f9ad289bd2c816a93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761242, "uuid": "9509cae7-468a-46b8-bcb7-ec88ce30303d", "comment": "Malware payload (Formbook)", "value": "5f7cad1026b554780d3b16f781934e32aa7c5ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649761242, "uuid": "98edbaf5-77b4-4930-ae40-773173f49804", "comment": "Malware payload (Formbook)", "value": "a15a1c22e51072f46582c9c2ee5b2ae62b72a5d9a0ce5339c1b89e8cb1c6feada6947f61482622c1789ab6f59e8a6d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761242, "uuid": "b3c66645-344d-4381-ae4d-e7e81357fb9d", "value": "T199350273BB56DEA7CEFC96780420BED363E182225243D74EACCC91A9B7836D857150C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761242, "uuid": "1234b314-cd79-4b14-9843-6cfe8455148f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761242, "uuid": "4c268957-c31c-4c71-a64f-c5fe36e88471", "value": "24576:/dBqCebfeuXVgOnZfea4+AgTbQieICRls5PmUg0JQh4:/dBqCafeEVVZX/AgnW5RlsxmUgGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649761242, "uuid": "0ac38738-94eb-4ae4-8096-008b81ca47d8", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649761242, "uuid": "7d743982-1203-4d66-a6b6-832c5f92abdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649761242, "uuid": "91006179-e22d-47fd-83e3-d8a498ca6afd", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141f6f1a-ba5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649767806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767806, "uuid": "d16f1cd5-27cc-45a5-afb3-b6a8137f2640", "comment": "Malware payload (Mirai)", "value": "a6fda0c75efd8a1dc9df97aff42a3bc4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767806, "uuid": "e9196fe3-1e97-4548-b00b-dc4a327c16b3", "comment": "Malware payload (Mirai)", "value": "fbdebdc1c6c6e8f23bdb79a0a67dfee79aad7c446897937a9e1ae69c9abe8414", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767806, "uuid": "8c5717e3-39cc-427d-a618-4d1b5ebdaba2", "comment": "Malware payload (Mirai)", "value": "6e723a942fc400a4b496f8392af9b407e53e9f1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649767806, "uuid": "15417064-2468-4bd4-ab78-42ab315dedb5", "comment": "Malware payload (Mirai)", "value": "5ae6be49506191c999773ceaddc744afba681f96ba49feb7a13e7c620f76f4de6fc6d04c5aa09d24513d18cc3910e66f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767806, "uuid": "ed622c83-4f47-4c7d-ab72-828869416d9d", "value": "T11123024320D3BA03E03458FE45628CDEB54AA6BCB1BF7B6B25490E154C75D93ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767806, "uuid": "ddd6d1a1-4889-4254-a3b5-a9f564a72f88", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFy9q3UELWt/iw+kvBGg6+fYtrBHP:P12O1LCNguovDPH7TcrdLWhiw+kvBGga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649767806, "uuid": "b9ebb760-b1a9-41d3-a42e-257fd3722972", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649767806, "uuid": "09ce1b20-c839-4125-9362-741cd2363d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649767806, "uuid": "a6b0a4e7-7849-4e7c-9379-9c1a32d6b230", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67edc60c-ba3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Metasploit)", "timestamp": 1649753773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753773, "uuid": "102b2ae4-6ab3-4d6e-97b4-8d3bcba5ba77", "comment": "Malware payload (Metasploit)", "value": "4dd93b057f00e9ea1817457d1a7c3984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753773, "uuid": "a410f482-3ec1-4a39-9952-b7f1a7b52c9b", "comment": "Malware payload (Metasploit)", "value": "fd1fd6fcd18b1d5dfabaa2f2cbcc28762ad14516c5a8f135650545813f814af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753773, "uuid": "4a720641-0b62-4ca2-b063-08459dea27d1", "comment": "Malware payload (Metasploit)", "value": "6b887a1c2063a7b72d9b5405eb58a7ba5c912c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649753773, "uuid": "fb282c49-d8ca-4dee-88eb-90e8681bfe0e", "comment": "Malware payload (Metasploit)", "value": "eb3316bc096ded27603a6c055d4764df7d107e91c370a60905ddb3f1ebdb3732e8eff219455e275c13f83bec00654854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753773, "uuid": "0d23cfb2-a5ba-4c02-aedf-8287f0589352", "value": "T1D392195EB71748F9C219D578DAFB4731BAB8F9221DA0833D02A0E5770E717509BB9E20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753773, "uuid": "c00cc6fe-81d8-434a-85a5-24565657c5a7", "value": "cf397ba7f5cdb6400d37be4fa241a399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753773, "uuid": "c9483b07-baad-4329-9679-066199fa12d8", "value": "192:qF3EUjGJmfsD9qoG7RT67APJln2rfipVYoyyzJAq43unfmpBVzwi+Rxb1:qdEUz0RqoOaYJ1dJAq4+ne9Uimxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649753773, "uuid": "fc68c29e-b57f-4e72-9f9e-89912ff1c0e9", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649753773, "uuid": "66bb095c-3a60-4f66-ba2c-2825f27eab91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649753773, "uuid": "f732b1c9-aa24-45f4-a653-8f2b833885c5", "value": "ldass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcf087b-bab8-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649806265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806265, "uuid": "4e84fc41-a48e-4b55-a1ad-592b6ea13b11", "comment": "Malware payload (RedLineStealer)", "value": "d78de0a2e4309e722df49f0d4c99003b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806265, "uuid": "b324bf17-7b18-4f46-9ff4-d25d553c2e0d", "comment": "Malware payload (RedLineStealer)", "value": "fea906cc495a43b46d07db657f68b3635b7c8c436798e8c955398592b4d1c056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806265, "uuid": "82387fb1-524e-46bc-82ff-b1a3c3daa8ac", "comment": "Malware payload (RedLineStealer)", "value": "9a6b02fc038e5c8a210d68dfab74d25ef27c30e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649806265, "uuid": "b227ecee-bceb-417a-9304-19cc7b7732ef", "comment": "Malware payload (RedLineStealer)", "value": "ec9cfe8472848eee6fbdbca870a3059a8c0b905e4c9e23340740b86e6bea13888fb19f2132f5293d46dbec736fea0c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806265, "uuid": "87a1d75d-d704-4f20-ab84-719a19f9a530", "value": "T1ED74F10237E2C032D067AA302935CB615BBEB9335671468B67A4137E1F607C29BF975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806265, "uuid": "1ea85199-c88f-47cf-a92d-04220e69c784", "value": "7f83c3d2c71504a0c9bb3a99cae3fb31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806265, "uuid": "ad4cf736-9b86-41e8-9a25-bdd4f44d473b", "value": "6144:Fh715nsWqfmtM4Y6IktcZ8q/Kmf14Fk6On:95nsWqDktmjSu4Fkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649806265, "uuid": "4e13149a-c346-4301-8980-43285c1aeae1", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649806265, "uuid": "40b4a260-3b14-4c44-a48a-f6995e884c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649806265, "uuid": "9113c670-62d3-4bf6-9ec6-88b6cf789d33", "value": "d78de0a2e4309e722df49f0d4c99003b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e74ab6f-ba31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649748093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748093, "uuid": "9f1803f1-d25f-4d07-8977-283138c0969a", "comment": "Malware payload", "value": "6ed5e8e0a7c33086c1ccf9b19bbd61d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748093, "uuid": "bc6e6fc2-9610-4123-9b73-f92976e242c8", "comment": "Malware payload", "value": "fec2fc379d25ead244f6086577325ee90aa5a78d5178e1e76af139c7557043ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748093, "uuid": "821a9c76-564b-4a52-ac54-4617a1adbcf4", "comment": "Malware payload", "value": "14f2039dace995737abf1e2aab5fedeb08b3be4f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649748093, "uuid": "be1f1dba-65ff-445f-bdc4-8fcf6537388d", "comment": "Malware payload", "value": "6afb772a2814bebd065a7417790cf8f513440809d41d300086fd750ea03549c092eb18134b81f4b29431d368543b4745", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748093, "uuid": "75ddc53a-24e0-4e6a-9c42-c265e6f767f1", "value": "T187F1F80ABBE81A36F4BE473D88F34B0913B1BA999512D71E1CE010BE5D66F215621FB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748093, "uuid": "2663696a-1e13-4aac-a1ba-20ea1c87792d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748093, "uuid": "18e5b18a-5757-4b5a-ac55-36ac19dc8b72", "value": "96:BvlACp0gyFjFeAKKoWoPWWtASmsTHBgHCHDCAymjPZRdYyT0Y1ufh2:pl0gCoWoPd97VBj1fRRNXuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649748093, "uuid": "59cef86e-7dd0-403d-89fa-43acdc1a62fb", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649748093, "uuid": "8688c80e-59c3-49a3-a05b-960e37c145a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649748093, "uuid": "ee9b5c4d-3058-4777-a54e-61414bbb56ba", "value": "system.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e7a4e4-ba22-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649741952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741952, "uuid": "35abfe45-efa5-4489-93a2-17dda43ff011", "comment": "Malware payload (SnakeKeylogger)", "value": "bfdc4a7009d813394e0889036fafc421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741952, "uuid": "9d777752-5f44-4087-bc2c-0af04adf9cd4", "comment": "Malware payload (SnakeKeylogger)", "value": "ff7c332b77194f5bafb276ac4eaa038e5014d8bc546cb49b565156581cef3449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741952, "uuid": "80859966-fd5b-4372-b1a2-10bb5fb34aae", "comment": "Malware payload (SnakeKeylogger)", "value": "7ddae09a11fc537300bd9d4986ee92b9c7c70cc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649741952, "uuid": "5d6e1708-b8f9-405c-9985-1f02c231b2d8", "comment": "Malware payload (SnakeKeylogger)", "value": "f0863d922ebe1c724c427ca4021951f79be9bc5d680368aed9ffb53b3c35af64b232de83d36534707b8e5f237ff76552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741952, "uuid": "de87c69c-1d63-48c5-baf2-f12263f44a9f", "value": "T17DC4D0157AF88629D5FE07BDE43801904BF676176826E37C6E0570E62E633D08B43B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741952, "uuid": "da2a5706-0536-4ecb-bce6-da6eab599fc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741952, "uuid": "bdbcdffc-2f19-4616-a8d3-310186d21ed3", "value": "12288:2kKUk6i/54qMU7T4Z24pH1ytCa4Sj8GtMplKxla4NLngVgz:2kKX6i/mqB/4x15Sj8GapUxlTNLgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649741952, "uuid": "8e301d64-b1b4-4933-b8c8-dbe31c3d9e74", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649741952, "uuid": "42c1dc61-2917-48ff-84f6-5b3fef058b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649741952, "uuid": "b7416d91-2761-4f3c-9963-ffb8a1767c42", "value": "duONZIw23uNXjKY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }