{ "Event": { "published": true, "date": "2023-04-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-11", "timestamp": 1681257781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3e808c1d-4ad7-41c9-b009-f37e47d3d0d7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb360463-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239030, "uuid": "767bdd20-9a03-42a0-b592-35abe456a5dd", "comment": "Malware payload", "value": "8088ec22f0f885086d42163c1e837ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239030, "uuid": "92eeb149-510a-4767-a90d-6fb3add5d0d3", "comment": "Malware payload", "value": "00054622b44474a980198266bf3f838d43cab9abe99e12788eda9ba208a57d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239030, "uuid": "c3eda312-4c49-4e02-9dd9-fefd2cfc8e94", "comment": "Malware payload", "value": "4ace1ec16fb009bf5012e0c09868d639c4ca10ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239030, "uuid": "9cb3d31c-9480-490b-b815-df294dd9391b", "comment": "Malware payload", "value": "86ee1a8ddae343344035ff6c6122f63813256479cc1e62c7b31e10a93526e0bbe33405ed64f007176ddd39488190e0f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239030, "uuid": "5779e326-f9e9-4718-ac49-1082e661e692", "value": "T1B1D41298A7099E33F630B6B0485BE904E145EC931AD7459FE3EF60FA18F857624F1712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239030, "uuid": "4402c4a1-3a7e-4acc-a3a2-4237b01ade16", "value": "12288:n7e6XXQDq1gU6Qv4Dbndue+NQWPGQxLtRzId5c0sr2b2sHG:n9XL6QA3d6CWP9PzITSS2yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239030, "uuid": "2c194091-22cc-4934-8f82-c27f94120bc7", "value": 626944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239030, "uuid": "05e8018c-3320-4071-a605-4f34792f135a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239030, "uuid": "86cc50d6-722a-46cc-a24f-fc05f7602165", "value": "8088ec22f0f885086d42163c1e837ce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af742ef6-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681208945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208945, "uuid": "c5e3fefd-ad1f-49ea-b894-6c50762b6fb6", "comment": "Malware payload (AveMariaRAT)", "value": "2a9a10cf99c08294f8dbcad1cb2aefc4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208945, "uuid": "d571f064-28c2-4c0d-89b8-43d18fc4b971", "comment": "Malware payload (AveMariaRAT)", "value": "005d2a65565cdb08e23d88a19fe9ed3e6bffe3358ab1ae34b252cd56a47a2bb2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208945, "uuid": "d4e56136-bd1c-4100-8cab-fba2e6864c8d", "comment": "Malware payload (AveMariaRAT)", "value": "bdbe3271e310ee12fb6e1e62ca7627ca829e295e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208945, "uuid": "a585f8d2-1ce3-4b9b-bc74-a7a55546985d", "comment": "Malware payload (AveMariaRAT)", "value": "a41d8ac52fb359b447ee05f418f5c17c5d56ad0b92fc47a7b74a8110aea9cfd02cc24856b1c19cc41113d779b44cc6bd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208945, "uuid": "0d0de992-212d-46c4-b3cc-08f62fbdd0f8", "value": "T1C0E47B112298C3E9F5E1B16E3534491312F4784E9F7CDAB1CA72B9D379967CB90C2A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208945, "uuid": "f3a3acc1-b5c6-4cee-aad3-e1e5df4934ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208945, "uuid": "f2e24884-4e6a-4c08-9478-4d5ba2c80fab", "value": "12288:/ZDyDycgdQlL2LLA8YHC658udnCuFcakE4XdKt:Rt2So8QnZFxkE8Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208945, "uuid": "24f315e3-4f3e-4420-9cd8-59e5fa35e04d", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208945, "uuid": "453822c2-b194-4d57-8d08-e28c6207d901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208945, "uuid": "e1745b3d-2724-48ea-958a-e3b6723c7435", "value": "Purchase Order\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d666bcd9-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681205574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205574, "uuid": "dcd32ee6-e934-4724-8cd8-9341c57ba777", "comment": "Malware payload (RemcosRAT)", "value": "cb43cfa544d997cbbf5ca1d3e437fb92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205574, "uuid": "8b2d98b9-225a-4503-807d-e8192974bb19", "comment": "Malware payload (RemcosRAT)", "value": "0294cdf9c9c38ea1f2261b63206293516944cffef513e12701c3092a9244c0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205574, "uuid": "01104495-73f1-447d-ad77-c47038565b2a", "comment": "Malware payload (RemcosRAT)", "value": "e1fca898451b04cef664b94a5ab33089b09932a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205574, "uuid": "b75c6dd0-f537-4f28-adda-f8a77f269db2", "comment": "Malware payload (RemcosRAT)", "value": "85341e68537044046f54aca58b13c2dacdb07672b377c7cc9d484e0e32e125041ed10cae15847cd99227b4ba133fae4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205574, "uuid": "7e475f29-7a71-48f3-86ac-6e704e837436", "value": "T1AFC61913FD8699A2F2559BB3C4E71C546FA8E8436697E209B48E334D0F33B762C06617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205574, "uuid": "e57272a0-7059-43b4-a52c-4d0cad9c0c12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205574, "uuid": "c0bf2455-c9bb-4ed6-9713-ce8eb2247b43", "value": "49152:xoH566E2qvkjUPlrrQMEwNQ7uR+crlECdJxnXFcA/qDMOx5JJx6mNqNbHhBA8PNb:W3jUVP67uMcrSCVSLDMOxnJsFZOBs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205574, "uuid": "f57dc572-6cdb-498f-858b-3cfe862650ec", "value": 12045312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205574, "uuid": "9384c6c1-a683-4ef5-9ca6-ea4ec894e64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205574, "uuid": "c8997776-75fd-4c2b-9027-a2ccb0409d4f", "value": "cb43cfa544d997cbbf5ca1d3e437fb92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516ea7a6-d84c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681205781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205781, "uuid": "fe114b04-c372-4de3-bd0d-0aed797ec7f3", "comment": "Malware payload (AgentTesla)", "value": "2f5057e39c53a0a05f7d63f9c5646a19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205781, "uuid": "3a11d17b-3646-4168-bcde-34b2a58f048f", "comment": "Malware payload (AgentTesla)", "value": "0442d940427ea6e7f9d614bb83ca56d539bed99c4307b7a6f13c35d73c002ef6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205781, "uuid": "d2aea56a-2028-436c-ac26-99857f21c2a9", "comment": "Malware payload (AgentTesla)", "value": "884985d5cd97d9d24f6980fea543048e304dc180", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205781, "uuid": "da94bf34-8caf-4ff4-8553-c8de9ca42b97", "comment": "Malware payload (AgentTesla)", "value": "ffd13c1900f52bafc541f6c17bbaa9513a04b2dbcaed4673af5b4783df7ca5402d5457eb665e5e420cdc1eb79137c33e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205781, "uuid": "d6177e0b-b6d6-4d12-884f-bf1d541f71b4", "value": "T103C4011E22B5DFA1E49C0FF454A4544227B8E246E170EE9C9CD313E78B72FA221497E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205781, "uuid": "7c9c58d3-8ad5-46fd-aedc-5deacfa4c1b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205781, "uuid": "2755c10e-5e90-410a-ad62-59fa2a31a6d5", "value": "6144:lKmwv8tYElAn3G8mp4By4+thGA2j+okJNs4hwmRGB5M7RPtSmjyaIEEJN3zAyVtD:vwv8t1+nvmxwPjIXAS9FPsmjPSDmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205781, "uuid": "f9021119-756b-4f26-b062-06b23b2c0445", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205781, "uuid": "0a79130c-1814-48a2-9d35-e454fb3859d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205781, "uuid": "46b6a242-f39f-4b55-8fdd-198ee07f8185", "value": "78410936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad100c0b-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218819, "uuid": "0f1275c2-731a-49bc-bb5a-c2286427fdd3", "comment": "Malware payload (SnakeKeylogger)", "value": "8a5c5e9c32f4321602c58fa73bed5583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218819, "uuid": "88767020-f55b-4c53-8261-7e471ca40d82", "comment": "Malware payload (SnakeKeylogger)", "value": "04aa55e1600b801ddda368268eaf6f2ab9858f402b526468d727a943eadfb122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218819, "uuid": "45c773af-1538-4e40-a7c4-e8ca1f04e7df", "comment": "Malware payload (SnakeKeylogger)", "value": "7be2847cccca04184b860c5a59ce64002faf399b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218819, "uuid": "b894ee04-d38f-4750-a2e5-2907837988bd", "comment": "Malware payload (SnakeKeylogger)", "value": "d27e03ec5e86f3a010c86b87e51fbf3e65e58def35f96df91ce8abaf772e237159d611f4b6903c7b1bc096e959ac1baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218819, "uuid": "2accf9fa-cf4b-4561-a840-b4c7e2657f0e", "value": "T10255226D43B0DB69F46C0FF1646454812378F249B960EAA99CE353E38776BA220593F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218819, "uuid": "2500fad2-b6d2-4db0-bcc8-0528c955896a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218819, "uuid": "71a94742-67a2-4529-975d-b6b3461cc506", "value": "24576:BCgp2MjsjbaTTFnRfmCProMwes+CQM1lE4Dt+B6ef+mg8zvWNo:BCgp2MjjThRRrop/TQElt+B6B+Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218819, "uuid": "acc375fb-4ba2-4705-ad79-4e9b24dfe869", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218819, "uuid": "738b8b49-1ebb-4ae4-8c03-7581af1ccc15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218819, "uuid": "a7b041c1-3e8d-45f4-b152-6a9ff95abb27", "value": "aO4531DgkGtMPOE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c97d753-d8a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681245770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245770, "uuid": "5f0da98f-bae9-4e56-8736-2ac43586b85a", "comment": "Malware payload", "value": "4d024b61a8c46bd4ce7b09b076a7ea22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245770, "uuid": "c10cd812-47eb-45c8-a378-5612dc3cf52f", "comment": "Malware payload", "value": "04e8cc86e07b01fc81ef6ef10ae8a5d36a9bbc73a42f1d022eb74efe1674fa56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245770, "uuid": "a8bec28b-f465-4e99-b4f3-e1aaf2e40d39", "comment": "Malware payload", "value": "4b272b76200a54ea1aa04412b93c22d39094dcfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245770, "uuid": "1c5ea8b0-e709-4e21-8865-736f65c6b626", "comment": "Malware payload", "value": "6c7dbbd1f3ce2d56facc30abe1ba99afeb2de11f31e23f31a73fd90d9c0b3891912aa3a17cd69aa271c87d23eef75b9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245770, "uuid": "0c80e391-3d81-4065-99ac-de0cf668f267", "value": "T116052316BBE88073EDF027745EF212E70B367C924CB4832B27468DC95DB3A94987175A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245770, "uuid": "72632c03-815a-44af-a529-5ef6bddda7ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245770, "uuid": "67d0731b-f157-4efb-be32-b648de5c389f", "value": "24576:fyI8N2q+6r6S/c/CmaO+DKHa3x2NLDZ/dB:qI82q+6rb/cKm1GKHUiLD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681245770, "uuid": "509d79e3-e911-4d1d-ac7e-c65f01d32d90", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681245770, "uuid": "4eebd5b4-4bbb-4675-be56-eee7c2acadf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245770, "uuid": "3756735c-a538-4ff4-9bdb-755e97db021f", "value": "4d024b61a8c46bd4ce7b09b076a7ea22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce81b08b-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681214151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214151, "uuid": "dabb4449-9c29-40d9-9a3c-4fdaa61adad7", "comment": "Malware payload (AsyncRAT)", "value": "4b9e652cd1d27445237b953505deb0ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214151, "uuid": "0a70f0d0-42fe-4c57-8c1e-e0f1e27a1729", "comment": "Malware payload (AsyncRAT)", "value": "0518cb75ba804d36f96c52f1a024558379a3e3fc974964e1baeff42816559976", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214151, "uuid": "4fdd6c14-2d0e-46a9-80ee-e9e1f753d4c3", "comment": "Malware payload (AsyncRAT)", "value": "49328fa6b4052ea9c11314ff9bc5d6b5d9d17f49", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214151, "uuid": "34da5e80-4432-4f7a-a3b6-baab22684fc5", "comment": "Malware payload (AsyncRAT)", "value": "35de284a450d9726580ee85d45f05e314449fd1bf000a449eb6b71a3c589520d9b6408014f09f94e68a70c19ec7d5595", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214151, "uuid": "e670650b-227c-492f-8d05-428e9527e56f", "value": "T1C9347B9D355472DFC86BC9368EA82C64FA61747B870BC247E41726AD9A0C99BCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214151, "uuid": "79aecf8e-60e4-4952-ac5b-e85f8f91523f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214151, "uuid": "01be3be4-5a72-45f4-879a-efb6192ab29b", "value": "6144:b5BJtXfMc8TA8evgNMFjTy/NX4YBSAhgpHeRI:jJtkX08evgNzNXBS4gpHeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214151, "uuid": "15bb77e9-144e-4282-9b3f-6ed1a3ffac4c", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214151, "uuid": "03657b82-01af-4082-ad6d-481eaecccf1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214151, "uuid": "87efa7f1-8ff0-4249-b915-48da8d9eb70c", "value": "4b9e652cd1d27445237b953505deb0ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a853d81-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215111, "uuid": "c735efd0-f0a2-4ae2-b603-a1f4b36e0026", "comment": "Malware payload", "value": "4cabf92c98ef69c5f77b3ca39f4b07c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215111, "uuid": "9d042adc-8513-4540-9a97-ba24ab81e7f5", "comment": "Malware payload", "value": "05ee0fa741f6bdeefdf9c44be30f06379e2a6a4b21672b47323be04f348deac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215111, "uuid": "24c98235-4e1e-42d8-904f-15702048a6d9", "comment": "Malware payload", "value": "154b567942b3dd16579587a3e5035e91cfa49058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215111, "uuid": "f9fd3f50-1a17-41ba-8e85-5d44305f89a0", "comment": "Malware payload", "value": "2c2ba51bfe786e757d138b2e6701042822bd0fbfddcd55c2eb85f51642eeb283e074c000b4b037d117fdd328af23c476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215111, "uuid": "ef2a5bfc-8fbd-4b71-ae55-b8b7eb23e769", "value": "T15A3623B3126A0105E1F5CC3D8623FDE831F6037A5A427C7959EEFDC52A214A4F627A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215111, "uuid": "2e275637-31bd-4458-a2df-23e7f1b5a12c", "value": "cbba6ec1c15baf471229f32989e901b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215111, "uuid": "65a1d621-1ddb-43ca-85a2-d6c6d90e94a6", "value": "98304:bdbH1biyvTeKVBgul9Q3GmXpVAwJzdY8egYv6P24FHBx179vx0:bdj1WcTeKCVpVAKegYv6Pvz7x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215111, "uuid": "620d0acf-b1b4-4209-bc8b-2caba3878028", "value": 5259264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215111, "uuid": "6163057c-d2e0-4e9c-b62e-e3ec0785d2ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215111, "uuid": "caf94a83-733d-4a6d-85e3-aa54b5e9bf27", "value": "4cabf92c98ef69c5f77b3ca39f4b07c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068bf58e-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681215104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215104, "uuid": "48b2249c-fbda-4dcc-9f5e-9cd96c68b475", "comment": "Malware payload (Smoke Loader)", "value": "238c57b6ae0461932bf6e25f129c42e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215104, "uuid": "6f095ec1-a702-4c0a-a836-38a03b331115", "comment": "Malware payload (Smoke Loader)", "value": "06162d0491e865bebbd46a8c93b2d760179cc860e1746555e1cefd872b146245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215104, "uuid": "694108d3-bf8f-4248-916a-7e4c166c8628", "comment": "Malware payload (Smoke Loader)", "value": "07461940fccea90165434ae79a5f06b79f59295b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215104, "uuid": "237ec526-56b7-4617-b932-bb11e3046f85", "comment": "Malware payload (Smoke Loader)", "value": "ce23acc25d2dd08ac6b4800b9c98fbe1006a614837108c6699ec3a728bf7b3a6ac5ad826e973320d69c2c661f0278fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215104, "uuid": "03565894-f568-4b62-b709-ed1854d6da4e", "value": "T12014CF21BAF1C072C76F417074A2EAB4667FBDE16350864B239827AE1E313D14A7B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215104, "uuid": "15718f6e-0c3d-42be-a618-10eb1fcae343", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215104, "uuid": "2aa9ce37-8bda-4f03-ab57-69e18382911c", "value": "3072:AWVcb3qNOombdxCfBWNz5ERLK6uMxMHpDWcV7R/p7fRoGX:NTIomb7SB80e6uiM4a/Po0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215104, "uuid": "ea24c87e-3193-42fb-8ea3-d5e9a31e323e", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215104, "uuid": "2fcd116e-29e9-4ade-937e-24effad89abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215104, "uuid": "e7dac633-0be1-48ea-a79c-02c3dadd8aac", "value": "238c57b6ae0461932bf6e25f129c42e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d51016c-d830-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681193802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193802, "uuid": "8bf9e7a9-1cf0-4142-b0cf-4ba009102e58", "comment": "Malware payload (AgentTesla)", "value": "f232b72d7165ea776ca9a624b40d9b25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193802, "uuid": "c84f9d83-02eb-4832-a7ea-f77808353e0d", "comment": "Malware payload (AgentTesla)", "value": "064cc8f4cf0bd367530bfc8a6d541e40a3120845252fe8c82a53f45d6a40e270", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193802, "uuid": "18b1c659-6acc-47bb-8b62-78fe332051c1", "comment": "Malware payload (AgentTesla)", "value": "228420050da3b993bc556b6ddd6bd6475013e397", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193802, "uuid": "c018873d-2c4f-4c70-beee-7d0f7fdb245c", "comment": "Malware payload (AgentTesla)", "value": "a44bcbd41e51bd4b75a2229940b219ca3dcc5943168726050ef38f132ca0ba01347de26f66a2f42f13fcf5de01df8d59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193802, "uuid": "602ebb14-b76a-4007-8fdc-2017a063a338", "value": "T1C7B5BF326281FED2DAFE5871F48213540DB4E8B7A354E395FAD892E72592718BCC5CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193802, "uuid": "7eb2d285-a49c-4a00-a87d-bd1595e488c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193802, "uuid": "6cb111e0-8495-4d6d-9384-33b0bae6ca68", "value": "24576:fYe3CFczkCbvl647mzHOzHKmPaN/KJeOvMJZ34oLN8MCc3wlcMmqRwedQLFWpql0:fYe3lbayziNxZoYN87lNS/9qdEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193802, "uuid": "148f3d46-6396-47d6-9b0d-9509e32203a1", "value": 2321408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193802, "uuid": "43892309-8fda-49f2-adc4-6b9188eeaef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193802, "uuid": "83050f33-3c30-4085-ae08-f871db277415", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1080524-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681196143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196143, "uuid": "dc100e31-9eb8-4396-bdf3-1d90fe56c2dc", "comment": "Malware payload (AgentTesla)", "value": "195ff766a198591eaefd9507794d1acc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196143, "uuid": "dd26474b-9ce5-4783-a642-2eafcc446fc8", "comment": "Malware payload (AgentTesla)", "value": "06cb801cdd6a42783ad3d7de6bd9928b53d714015611c28edc9fb7eb955f53c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196143, "uuid": "a1d8bf5d-e22e-4a20-a671-7604b00ae4b1", "comment": "Malware payload (AgentTesla)", "value": "bd9b1076defa689e0f159412cb9687b7db57a0fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196143, "uuid": "41c29734-4c48-4096-b826-8d8720a39dc2", "comment": "Malware payload (AgentTesla)", "value": "1d99a38fb2431043c56fff3e42803f71b718c2a5d2d4e10529d648355083274c8faa303b96f0406a246dabe154b0068e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196143, "uuid": "bd2882b6-f516-4ce0-ab08-4fef86a5fce1", "value": "T1D225AEC46AC54BD0C037F175B04BCAB3C7D2092AE089DAF13897668694D2E525DF68EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196143, "uuid": "1337e5a4-598f-4a04-97d9-ab14f4cb49e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196143, "uuid": "f3f8fbca-e217-4fb3-8215-c5bc8380b980", "value": "24576:G1QhklU0YNOCaOogX0TZNrb7/PuPczT9Q:Ge0YNOCaOz0TZZbzGPkT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196143, "uuid": "7751b99f-efcc-40b9-82a2-818cbbb7ec66", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196143, "uuid": "994289a7-ecd7-407f-942f-c08ea6fd39f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196143, "uuid": "b2030a2e-c8b8-4001-b9d1-24a7bd1372b8", "value": "RFQ 6000000757 - 14000461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56cf91e-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1681208955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208955, "uuid": "02adc7ce-638c-4ef8-a596-f8242348301f", "comment": "Malware payload (ModiLoader)", "value": "5f213b0f6b45f2ee8ed190b8eb4d88ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208955, "uuid": "d8f825d5-aa6d-4014-8689-171fb9076350", "comment": "Malware payload (ModiLoader)", "value": "08c3c3fe2bc77b8791026cd7143f21526272611da1167e7761325f9a48fda783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208955, "uuid": "6eb7696e-afab-4f06-8344-a74b05a74c56", "comment": "Malware payload (ModiLoader)", "value": "b3d9b73a75743e3a62ade19db9c9fc2981e348cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208955, "uuid": "e046e673-4de9-4662-91cf-e303244cbd40", "comment": "Malware payload (ModiLoader)", "value": "9505090b45f0c02db66c41ca03a5f049652584a9cae0a23b111cef813c657811242d7a1dd7d9af071afb5bfdc274a98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208955, "uuid": "91351185-1179-4f1a-98db-3b646fb0efe5", "value": "T1B2057C21E1518437E5A24A7C9C4BD3B9992D7E116E28F44B36E46F4F3EF8260292D3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208955, "uuid": "1515f611-37d2-446b-ad9d-7dea9f4b4ef2", "value": "3d3dfee0b73b800a9bca6b50b5fb8258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208955, "uuid": "8a62aee8-7952-4358-99bd-afdf30ef79f3", "value": "12288:m8rLgxLKQfJJuXFI3MU+oVv6G57D1l0JttQCMO+U1xldIuau/T2SAzCk1Ph:RrLgO0023ZQK9qEO+U1xldqu/T2SAbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208955, "uuid": "31b05075-ba6a-4367-a475-f7f3e3b6da20", "value": 867552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208955, "uuid": "4d69daa9-b5a7-4c74-ae5d-36797446d4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208955, "uuid": "fdcc4b85-6690-49f2-aa61-a0f30a4c7184", "value": "SecuriteInfo.com.Variant.Bulz.89663.251.20581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf75087-d8a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242546, "uuid": "0ac8df9a-80b4-44c3-b22d-1e5534d1caa6", "comment": "Malware payload", "value": "e59ec6b4041ae2a9ffa01a1b924a1b4e", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242546, "uuid": "f54b7d07-d7ed-42da-bc4a-36ad0820d4ae", "comment": "Malware payload", "value": "0951fb7092432df1dd36bfea6ef12ea006a3b0152c989b534a0f3f898d1a111b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242546, "uuid": "8d127327-f7af-47e8-b76f-443f1dcc973a", "comment": "Malware payload", "value": "c5f25c100f6b4a83713a0e46c1bbf087fa372334", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242546, "uuid": "bbda79fc-711a-42ab-aab1-64b46b31078a", "comment": "Malware payload", "value": "bdfb73f8ce8faee59c922012055b55c9b278d0c163e22017c8a9d97e67a37123c12ea7a7bccd5f0e512837acef353de4", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242546, "uuid": "b8b79e51-3c15-4940-90ed-24a758405bf1", "value": "T1E053F1F3C5961E08E8C25FA772507969427D702BC5D0E2C332320B577E4455A3BB2AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242546, "uuid": "d5d2354c-2dcd-4d15-a10c-e8489feddce9", "value": "1536:ZSIiXBU2mGP4jVFwu9RGwZndp7HCs7m7OXFWqaXtM4:ZSlyG4jwuesFpSM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242546, "uuid": "060d81ab-f267-40ba-9353-604153761de0", "value": 65789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242546, "uuid": "3444c9b3-d033-4679-a7ff-755db6e8d85c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242546, "uuid": "bd8fbc39-ed28-4397-a28c-728943145bc0", "value": "ZQ_January.23(2).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11cdae5-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681196117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196117, "uuid": "9be083cb-f79f-4ded-9035-e4d2acbee7ae", "comment": "Malware payload (RemcosRAT)", "value": "3f9f9ca39bd4dd337deba6a092090c2d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196117, "uuid": "4d26fa5b-0802-4733-8fe5-e77cd65b5cc8", "comment": "Malware payload (RemcosRAT)", "value": "095898097309becff7d599484026e788fb50d06635212b3bc70332be804acd13", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196117, "uuid": "9f9266fa-507b-4d8c-a708-e693af374bfa", "comment": "Malware payload (RemcosRAT)", "value": "56fd4871c79a231339bd4a0d414f37e0e55693e9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196117, "uuid": "d713c004-6333-4500-bd53-5cbe6f45b1ac", "comment": "Malware payload (RemcosRAT)", "value": "6d767f397046d7a65045b607f6c20b0ed5dc9e8cba667bdac4f5d4e6fc0c2402620e1c66ea27ce340ec0f86ac8751e1e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196117, "uuid": "1b181700-155c-499b-ba8f-634c6e6a55e2", "value": "T18315339D3D92A7B3B0B5171B89BF955F0AB3F9227152612BDE10836A313C7DC178EA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196117, "uuid": "7a085d79-83bd-4ba0-9119-d868a3fee178", "value": "24576:n5lo6iLrXiJP1s+83VeSMJ54OyULPcGhVgx8:566iLkP1EyJqOlLPcyw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196117, "uuid": "b99554d3-2273-44c6-8e7e-569238321b20", "value": 903010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196117, "uuid": "e61f5bc4-ee4d-4571-ad82-2dda12ae9dd3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196117, "uuid": "2ffadf30-67b3-4106-9f95-a32a75ae091c", "value": "DHL Shipping Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188aeb13-d82d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681192371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192371, "uuid": "966c8e42-2fe6-43ad-bd8e-7f7d033e3cae", "comment": "Malware payload (AgentTesla)", "value": "6d6964908889675f4deda0ef8c7beaf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192371, "uuid": "c0c108d8-8945-478a-8478-1bee4676178f", "comment": "Malware payload (AgentTesla)", "value": "09e44a696a8b0cc51b15e77ddf2becb86e577ca94a1a37b2b25ee1929405b359", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192371, "uuid": "016ae5c7-b07f-46e9-aeb5-636abc79d5f3", "comment": "Malware payload (AgentTesla)", "value": "d3e2c3e5143292a3e4a990494b1fed36cf7158e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192371, "uuid": "658cb484-1ea7-4625-a008-a38c9b604d49", "comment": "Malware payload (AgentTesla)", "value": "923c788e33ff67301aa5090ac35f75667cd2cf41a6da36ac86850dcf261f03084a7363555575bc45f65f519f6ff28f81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192371, "uuid": "b1fafc3e-089c-481f-af6c-5dac7753da8b", "value": "T140E433AC20C909A5DB5A627ABAF7BC7FDF3145421D80BF28209C473C9922B971CD5D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192371, "uuid": "d86a678e-b6c1-4ceb-95ce-c41e3743d8ed", "value": "12288:nZx2GLEfRoqdjQPIRFk91LRujABOprfIg5SzT5tq0ddCK7+8XGmu:nGAEfaqdqILkXGYkrwF1VdTyIzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681192371, "uuid": "42c7e408-278a-45f1-8831-0dbeb4b091bf", "value": 702231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681192371, "uuid": "82b47ca1-87fa-4306-a1ce-b0ec22979691", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192371, "uuid": "f645c68f-0a29-49e4-b9d8-723b649d8d7d", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db7ada6-d866-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681216915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216915, "uuid": "4a254c6a-d7d4-46d2-9023-935e060cdc9b", "comment": "Malware payload", "value": "97b5b7d6d1292218e49f30af21f577d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216915, "uuid": "57b33c24-d4c0-4534-9d73-171fead5e2e1", "comment": "Malware payload", "value": "0aed12e27ed3c9580bee1a3b1ee53a417923e6a875f05361c22b3d3b26be28a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216915, "uuid": "31982311-6fde-4336-a640-3d4b0c58e6dd", "comment": "Malware payload", "value": "d8b0a02dab1f3621d77b74f4b710a75c74e37f82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216915, "uuid": "f5bbbea6-36a6-4d45-b95f-d8d3ccd91a12", "comment": "Malware payload", "value": "c4080512660340058d70754a1e342b4689ce4ca268660cec6b76829d9bf69e5dc80469255c0f6f04e1d3affa2d30ef87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216915, "uuid": "f99dff11-3d5e-4392-b2a3-79701623fef1", "value": "T15AE5672968F5622AD1FAF1B3BFC6F15BC203726ED2022F2AD5E517064631D21674293F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216915, "uuid": "fb56a453-1fa4-4099-85f1-a543982840d4", "value": "4e3bb059a4bb7b776ab3c1ca8c44d314", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216915, "uuid": "55b54d1a-9b12-4785-90f3-c4661a72baa1", "value": "12288:mx/6hPt5lSaC+zGpNRga1mzFMTEXCPJVFHL3QWcjK0ljvHNoD5i:Plt+PJV5L3WK0lvH6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681216915, "uuid": "a763be17-f3f1-4bd8-8fea-70b620393114", "value": 3039232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681216915, "uuid": "4381de5a-1d35-4afe-a2a0-86cb9281797e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216915, "uuid": "135e5035-8413-44dc-bc0a-9fa56667c9fe", "value": "SecuriteInfo.com.Trojan.GenericKD.46246321.19915.23840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5a21fb-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681204487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204487, "uuid": "08032864-9bb5-40aa-b200-f273e455d0a2", "comment": "Malware payload (Smoke Loader)", "value": "a7a3a727dba1af561003bee0ee2da0a5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204487, "uuid": "767622a9-4331-42b0-bfc9-e2f59581d64d", "comment": "Malware payload (Smoke Loader)", "value": "0b1c91f32e297df575ba5b4843d92ea25ba34d9aedd64f79e875b9b579f3c43d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204487, "uuid": "d59c1bf4-5cd7-4270-9292-79aa2d358672", "comment": "Malware payload (Smoke Loader)", "value": "55dbe7574e1bc3206688d1346034e8b2c90b7f83", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204487, "uuid": "8854b160-823b-4eba-b5ff-7b1ecb2fb2e6", "comment": "Malware payload (Smoke Loader)", "value": "d5eddd29088a0ce4cd6f71e524fdb3c411391567d38fd38f0559d8947fcefbb9b65bfd30ef14ab9b585e1487e452cd8c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204487, "uuid": "f3937a18-082f-47fb-a001-8e564758836b", "value": "T10714DF317AE0E0B3D46F0974C861DBA0AE7BB96193A4859B332816AF1D317C14F6E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204487, "uuid": "40413b52-bff4-4a46-aeb6-39bed09c2e51", "value": "a1cd3e7956f73508d7120d1c096b4596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204487, "uuid": "7322de14-c25f-4fe5-884b-0910f1656e44", "value": "3072:/Q28HqyUeMalThPjU+XhsWT2Q/v2eTtikA4krn9OvKaA:428KETdXSQGeZiIOUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204487, "uuid": "93956278-4a47-44a0-a6bc-ac75c9f25036", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204487, "uuid": "fb875126-afc7-41d7-8d67-02be163fbdc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204487, "uuid": "c88999b0-6106-4431-b0e7-bc4f4eb5a9ce", "value": "a7a3a727dba1af561003bee0ee2da0a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f547bb-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239095, "uuid": "41bb8124-1f3a-4960-9895-05568c365a02", "comment": "Malware payload", "value": "c17a5cb9ede163355220cd5669b62590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239095, "uuid": "3e71444f-18b4-4c59-865f-4f79145c9183", "comment": "Malware payload", "value": "0ba799607c3249b17cb474a73a255b0f38dc09e05526258c9144e23209b1a01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239095, "uuid": "46f52234-d390-454a-91cd-0143f43fd919", "comment": "Malware payload", "value": "9aedb531b74aa0d72f5306832e8892a2cfa5ed6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239095, "uuid": "162fd872-a0c7-45c7-a9f2-91b0a55a7738", "comment": "Malware payload", "value": "7fd9ccb8a67cdf99e5390ca79214364e2d0ddd44c4b5ce5981893c0e79b9e9de5d9834f5f9134e190bc41e1b29a9d8e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239095, "uuid": "5b6eccb0-757e-475c-a4d9-9a7ca66dc71a", "value": "T1CF05125C6375ABA5E48C0FF894442842277CA219F0B4DDAC9CE613EB8AB2F11561D3F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239095, "uuid": "b30d5bfa-ecbb-4d67-8c0d-8376139e937c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239095, "uuid": "2d687b0c-665d-4654-ade1-60e2a6a8f487", "value": "12288:bMmzuGAXI9QnL6qOkiLuVAiF7QL6otBn8idumgmvTjXNHcY307QW:b1CGAYAeClVAuQL6UddDv3NHcY307", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239095, "uuid": "8d2c5498-23dd-4675-8fb8-9a268131f0b6", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239095, "uuid": "cf713d7c-f6ce-4883-a5a6-d741144b27d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239095, "uuid": "dadb4241-8215-4412-bc3e-d736b380717e", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131 (8).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f37540-d88e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681234219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234219, "uuid": "01d10e24-0acb-4086-a1ac-e352db4eff31", "comment": "Malware payload (Amadey)", "value": "386f102e3b163bd8ff2cc41537b2d370", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234219, "uuid": "fb6ae80a-65bb-4224-851c-c4ffef3635fb", "comment": "Malware payload (Amadey)", "value": "0c62bf8ac0fc7677ceea6fbca6f5db5d906af63b9ca0a47e9c2734bfa6123eaa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234219, "uuid": "c42f3b83-468b-48f2-a56f-86bcbb11455a", "comment": "Malware payload (Amadey)", "value": "94dd8cc73ce661461fad3d4d214bd0ecb3fdbace", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234219, "uuid": "4d376b3a-4599-4590-a3cb-b08ee634673a", "comment": "Malware payload (Amadey)", "value": "5b3aec6c58c813dfbfa2c22925bc308351782dc809cc357e11d1eb41d97f28ac7049dbb74615c954b1c4e869d8888633", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234219, "uuid": "523ec991-80b4-447c-af62-27dfaed8ba56", "value": "T1B7052326F7DD8231F8715B7044FA46831F31BD90AA38526B675AE98A1C329C4BD3335B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234219, "uuid": "caa2decc-e22b-4a92-91a1-7218f14f1309", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234219, "uuid": "b9a0142d-c2b9-43f1-bc20-edc9efdb93c0", "value": "24576:3yZVCdq3Vvy9xGqM/VPbNL+m7RYGVv5jMwVvU:CZVJ3VvMoPbN77R9V5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681234219, "uuid": "fa1ede72-e666-4afd-841f-d927fdaf67a1", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681234219, "uuid": "4b60a836-324d-430f-924f-b7e17ebc3877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234219, "uuid": "e40d78cf-c193-4760-b56a-4ee5c228640e", "value": "386f102e3b163bd8ff2cc41537b2d370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2ec905-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195999, "uuid": "46e7a2be-9920-4323-8e12-2c57d2f6566e", "comment": "Malware payload (AgentTesla)", "value": "72ab0c8560ce16d26212f45720ec6909", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195999, "uuid": "d262ec1c-9d33-4791-9213-8097b266837a", "comment": "Malware payload (AgentTesla)", "value": "0ccb267c879fa0c029ca7c92c9add31462337de55fc5b970746ec581a0a346c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195999, "uuid": "832927d9-6c82-4bb9-b5d6-de2c91caf257", "comment": "Malware payload (AgentTesla)", "value": "786baff2c5aa9320d11d13f3fb02fa28f7e4ff82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195999, "uuid": "e5f6caf8-b4d1-4473-8f1e-2f0ce7a970a3", "comment": "Malware payload (AgentTesla)", "value": "1dde500731d798fa05e01acabb84abb0a54e433381452aec1ee57003b38754ca68d5988427c7686ef4325446dbfb8e31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195999, "uuid": "f9f96bf0-134a-45a2-b484-d5dffbc12ad5", "value": "T187D4C0873940C59CCE6951F37317855473A9DCFFC908A60A6BC83357AEE6B920C26B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195999, "uuid": "b9f395ed-17b3-4a89-a054-cbc90d7c1517", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195999, "uuid": "d9309ce8-b745-4377-8790-70adba30229c", "value": "12288:+YW6nvmjqKoebvTMECFfrLtgaydxStnWtTkrmuIW7Yb+zw3G:+YW6nujqKoebvQEKRgaixKWCig7Yb+WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195999, "uuid": "ac8dadfe-a6b3-47e5-8a13-9cdb75dd66ca", "value": 646633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195999, "uuid": "5841d8a8-ff9a-421e-b116-f6f8213b7971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195999, "uuid": "79f2106c-6097-4ec3-b0a9-e5108ef0acce", "value": "AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986a8963-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215349, "uuid": "3c9903c5-ab8c-46cc-82a5-d2d32fd74eb0", "comment": "Malware payload", "value": "077c0f9c3be4a6d9b0866863efb755d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215349, "uuid": "ffcffadf-ce1d-43aa-a9d4-39c99b699595", "comment": "Malware payload", "value": "0cd9440b7b750e764c060d64498c1f8fa0c1eed584c0511a0e981e7330eea464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215349, "uuid": "01864c5e-1d30-4d9b-940f-b80d4dd7ace3", "comment": "Malware payload", "value": "0ed333ffa4ef6e5a3778c313d3f7eaf452d052c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215349, "uuid": "6a8d3291-36ae-47ac-85dd-7f3f932b97a3", "comment": "Malware payload", "value": "07d0411f331e5aef15537fceb91dc3b0922a9873397b9744653844e0fd4fcc3b65e6d5c8c4c488e241ba7d5d22433391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215349, "uuid": "519b78fc-803f-43ac-bf94-048823846354", "value": "T1F8B5A8A9DB32358D40DB2033D16BBC9C85550D74876FF27CAFA9CA622E7842C2C93795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215349, "uuid": "cc8a7765-3900-455f-b064-dade4fb837da", "value": "5de806bdfc34b28431f99380f9f300fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215349, "uuid": "d051cf0e-ce9e-4c3a-834c-054d4fef9f16", "value": "24576:jILvSlU8Gv0Wd85asnHRC0M6Ho5F414f8aycO8zrwPOE6kHJDZMxIwZqeFPJcSXz:svXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215349, "uuid": "9d86d748-ef29-48a7-8e24-2de6c82a01e2", "value": 2277888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215349, "uuid": "8e929b69-001c-490e-b38c-00bc438fa066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215349, "uuid": "1280b2fc-a387-46bd-9355-376ba672bbd4", "value": "077c0f9c3be4a6d9b0866863efb755d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27762bbd-d89b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1681239641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239641, "uuid": "d392502e-fe05-4d02-a9fa-bfe358b3a81f", "comment": "Malware payload (Fabookie)", "value": "48f3ac07d6ced59167c3b5ad97866e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239641, "uuid": "b6fc5e72-4f8b-4f54-b544-d039a87f74c3", "comment": "Malware payload (Fabookie)", "value": "0d68e80b05103406428c1d530d720966eef4a40f458c2ca315a0d449d7dd67a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239641, "uuid": "327d0835-dfbf-4ccb-9894-58d8309cba1b", "comment": "Malware payload (Fabookie)", "value": "d6212180617bb8f3548048984a4c3a754ff8fafa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239641, "uuid": "91754140-d286-4794-ac53-77417608b188", "comment": "Malware payload (Fabookie)", "value": "39facc9484fa4d3086c18725bc6bf89504f4a8bfa5d4f0e7e40cc4c796711edd679eb2219d933e0e074a77e9ac07a619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239641, "uuid": "53021883-f20c-42fa-8387-3b84c76728e9", "value": "T1E4D4DF81B39196D9C4B8C430C593CA71CA317C24DB28569BB6D4BB7F2F32AB1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239641, "uuid": "69b4de0a-3715-4934-8248-fcaaf9f09df6", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239641, "uuid": "7e48e936-53c1-4058-b251-7e040261711b", "value": "12288:G72z73/jvAx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qu3/rSWr3/kRc4l6g6gtPbcHn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239641, "uuid": "94ab1688-daaf-4493-aa76-e3285f8989f4", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239641, "uuid": "7bb105a7-9457-4441-878d-97e665d91896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239641, "uuid": "ec647af4-b9d8-477f-b4e3-038bd9a50cb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8344c94c-d84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1681205005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205005, "uuid": "0aa67714-f998-46b6-99ee-4955c34c7ceb", "comment": "Malware payload (zgRAT)", "value": "c593dd9021e715cea52c980f1567d839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205005, "uuid": "d444b2f9-2c35-4878-8640-13f3b8029c17", "comment": "Malware payload (zgRAT)", "value": "0e08484180b5277cc740bbf6718b5f19dcfcf8346b8056a00e170a71481abd01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205005, "uuid": "42a3af40-0662-4cf7-9489-bd8c12483cbd", "comment": "Malware payload (zgRAT)", "value": "c3e64eb927870a6b7a3e0d419749e2e8e8604480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205005, "uuid": "ae0f7652-1551-4032-bc12-474e44118b3f", "comment": "Malware payload (zgRAT)", "value": "892e5e6c6ce44b6b02ded1db73f437b89fd5db8de560a392748213f20fb2592e0c8a5f17c367c8da36c6123d0b5169cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205005, "uuid": "a504a970-8b0f-446c-a696-b79123ad320b", "value": "T1BFE5E1335AC2FE96C77E9DF9D85712100DF8CCE7931CE691BDC861A524AA3186E858F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205005, "uuid": "ce6cc62f-a755-4917-bf32-bc87ac0466c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205005, "uuid": "104744fb-1ea4-4916-883c-6d30c5faaa8f", "value": "49152:aIefhdi8aMEitIoG0KB9JqNU65eHTbSOqdM:aIef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205005, "uuid": "c66041b3-0933-435c-9754-3675aee3fb9f", "value": 3227136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205005, "uuid": "8d5ccbd5-b84c-48f0-9e6b-69c9983c5338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205005, "uuid": "288cc5da-7c28-4e99-b11e-bbfa0357a96a", "value": "c593dd9021e715cea52c980f1567d839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee992193-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681209051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209051, "uuid": "5a13a43c-408a-4ccb-95d9-6e329b88be38", "comment": "Malware payload (AgentTesla)", "value": "123130b87eb0531888eccf54c10a19b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209051, "uuid": "560f0cf1-67fc-4106-b079-ccd0483b43fa", "comment": "Malware payload (AgentTesla)", "value": "0e6d8051e0ac94e45efced1daccb8dd432d1d171220928794b66acf6fc913cf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209051, "uuid": "9bd79708-9ffb-45ac-9715-0924155aed2c", "comment": "Malware payload (AgentTesla)", "value": "bca58656bd87f91ea5cbee4caa7d8c6bcf107579", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209051, "uuid": "6b4eb84e-5e42-47aa-b1b7-32f497a3a160", "comment": "Malware payload (AgentTesla)", "value": "5de1f9edea1c75a11ffccb484a377fa748711458c9ebef4c43f76e8628b9404ceb4b38cf9206463e572ca687e7d3b454", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209051, "uuid": "c6a2f6d3-2dd8-48e8-907f-42873f66a270", "value": "T1306423587688D573F9D383322E390B6F9AE2C83124A3D56B17140F5DBA633C2D99E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209051, "uuid": "46992486-d04f-4f9c-97df-5ca52661070b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209051, "uuid": "f13c6a70-57e4-4eff-b551-123d3c2e63b6", "value": "6144:/Ya6hqktAzR8cQsHja2OCsuLGLk0TaJ5s3Aoj3IB+XyNHfnyjh7GPCn4vro:/Y7qktCR8cpHjaLCGLJTa/svj4IXMfyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209051, "uuid": "53bad722-0e9c-4ad8-922c-e8422e603181", "value": 331340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209051, "uuid": "d56bbcad-7963-4862-88e8-a5641209d7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209051, "uuid": "658618db-6020-412c-8a78-2280be2b1065", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86952bea-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681204152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204152, "uuid": "020aabef-7f7f-41f4-9126-0129a6b795dd", "comment": "Malware payload (GCleaner)", "value": "c1da6f537f45f1ddcd4f0677b3f8cb7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204152, "uuid": "ec389e67-96c6-4e28-82f0-ff9e15732bd6", "comment": "Malware payload (GCleaner)", "value": "0ec584f0565c38a70c9c560a7730cc54f4be565f725e837effe747d80cdc51e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204152, "uuid": "8c3865ea-8430-447c-8043-2ed783b684ea", "comment": "Malware payload (GCleaner)", "value": "d1c99a5a9543380177cd568cb8cabd3355fff089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204152, "uuid": "3f5322c7-f230-49df-84bf-0448e805046c", "comment": "Malware payload (GCleaner)", "value": "ae8a73719824b96d696f6f8af41ce95a8809010272ccf317bb7098f35965f7c475fbc6b0183dd76fd8be9fab43584b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204152, "uuid": "8b349f6b-f9b2-424e-b9cf-fd3e21180b31", "value": "T11644F1707DE08831C966B63444B2CB6516FFB957167185C777B8239AAF213D12E3438B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204152, "uuid": "568e0352-25c5-4f09-9a64-95ef9b32cd01", "value": "82ab9ed8901e93f77bae02483c5ed839", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204152, "uuid": "b0f95879-6ae9-4389-a211-fa2a60e2c632", "value": "3072:40X288hDqoJ1z81tc2wmaS7Rd+ah11TtzLuHHzqnKtAg6Ajwbvz4HKtlqTEG6rHi:V28forZ2wzSHdWTqK09MX62Zt5W9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204152, "uuid": "44ee811d-2170-4cd6-9216-ce8d8dd3d54b", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204152, "uuid": "2f730289-ad7d-4fe3-acfd-b1fd37e0aa88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204152, "uuid": "706c2feb-963d-4487-a130-651042d4aec0", "value": "c1da6f537f45f1ddcd4f0677b3f8cb7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a29500-d85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1681212824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212824, "uuid": "cbf9062a-6a56-48b9-a260-4fc9a12cf9f7", "comment": "Malware payload (QuasarRAT)", "value": "46fabd3f430861f683716bc8857de68d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212824, "uuid": "96266742-2bf8-4644-9ffe-86ef4ab01961", "comment": "Malware payload (QuasarRAT)", "value": "115e61f3a2dc4990c828bc0e83750d5c90f9826004b597864613b70bec9dbc74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212824, "uuid": "56ca3063-cd53-4c0f-8e54-4f9622e3bb89", "comment": "Malware payload (QuasarRAT)", "value": "ab6cdedcc77c5b2a84cc9d02d35903316d39b55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212824, "uuid": "15761bcd-190d-4b19-af26-d4db711cbb5f", "comment": "Malware payload (QuasarRAT)", "value": "713b762f3b8977bc31ce711f0ca8c05ec8114811ba4c8e447558d06c37923651bbe01b67c6ce38ab2d0429bc16ca1528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212824, "uuid": "45da47cc-64ff-450b-9710-6d1c2371cfa8", "value": "T175152325BAE58137E9D127B886F8201316F5FCA00F7947CFB306166E5A60BC05E76397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212824, "uuid": "075f82e6-7344-4fbf-9ab2-655c704fd5cd", "value": "2339ac77bf9371500ebbf86df3a10d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212824, "uuid": "ec6d7b5b-4c26-4b99-80be-773b468ea1c3", "value": "24576:+QU4J4Vz9b9979Z+KCz+wQ2+WgnJr3sy/GytKAHu:BCVz5v7T+/6Jr3xOBAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681212824, "uuid": "86474da8-1f4b-4b29-a7f0-33244f8211b9", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681212824, "uuid": "685cdc52-2e43-419c-b694-c3dea0b9b27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212824, "uuid": "c3d81613-23a9-49f0-91af-b65f03fd1131", "value": "SecuriteInfo.com.Trojan.GenericKD.66342135.3446.10413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c509bb6e-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681196096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196096, "uuid": "829b4509-00f8-4a90-8bf7-61d9d7da7ad4", "comment": "Malware payload", "value": "0fb81935c032b41ce2a8f29e51941b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196096, "uuid": "9120b784-1536-477e-8200-6f0131fa8277", "comment": "Malware payload", "value": "118f8cfcf4d2b42df08ad902bd44ab60380dad14b1847a15db61b487c286d57b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196096, "uuid": "922f75eb-a01f-4ab4-a6b1-7ce84545aad7", "comment": "Malware payload", "value": "d1448770168aa6c41366cec1899e7737b889128d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196096, "uuid": "731e312e-5aa8-4578-b29c-42336b52530f", "comment": "Malware payload", "value": "60cfaade430790d47a14bac96cca623e02007a6302190c0a7bec07d7d94273ff58398c1c363735f0f7b5f04a5956a86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196096, "uuid": "94151826-bc60-400b-9657-be16def43b2c", "value": "T1E3862A07FBD5DA62C6AE0333E6E5021947B2F8516213D72D319D336A3F137A24D42AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196096, "uuid": "5fb28dd6-34e2-41ce-8810-a88fa5a77e66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196096, "uuid": "602bab4d-1fb7-4a5e-a1d4-386c6db01d8e", "value": "49152:iFQ5CnAqBoR7Aqb1SYd+jco6VnP2K/HNvvyH8Ezggt38goKvKAd6TsQDYG3sDRyU:iRBoR7UYW2VR9GggtjE2TLtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196096, "uuid": "77d5d38c-c7aa-4126-8edc-255d40374479", "value": 8139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196096, "uuid": "72f7ac4c-0c4d-442f-922a-7c7a64211a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196096, "uuid": "2d38c804-fe3c-452d-bc61-065a40a2b6ab", "value": "Lenmark_Original PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eb4eb4-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1681214078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214078, "uuid": "e5c49ace-e33e-4b98-b69d-2cac2e4bf562", "comment": "Malware payload (ModiLoader)", "value": "dd135d51b98178b15d4111001131f91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214078, "uuid": "61d9f97b-f050-4d9f-b8bf-07cd2b59ef38", "comment": "Malware payload (ModiLoader)", "value": "135950b42dd73dbe351f5c677d8485c1bf4f0a0dafae8565301a069fad1db1da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214078, "uuid": "de17a556-4ab2-411f-8196-05216b76dda0", "comment": "Malware payload (ModiLoader)", "value": "62757575a10f8a906bac8a2b7b68e855b6d2231a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214078, "uuid": "c57b349e-892c-41ab-9829-9508c5d98d42", "comment": "Malware payload (ModiLoader)", "value": "f5db0c2d346c88b3231d53b196f667c17acd6b44ce68c24635ba39c827ca34de60cc6ea432817a939b825b563b9528ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214078, "uuid": "a49701d6-5497-4508-ae7d-253f2b5ec086", "value": "T1B4256C35E7A1C4B1E566413C9C0E46A8552CFE003D34F68B36E2AE5A0FFC694E47A7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214078, "uuid": "d9c9a3d9-5968-462c-9912-b667b974ade1", "value": "462a1dd4585433a12f56b4e56d85cb7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214078, "uuid": "66b7a1fc-aa0f-49db-af1e-6e156611fb32", "value": "24576:WppGPEbmkx2lp2w4FvR93i2O+U1xldqu/T2SA:WppGscYFP9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214078, "uuid": "366f42e1-1465-4c4e-b08f-11e845f6b67f", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214078, "uuid": "4d7b6c5f-7b93-4b6e-9965-58bab05ba0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214078, "uuid": "d46b646c-c757-493b-9f3e-66c00fb9b3be", "value": "dd135d51b98178b15d4111001131f91a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf82b772-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195658, "uuid": "9f68a7cf-0951-45c2-901c-9bc98d07e212", "comment": "Malware payload (AgentTesla)", "value": "5ad0f1d2103f942cbb51712b697d1ac0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195658, "uuid": "61314cdf-b722-408b-b50e-71f77ae93c87", "comment": "Malware payload (AgentTesla)", "value": "135ab4738a08869cd394b9d59fd122acd7ceabdf74e59cb6de053280b1d2d7f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195658, "uuid": "df6a5aac-59b2-45f1-aed7-3a588be766f8", "comment": "Malware payload (AgentTesla)", "value": "ad19701a0403616fd315a5e42cfec9058bb3dae0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195658, "uuid": "0ec118b9-7d08-47bc-80ab-b9f3cd37b838", "comment": "Malware payload (AgentTesla)", "value": "b0307917283ad4da4882351872e6d5895cbf49eacee94fa9f1f47c5a78b52f760318107aabf583e3c4ef508e0a67c0d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195658, "uuid": "dc03bc30-5e8a-4546-9a48-001e21fca12b", "value": "T159F4E006B964CA61E59936F1759128F80F306D5E800FD7A98D7278963A3F383DE0F19E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195658, "uuid": "14554965-95c7-4314-8fcc-940975ff4f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195658, "uuid": "05f4e4e9-4828-44c7-ba8c-af4969768e6e", "value": "12288:xIS/9ppCZKdb7ETIiVw/+hTrlHKcn6qM9rLXCFH4R07MGEfRORMIF0Th:td7qVvPJKcqh1R07XuORME0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195658, "uuid": "06c4c30b-d8c1-4ccf-9cd1-c0f837ec4bdf", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195658, "uuid": "98026f3c-fa8f-447b-83e7-663f4788a10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195658, "uuid": "fa00354b-2fb1-4430-8f92-a95f4781cbe4", "value": "DG568qdxI1DjhwE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad65bbe7-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681221827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221827, "uuid": "a55927da-a5d0-451c-b8bc-4854b32c7d9e", "comment": "Malware payload (Smoke Loader)", "value": "975405c6dcddff9440c2aa114db7b993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221827, "uuid": "23c162ce-af29-441c-a540-83057424de58", "comment": "Malware payload (Smoke Loader)", "value": "1375ff802b25e8b03072612d882c333bbb664157a2bef8e2cf2380960b3c6adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221827, "uuid": "85ae8bd3-7b90-4f0f-ad11-4655e875fbee", "comment": "Malware payload (Smoke Loader)", "value": "9bf8b620a26af4320add712487e6ed8477603241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221827, "uuid": "a09ddcc0-4a25-4b25-9562-73254ba2a8d1", "comment": "Malware payload (Smoke Loader)", "value": "2139daae9c8eb5124ec00761524e05ea5d19a40a7a0ff9de49fd81e04d9db6ab1b88113d2935d08142e00d72baba7891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221827, "uuid": "12cc899e-70a8-49d4-906a-d204c8335b60", "value": "T11924D0227AD1C076D49B00740520EEA47A3EB971E7A5CA8B739407BF0F347D196BA35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221827, "uuid": "e398e4d8-d43a-4ff4-ab8f-8834d6e0f054", "value": "ab082a716c28869a457cab71ba8dd878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221827, "uuid": "77fccf81-b0eb-449e-8448-2ce1172b35ec", "value": "3072:nx7BLgRqkgmuEGv1DN1yYO21qc2ml5AmWDbk+bznHvX5Sy1W:xogmmdDN1yYlH2mj/IIEbv0yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221827, "uuid": "58c5e048-fdb0-459c-be3b-8cb6b26049fb", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221827, "uuid": "8f78c338-f03a-4270-8ee7-4c731a6262d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221827, "uuid": "3ac19156-f7e9-48c5-acde-fa16b6ee00de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d676b05-d89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681239409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239409, "uuid": "8996b5d9-d539-4495-abdf-e0ea7172b92d", "comment": "Malware payload (Amadey)", "value": "ee69aeae2f96208fc3b11dfb70e07161", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239409, "uuid": "07db092e-350c-47ae-80c1-8a78776214b6", "comment": "Malware payload (Amadey)", "value": "13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239409, "uuid": "8ed2d686-d71c-4e8e-bedd-3e829024b1c7", "comment": "Malware payload (Amadey)", "value": "5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239409, "uuid": "6af51212-be0e-41b0-96d5-59e2b0555fdb", "comment": "Malware payload (Amadey)", "value": "528898925b273ac9647e12ae364f9938ed769036326f52c676faf0f220be993e68b05e2959e0d8176e9c19702846e50d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239409, "uuid": "b53f432e-7200-45e4-958e-1c87db1b0ee3", "value": "T15C936B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE36D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239409, "uuid": "1876be57-431d-4fd2-aca6-54e2436fbd7b", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239409, "uuid": "a442f215-aa87-434b-aac8-31249eea1ad6", "value": "1536:bo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUlhaB89p:boUCWbBNpplToUs1uNhj25LJUzaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239409, "uuid": "2634b392-d707-4daa-ae0c-4eba480967a5", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239409, "uuid": "05a07f7d-bdc4-4ea3-8210-08db7667f4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239409, "uuid": "7565f47c-1a7d-41fc-9916-4b4b07011518", "value": "ee69aeae2f96208fc3b11dfb70e07161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bb4a11-d89a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239418, "uuid": "04f5ad8e-d478-4d80-96ba-394df0839298", "comment": "Malware payload", "value": "d22b7fb4f79d50d0b5e21e07e806406e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239418, "uuid": "bc46393a-fc73-401e-b5f5-2fc189f85c90", "comment": "Malware payload", "value": "167aa3e5f12176275274a38d28ee6dbd3b61162f7896f0f5f933a1255b8ddee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239418, "uuid": "b0434e19-8e7a-4924-a4ae-0e174cef7483", "comment": "Malware payload", "value": "06d8828e043b7cb4df21aa11608aceca356e583c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239418, "uuid": "80c9fa95-5c6b-4357-8fe9-897a020d9d87", "comment": "Malware payload", "value": "3fd903b19e92f0ea38be8e62ec6f9c160bc5310644200b7232f6f3219e7544cab816ace0d122337b3248134d98abbbe5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239418, "uuid": "b2995488-454f-46fd-b607-7588aa8fcd70", "value": "T1A8152362B7C88063D9742BB5A9F3039316333DD68839576B23501C9E587238AF571BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239418, "uuid": "4bda56f4-977a-4b7b-89c7-2b823403370b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239418, "uuid": "73aba09a-5caa-4252-b66c-cb17b2816609", "value": "12288:pMr3y90ai0uYrFNPk9zS2aeAG1nGiqKDLOx+c/vBoEx8/DlXWF3gvQV9Z2j/Z49F:2yHfeukACiKPmJSEerlw32/ijPxyaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239418, "uuid": "84508f45-c3e3-4a43-b2f3-7625e03780bf", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239418, "uuid": "64a57973-5a0a-42f7-adac-b61c3ca67621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239418, "uuid": "73de9b76-b963-432a-bfd0-0e0ebe9bbf29", "value": "d22b7fb4f79d50d0b5e21e07e806406e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a2a73c-d8a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681241834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241834, "uuid": "4b3ce55f-fbf9-4527-b4b8-0093e16e1f9a", "comment": "Malware payload", "value": "c399dff9f63d68225b5e26ccf060b6c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241834, "uuid": "3507fafc-9fd7-482f-8286-817349c9da83", "comment": "Malware payload", "value": "16c5838cf7bc790900e29410387a62432144dd69f95e4835e8a1127193d544dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241834, "uuid": "3dbd1236-a11d-42c4-a141-f3a729123780", "comment": "Malware payload", "value": "a21cbc97d0b9e9387d7568dd8a039f8f191ec417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241834, "uuid": "9a6180b5-5780-44fb-944b-562e63ecd106", "comment": "Malware payload", "value": "7f09240f62a054a101967037d5db7db2ddaf638885222b02f42bca28214da9a60bf2411ae9e78484f8a3a05aff13fa7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241834, "uuid": "f7a152ca-5c2c-4dbd-a66a-d7fdcbc04381", "value": "T1C3255C01FFD58036E4731031DBE4D9B359AFB8215BE549FF67848AA90A342C0B5F86DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241834, "uuid": "06e691e4-c2aa-4204-9283-bfb8cebe9912", "value": "e9beb24971b0106aeb670e6b8c7524ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241834, "uuid": "1bd64b6b-d754-43e9-8019-9057fda320d4", "value": "6144:3TWj0sZYHUFpZAOeBkhHvY5o117GjIAFcLBB:3s0s350aQ5oj7GjIxBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681241834, "uuid": "1e4c94c5-0e93-4e30-b2a0-c14a26f211cf", "value": 1052064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681241834, "uuid": "6f88b36e-cade-46a6-a80b-5cf28bb5e29c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241834, "uuid": "1942afd1-1415-4a9b-b0e1-e2cfce62848e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d8951c-d89f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681241517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241517, "uuid": "09ef1d08-c22a-452b-b4c9-3479a65891af", "comment": "Malware payload", "value": "15f793debb481bb6a281a467aceedf22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241517, "uuid": "b3482473-81f4-4048-b79a-1fc86e3de759", "comment": "Malware payload", "value": "18cc39e1a315b16df1d29251ceb837c61803b34e005cc32eb27c45120893583c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241517, "uuid": "031c590c-6bc2-4c5f-b811-ab61bad5696f", "comment": "Malware payload", "value": "d7be3e99126ea35324e548a170beb0a00d69c24d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241517, "uuid": "849358fe-eabb-4e42-84b0-6309ee55688b", "comment": "Malware payload", "value": "f98cf8427c9e6465cc98b038168094d6f0ba4de254221c11f532dfc97e5626602fccb7f48110b5e2187d87709dac5f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241517, "uuid": "2073efc2-70c7-4758-baf7-66a17e334014", "value": "T1A274F1317AB0D073C56F41701915CAB4AA7FB83066B9968B37706BFE1E303D19A7A706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241517, "uuid": "c9789f1d-5dcb-4016-adaa-6db161db9917", "value": "b1fdc126cbffd1158f4f7e2df2177ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241517, "uuid": "0cd9b3fd-c0e8-42de-8a61-3be8cf8f68ce", "value": "6144:H+GA56059ilhff8V+2tmdo2abIVIT8hHK3ns3LSuhj:H+568gnZ22abIVICK3n+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681241517, "uuid": "39469926-6750-46f0-92ef-4ea23485e371", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681241517, "uuid": "836b6339-8ce3-4ccf-9158-b6b9357c05ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241517, "uuid": "fe3737bf-2cd4-4a00-83e3-6dcacdcaae3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874391b7-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215320, "uuid": "7cf13e0c-0f5f-4060-94ab-6026929f7a0d", "comment": "Malware payload", "value": "2e9f065af21035ce8ce01d72aaac5f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215320, "uuid": "ad1c6163-b58a-40bd-a054-e49c630f55b5", "comment": "Malware payload", "value": "1c5c647db50b160ebf28381ddd734ae293c88e8bb2d78af518d46599979ff019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215320, "uuid": "67766603-11a8-40c0-9197-49d40bf62995", "comment": "Malware payload", "value": "9e1c433cf4e7e6b47c9e24754f35793354027f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215320, "uuid": "57246a2f-4398-4403-b665-9be1fa2f82ca", "comment": "Malware payload", "value": "5b79c887b009e6a61b3750630e2d5cdd832467c1687c604bce50032768fcba46e4b37ceeb6eef07e041d32d7950cae2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215320, "uuid": "a27218da-5e69-45f0-aa7b-d724144725b2", "value": "T1CA163339DAAA4DB6EE76687C425315E91273EDC480424D62333D3C64C83F19BC8ADDB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215320, "uuid": "9486510c-a5cc-4e09-ba14-153942116e51", "value": "98304:XRbj92scwqfy6aBXjDtqFSRfBl0GoNjgwDY7SICUFjhFvP:V92sc3fyjagcVuNHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215320, "uuid": "4a0e2a39-2a14-4c63-b1d1-917e278de81f", "value": 4109978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215320, "uuid": "81954916-6bc2-4f03-9d1b-c973ae1e564d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215320, "uuid": "321de19a-7738-425b-a1f5-44544d003577", "value": "2e9f065af21035ce8ce01d72aaac5f6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4fb118-d803-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681174424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174424, "uuid": "96ca6669-c6f7-44d1-ab07-bc20059670a3", "comment": "Malware payload (Smoke Loader)", "value": "2e3d27072ae98534d90b5ea6ff4d7078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174424, "uuid": "e5f52a58-fb4d-4522-9989-e8a91612e5d7", "comment": "Malware payload (Smoke Loader)", "value": "1caa6ce5ec2129481db6402f1b9449e084de97a97aec7dcff9843ea169b996bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174424, "uuid": "2ace83e8-9695-4c29-87a1-d668a216ed1b", "comment": "Malware payload (Smoke Loader)", "value": "a189ab7367a0279678dc967d763a88fd768a89e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174424, "uuid": "9a328f0b-5dfb-4cb2-a311-6c3ea49aa0f0", "comment": "Malware payload (Smoke Loader)", "value": "dffa382d7aa1127b5d6bfc756d14c5ea015ace46027ff6c1510fb8ed0d2e92d27f4eb23b14a4ae4336401cccb472a5b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174424, "uuid": "ca558063-19c7-4aa6-9bea-15fbb1e6435a", "value": "T1CD14D026BAF1D0B6D05B45700812EAA06F7E7872A765C58B332817FF1E313D186BA357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174424, "uuid": "fa72e684-a71e-4640-a0a6-367ce8460032", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174424, "uuid": "3ebd81bd-9288-4e58-9a00-0d6a0ed55c00", "value": "3072:7ee28anlk0YN7WbIFKwJFIzGZ1LBmbwmvTVeMPeZxWOwLW:P28cG7eqKwJxTLawmLVFPe0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174424, "uuid": "b8cb660c-a523-4b08-ac8f-3ebd6df3f46c", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174424, "uuid": "027ea0ae-7873-4111-a2c3-6dcfdcd768d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174424, "uuid": "8d1080ab-21c9-4366-ad56-acfd49ae3022", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcd1a44-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681205506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205506, "uuid": "a36c99b5-3f9a-4f80-a0f5-9e9d52f6c117", "comment": "Malware payload (Vidar)", "value": "aa24958e84ca0a33c313d61d8d43a62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205506, "uuid": "bf0b149b-52c8-4542-bba8-634af6519f06", "comment": "Malware payload (Vidar)", "value": "1cc37720fb14545fac7749d5da5a4cd975b0395bd48b376bc059d3af7c2155ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205506, "uuid": "b54fa9c2-3f4b-4a47-a79c-a3b8d7bc5914", "comment": "Malware payload (Vidar)", "value": "55aa402c9909828172adf99aef35ddaf25f016f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205506, "uuid": "6a7326d0-c9ca-4617-9faf-01bd6a61bb8d", "comment": "Malware payload (Vidar)", "value": "4aa8798dfdf8b3d96bb82707a6b7d0a35354881257d715bb613c91e5eac592415941a93584eab31f50ef5af6c01dd525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205506, "uuid": "3bbb7a76-a2aa-447d-bf3f-fc3607eff7f6", "value": "T15C64F221FAE1D0B2C4A785305824DA54AD7F78A2E7A5C68B2364177F1F307D09FAB712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205506, "uuid": "43f62fde-3d8f-4826-b352-6fddcb476963", "value": "4c3723f654b7ebef4d253c089e97df92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205506, "uuid": "f93470dd-fd4c-43bc-b4c8-082343f54ad7", "value": "6144:l28LnUFRa91yA1crDeobjAujTQ6Wks0ULbchUnJ:l7USjtcrSijTQJkaLbTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205506, "uuid": "495cb65d-48ee-425e-8fca-1a3cff418255", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205506, "uuid": "c624200d-0cd8-4c54-a174-48f86d0382f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205506, "uuid": "adf5ffc5-e4ca-49bb-9166-91cd117a5dd4", "value": "aa24958e84ca0a33c313d61d8d43a62d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3672fd9-d855-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681209918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209918, "uuid": "2350a3e1-3701-42f4-afb8-1a2f3b305b0e", "comment": "Malware payload (AsyncRAT)", "value": "68cff6cdfb54587ab2c35b247aeae095", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209918, "uuid": "3a20a8b5-9aa3-454a-b83e-05d2b81f000e", "comment": "Malware payload (AsyncRAT)", "value": "1cdf52394830404a86b2460bcd082ac5036edd19591b4f300fda04b900daf5ee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209918, "uuid": "26d323cc-e58c-4ad0-9527-0d4c05316355", "comment": "Malware payload (AsyncRAT)", "value": "ea820a256f7975b3a99b052c1b6e19949e0964e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209918, "uuid": "668c26b3-1a55-487c-86e4-0328d89d89e8", "comment": "Malware payload (AsyncRAT)", "value": "d767b221ac7f8db3794f348bc8bd172f1d32d81713dc6f445e11ce81967f5e8c4b936fd50adfd0ff5841398325b64ae7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209918, "uuid": "ddda0e0c-1d9c-40f4-b6b3-7cb11f29b038", "value": "T18C346B8C765472DFC867C8B68EA82C64FA607477571BC203A45316EAAA4C9DBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209918, "uuid": "c9746fa6-7096-4a83-8c5f-aa518b742e71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209918, "uuid": "c92a2bc6-7ca7-484b-a3d2-58b455458e79", "value": "6144:AKiGahcctW2xJuoWt7RTct7/LVWsfRTGDNWU24mMI:AKVMJJJ0paMyJGDNWU24mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209918, "uuid": "ee7d8ed8-7b93-4987-be29-4ad05050bad6", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209918, "uuid": "0a2db3e7-75a6-4696-a795-83fc85a29105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209918, "uuid": "0ab55024-b0a2-4a66-b249-79f38d986a9e", "value": "68cff6cdfb54587ab2c35b247aeae095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e82165d-d83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681200219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200219, "uuid": "071e2856-5a10-4ff5-ac50-73dece578e47", "comment": "Malware payload (AgentTesla)", "value": "dfec1dd8875c667ce7305084a3583a42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200219, "uuid": "769aead9-6844-4ac5-9991-cce11e02e53b", "comment": "Malware payload (AgentTesla)", "value": "1d33467dba0945d2a0dab179b6d5a38c9e936f3c51a12dbefdaf361df2a62562", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200219, "uuid": "f21b4388-60a0-401b-abd6-44f2b12e98e4", "comment": "Malware payload (AgentTesla)", "value": "64cf8c5f16b8adaba37146a85f1910dbcceb8d08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200219, "uuid": "0ec59df0-f4e2-4d40-8ed8-64d4ba1af892", "comment": "Malware payload (AgentTesla)", "value": "edc539d1067628f3dbfc6686a98dd1fec2232c67b84768ce37c0ae00b11f0c8903611f9852549aed636631355e675217", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200219, "uuid": "e93df0a9-05fb-4d9b-9e67-3fe9bfd66036", "value": "T143C4019E6275EFA4F45C0BF41090684517BCE349E1A0ED6C9C9223E38E77FA211993E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200219, "uuid": "3de9fbd2-9049-43d0-a585-814cc1fa1093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200219, "uuid": "b496ac70-c263-4fab-a12b-eedbf5730daf", "value": "12288:ezk2w1wjVviTsFSS+DTU5Vb/5CzT7uE6Hwx4K6Id:eQ2w1wjVvia0TU5Vb/5CaE6Hw+K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681200219, "uuid": "15e0f206-428e-4064-8c66-acee1177fed7", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681200219, "uuid": "e63fb71e-2bb1-4b5c-b778-bfda03243310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200219, "uuid": "dc5d3aa0-6dc7-4e9c-b09a-a53943aa083b", "value": "Payment Slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b182036-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681208884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208884, "uuid": "61984720-bb71-4e2f-93e9-d0e022b2b800", "comment": "Malware payload (AgentTesla)", "value": "9e7222cdd1cfe151e151b8279a536279", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208884, "uuid": "13829384-0ce8-40af-9fa5-d944b77a6989", "comment": "Malware payload (AgentTesla)", "value": "1d44eb9974bfaa01d6649d74a6e2e90d5188120e9c97e1a1dd357cbf56efcb72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208884, "uuid": "ecb4dae7-40c8-4337-96a8-c17088020113", "comment": "Malware payload (AgentTesla)", "value": "e645535fac1416baca7cc1fa029217a48c247c13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208884, "uuid": "06e8fca0-cf54-4dc7-92f9-757df21ffb08", "comment": "Malware payload (AgentTesla)", "value": "b3f7bfab2cba0fa5752858cd0fb331d421a53aa222f48dafa1a6bb79da6b56f4fb752ef4da1d936be67936ae31621065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208884, "uuid": "265fb53b-8a97-4ded-9bd7-0f183dcffaa6", "value": "T145C44C84BFC4CAA7C53EA7B79462335127F5C5D1B11BAB4769D4A2F06CA23482D2C1EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208884, "uuid": "b5368774-1818-4a72-b4fa-d38a9c803970", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208884, "uuid": "0774ea91-6422-4db9-bbf7-5bd782d3abf0", "value": "12288:MaDC8jqoXDa2VE1deVaAN2JHaz9ArwuMT/G9+:NpjqUW2VE62A6rwuMyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208884, "uuid": "a55861e1-6271-416c-9d03-fbb9949491c2", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208884, "uuid": "c921fb2a-1dbd-4585-b1a4-1a0d4e26668b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208884, "uuid": "aa972d3f-8326-42db-bc46-aba71f9515b0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314f1ef1-d824-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681188547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188547, "uuid": "e25991a7-92d3-476a-887d-33cae506f432", "comment": "Malware payload (GCleaner)", "value": "7f420b8feb60476588ece4d312475f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188547, "uuid": "7e3eaf9c-6f04-41dc-bdfb-a387cb5fd231", "comment": "Malware payload (GCleaner)", "value": "1dd38e375c52c69190bebe72918c886a1a3aaf35f78cbea57df74e20b379f96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188547, "uuid": "6197bad1-c50a-4f94-9f5f-92f94d1c0bad", "comment": "Malware payload (GCleaner)", "value": "286027b7b0d625d41c49c735bab192298bba550c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188547, "uuid": "e0832242-262f-4dee-9c4e-389f01956006", "comment": "Malware payload (GCleaner)", "value": "b28088c2d95a6c889e43b7ee7b66b72770c74be5e3cba600e45881fb8f0e7eb9c90aa41b2f97724977f0e6904c85a6b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188547, "uuid": "c7379a52-d0f4-4928-b5ce-31e95e26940b", "value": "T16FE5332354E1D0F0D2E60B72BA01DF196762FD4A2D26025836BFA9CD5FE3227B955307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188547, "uuid": "dd72b0b3-b873-4fe7-95e1-0c40038ce025", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188547, "uuid": "0167c0c8-93dd-43e1-8041-17b312b04578", "value": "98304:q/BPns8uPsS8lJArNowrkRg9SoD40EAxG4TWSt:afuCDApVG4V4t4zTWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681188547, "uuid": "b25da0ad-f7e0-46e4-b72f-8516c4de8427", "value": 3193820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681188547, "uuid": "699a6c2a-56af-474d-9803-8a5ef59c57dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188547, "uuid": "982e0c05-2d26-4db4-833f-8d3c0041df55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79408a31-d84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681204989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204989, "uuid": "d9ed0053-6162-4e42-ae2e-eb3ae4a373ba", "comment": "Malware payload (AgentTesla)", "value": "f60fe7069b3b015056220d3c6c101c41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204989, "uuid": "73b452dd-d3c8-477c-9ef2-67cbe0f9ac76", "comment": "Malware payload (AgentTesla)", "value": "1df9f507ed70f0454481d9b71802db25fda435464628cada52f5d8d86536c4a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204989, "uuid": "55533dc1-0dd6-447a-b01d-c4764c4e8170", "comment": "Malware payload (AgentTesla)", "value": "200669722c847114a4a622ac8b3b364ece1c3ff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204989, "uuid": "b4fb69cd-a546-44ad-8448-22c6f1fffc63", "comment": "Malware payload (AgentTesla)", "value": "df70caa35fba4fab15b92bfe6cb65b518a63e61f103b57ff0d39d3571eae72c8e686302ba573d5860e5059a4f6fe16a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204989, "uuid": "389c545f-78d9-456b-a674-1feea3c8e49d", "value": "T1E3050103B18D932EDA6887F67035427843B5EF2B6511E7AABCD6EC7F493274C4A006D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204989, "uuid": "85028d78-1473-4a8c-8973-08b5bbf97481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204989, "uuid": "b72983bc-5105-4b14-b31f-df4a76bd47e7", "value": "12288:w5CBWKdq1FbwwJLwrnlMXO0poc7KV5jkyMFe4CrnK2hxsLpK/N:TfrpTlMXOaoc7KLjkhedK2PsLpKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204989, "uuid": "0f75eaf5-d8e1-46d8-8366-2137c56b505f", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204989, "uuid": "5fdfe458-7ae6-4085-9d74-ea075f057cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204989, "uuid": "b41858e0-83d1-49e1-8860-ab6754c7c1c9", "value": "PO.20230187349931062023PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6d289d-d866-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681216916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216916, "uuid": "f5d34bdb-8115-452d-a497-d3c568f3163e", "comment": "Malware payload", "value": "c9c34d1ebd7e5a300c7f9e9bb98fb7cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216916, "uuid": "ad1b4515-5f27-44a2-803c-527060b8cf02", "comment": "Malware payload", "value": "1e5ada07eb9e76d616b0eb409d3acd7b69c71883b8b8f26934e7dea1203790df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216916, "uuid": "a96476c4-1910-497f-9a9b-8300511dcfc2", "comment": "Malware payload", "value": "4c56c46750b81a52bf17c33ff116bdfc68f078bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216916, "uuid": "5210c862-196f-4e3e-b669-f75a97ec0c8e", "comment": "Malware payload", "value": "a3b1c10f2ccdcba871a933818d851e72795fba76e0ffd91ef4223025314c9aafb0c2b425957cb8b34f4023c9313e1dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216916, "uuid": "42cb5208-f4d1-4276-8d93-118fe071caa0", "value": "T10E92D06263709A8FC5C8D2B70593CCA825F14FC5810193B35228E5AE64FF6778E183A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216916, "uuid": "48e5f43b-c211-4e67-a1fe-1b16616d0590", "value": "e05b805c5d1daf2c544de0817ec8a82f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216916, "uuid": "c79dd085-5a88-4560-b4cc-e92283583ee1", "value": "384:i944KH7PeR8x9ESresKC8+j17IYfgGfeocjdXwDo53Tj53yON:ijKTLASrDKWlNfge3c1wDo53TN3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681216916, "uuid": "74186fcd-6929-45e6-a541-fe5f387f741d", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681216916, "uuid": "632d9923-5151-4ba7-b889-168a60f61fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216916, "uuid": "991bdeda-e73d-4708-93eb-c8d0818ce72d", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.9760.1546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e725357-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681214017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214017, "uuid": "63a329ac-55a7-4822-99b3-917edfaeceb6", "comment": "Malware payload (Vidar)", "value": "5d0e74b9e6d4c302d5d5c37db3919da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214017, "uuid": "c0200f01-2e93-40e8-a4d2-c8b2be15d5c0", "comment": "Malware payload (Vidar)", "value": "1e639621444695d353b529e1b1e27ea0b94b19a338b119b28e41113b6e6c4376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214017, "uuid": "60542000-d299-4c7a-b508-808b66170eef", "comment": "Malware payload (Vidar)", "value": "0e49e235c63827c592d2037ed1430db204d5c225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214017, "uuid": "e75d4adc-6c91-4246-a850-97ccbe10a2bb", "comment": "Malware payload (Vidar)", "value": "af4c18b8d98e886c2aac7c68eb1b3039f02f03f437788276658fac495b6438719fd5af8b571250ad3a355514c9f20dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214017, "uuid": "0c5ea48a-75d6-4717-80df-1d68b8ef1089", "value": "T177640162FAE08473C0AFF4315621DA605E7F7C71D66082CB27646B5E1F306925BAE363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214017, "uuid": "ab268f8c-152c-4844-b583-77860374e16d", "value": "94b862c07f0e4212c3fe2a5391e2e04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214017, "uuid": "bd036c38-66ec-44a7-9121-08f71a81a6b3", "value": "6144:xefmkpdL0NTZGpk3TqhgMjkHqNC5Q5OCowUNgmlP7XIT+05:xefmU0NTYXje5QnmGD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214017, "uuid": "d0dd73a0-8e4d-4528-987c-1e71d9aee149", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214017, "uuid": "d3cca678-b330-4825-92f0-8207df33454a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214017, "uuid": "3045ee19-fad8-4e74-a4da-cb73ac70bad4", "value": "5d0e74b9e6d4c302d5d5c37db3919da7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ea8e97-d839-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681197628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197628, "uuid": "6d19d906-adaf-412a-90b9-5137a6cba866", "comment": "Malware payload (AgentTesla)", "value": "2428249766513072c93bd4749b08406d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197628, "uuid": "01e6e0ab-fa03-48ba-9cae-2cf55e583160", "comment": "Malware payload (AgentTesla)", "value": "1ed3c374ac458fc9701a422c5608bf80c161a9a4adf4fdd596a7d885c9048de7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197628, "uuid": "b19f64e9-86b5-42f1-a2ed-be0dbb5262d2", "comment": "Malware payload (AgentTesla)", "value": "fc63995db36957387c3fa26f3ca0814b024d3445", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197628, "uuid": "c2061a9d-0e4f-4896-9e89-e0b00e183a29", "comment": "Malware payload (AgentTesla)", "value": "4db48039c11d88527e7c2ca9ec1db74f99486eb0c8718c8f3df92713e5cdfba44cd234a8a1f08207e958caf3db38ec43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197628, "uuid": "a1c44df1-6311-4195-9d68-a52845bf3807", "value": "T173F42214325AFB22D52D0BF79153691403B6662B4863F3BE5CDA1CFF1862B4CC992D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197628, "uuid": "5f9510c3-16f4-4ecf-9cd8-149359f90830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197628, "uuid": "4f5f50e3-9f3f-4bc3-9023-601b46e02501", "value": "12288:t5CBWKdq1FbwwJLwrhEp+MBES5SXn04s3qlTopiXLP1J7Z120ter:mfrpN0M02lMpij1J7Z123r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681197628, "uuid": "9e466158-aa58-4776-a3d5-8465ab8a485b", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681197628, "uuid": "6f80629c-5664-41a2-862c-6208a2cdf2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197628, "uuid": "4f6a7bb3-b127-4c39-9bd7-151a4740e44f", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c2d1a8-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681221815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221815, "uuid": "7e4c22b1-dc6b-422e-a3d2-5469d5bdb272", "comment": "Malware payload (Vidar)", "value": "4fd7a53f166359d0afb35f04f684d288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221815, "uuid": "78207c84-6b75-4df8-ab4e-e2a326db7102", "comment": "Malware payload (Vidar)", "value": "1f1faf0552000f3a0671b5edff78341eb35afd8c667575f05994fea3391ada18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221815, "uuid": "0e018c82-8175-4ea4-93ef-fa20d7411f5f", "comment": "Malware payload (Vidar)", "value": "081b8b1a2d0d6f9b629f792d0344c1519e03b3b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221815, "uuid": "7faaa226-64dc-44ed-b789-53a53afb9499", "comment": "Malware payload (Vidar)", "value": "cf3b82a64d16f528bbf4e9d65273569d59e721103d3290899983adabd61aaf0336248fb7194d3201ee8aeb9526d23643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221815, "uuid": "3a080a1f-73ee-4cf0-a4ae-5fa09eb76e25", "value": "T13664F023B7A1C0F6C89B01744D21DA70AEFEB871A664C997374857EE6E30691D76F302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221815, "uuid": "45815a2b-4ae6-43ce-92dd-572940c1aff0", "value": "ab082a716c28869a457cab71ba8dd878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221815, "uuid": "26eb3fd5-7d6b-4174-96bd-b58304113cc6", "value": "6144:KF0VipBVmIA84HfkTP3chZ0wbcOrcHjG9p:KF0VYBC84AX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221815, "uuid": "e6f1bdbe-2fe1-4c9d-b9f4-275d17daf796", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221815, "uuid": "1b520f42-1263-4051-a41d-ba531d76d04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221815, "uuid": "552a29ab-5397-46d2-a792-624718b1c58f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c06f176-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681240266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240266, "uuid": "a981df30-c34f-4705-9fc3-1641eb4e5f16", "comment": "Malware payload", "value": "e60d9b8716cbd4e61d9860a5739e567c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240266, "uuid": "f4bf85f7-4ae9-4ad9-b608-18fda07e61a9", "comment": "Malware payload", "value": "1f53af180263a4506a6c2252865b61ef128824620b500110eadd37ed3231b7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240266, "uuid": "087928e8-d614-4d93-871c-87a263dada66", "comment": "Malware payload", "value": "905cfa3b16ffa3761181655117945bfd4ba9cee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240266, "uuid": "2928f724-15ec-41c5-8914-bd037ec9c0ef", "comment": "Malware payload", "value": "664e0bced64eba34cffdc60044c43c0d77c68038c25d7d7d97d6afc2087f389b4dfe0898497232e944f0e2b7a91fe9ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240266, "uuid": "5d4b1028-5545-4ec2-86c2-a20bc9965667", "value": "T1E124D031BBA2C072C55B40724420DBB4AA7FB8B1BBA2C69B73541FBF5D30790526A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240266, "uuid": "f2aa82d1-fc52-4411-ac0e-769af6f5c916", "value": "b81caf9645c283582db7fbe3519ee19d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240266, "uuid": "241b5e1c-5533-4a5a-8094-24f1db157fbf", "value": "3072:zmXa+UiYuXaRuJRg0wZPflbzAVDU0/qHhNSivxL13uly5tlEYP5N46J:aK+UwaRu3gfP2U0/qzSzytz46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240266, "uuid": "0d055c64-2d29-4a37-8e3a-b3825c1baa2a", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240266, "uuid": "affcb37e-c5fa-46ed-b653-0fc5e6bb069d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240266, "uuid": "ef36555c-6539-4e09-b0a0-a88c0bb18773", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9641e5c9-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sality)", "timestamp": 1681214057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214057, "uuid": "4ee4d045-f1bc-4d4f-b564-033a768d8ce6", "comment": "Malware payload (Sality)", "value": "f96ad2108001929ccc0d4244215239f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214057, "uuid": "88eb0fdc-a545-4235-8aef-2e0f01b7c239", "comment": "Malware payload (Sality)", "value": "20ad1e6af5c86cb19ced3387f0a7928d98d5b62537d525d1a63e3ecd4a039bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214057, "uuid": "a38f4072-495b-4cba-bece-dd4e7da8fa79", "comment": "Malware payload (Sality)", "value": "7f8d00ccdefe09d92adc1c87df833834123fd49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214057, "uuid": "416c5c55-f186-4e1e-8658-659a83fd0d67", "comment": "Malware payload (Sality)", "value": "1bced5ffacd636288518886f0ab0828abd2b754f5b3afa4ff263ea14b0f0440350e89039a86e27bc936b2bdb201af2d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214057, "uuid": "50343b58-fb13-4038-90df-1e7703249ac9", "value": "T1D725231933080F5DD5002CB518FF5F236321E5C065070F23A3692ACBAE9B7DA7B6769A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214057, "uuid": "8bf05497-81dd-4dc2-989a-255f2474544b", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214057, "uuid": "dfc0c317-8570-47cf-8c5a-86229f603060", "value": "24576:kMKhKJqnHBL84j3CeNcYR+xHcL/BqZIe4YI2kpTs9vdiBMRX4lR:kEQnHBLJ3CeNcYI6L/Brpvg/iOF4lR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214057, "uuid": "a22215e6-7f3f-4950-9735-156b3e966fdf", "value": 1055286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214057, "uuid": "b10c7c78-efb4-48bb-b3e8-db9524fe67d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214057, "uuid": "23ca47d5-e7d5-4ff1-9a00-6dce1777623a", "value": "f96ad2108001929ccc0d4244215239f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e547f0af-d89b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239959, "uuid": "3bc59342-c814-46be-9452-4b68bf1127ad", "comment": "Malware payload", "value": "6bf4ba99963e47a595be060041c348b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239959, "uuid": "b2d280ff-d8da-4491-aac3-3e3d5e95e4fb", "comment": "Malware payload", "value": "20f0bf2d2e71c178f1c14488e71a5b6c2b12a1b0ed113ced8be77473b0ff151a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239959, "uuid": "b60bdcba-4938-426a-bfb3-52021018da6a", "comment": "Malware payload", "value": "c9c7571a1bdb25dbf9c90f1cf5b6269c7540b949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239959, "uuid": "c5308aa1-d5aa-40c7-9b00-612bffd5d102", "comment": "Malware payload", "value": "bdb38247c7d2ef8c9bc3b6810cee8526a7ab069896c89d8a21280d012563c9014a585e09d70bc4131e1a3290e2c60986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239959, "uuid": "244bbcb1-e02f-4a32-a82c-eb5c3dd9deb7", "value": "T12E352362EAF8D032D5B9037495F753971B393EB38975872B7359A94F0872182AC32327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239959, "uuid": "670daf60-d469-46ca-a77f-527aacc07fda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239959, "uuid": "e300b14b-537e-43f6-8f37-3df79494f81a", "value": "24576:YyNOheHgyAjuO/U2uirHk+WfC/DPCIk9gbK6o2bR7LosenR+f:fNbgNjuouioa8bVk7LTkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239959, "uuid": "2c0fab7e-329d-4bd8-ae81-06e67aca81e4", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239959, "uuid": "3ace6a49-cd79-43b4-81ef-699458b57272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239959, "uuid": "78116c36-2cec-4bb5-84dc-cfbfefef23fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ebade4-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242970, "uuid": "796aa9be-d39a-4773-9d46-8c24a0fa6345", "comment": "Malware payload", "value": "cc88acf3afc9ac6a553e5de15934ba7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242970, "uuid": "689c92bf-3994-4180-b9f9-9e2e076d0b81", "comment": "Malware payload", "value": "215948356a54bebacbb45398ca39c82a6e9ac27d0ebc2c283bf7fd29b819dd62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242970, "uuid": "7d9d8cca-143d-4bfe-8c5b-c8944305a513", "comment": "Malware payload", "value": "540b52a2d0ebf4f6f51cefb61a5228c6830447cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242970, "uuid": "e3573f93-8e3c-4175-9274-6b4f145ef79b", "comment": "Malware payload", "value": "bba46f8249e43918eb5f200da2569a9928ce0899b451491ac6517a694ea7b5407dd74e26ebfda6bf5d4505df120d5755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242970, "uuid": "f10890ca-942e-4870-b470-68bf7cf7a4b5", "value": "T1DF352319B7E8C170E9316FB1ADF311D31E777CA05C24833B93A19A4F0CB2660A5B8B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242970, "uuid": "9b703251-2569-4973-b627-12590b3d53fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242970, "uuid": "535b1777-19ff-43e8-92fc-02a34a033046", "value": "24576:nylATSl+q/URHsxc5sLJm8/AUT2Nr+u4WGm5Iw:yYSl+kW35sL//As21Zh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242970, "uuid": "c5fa2239-98c9-4e0e-8d3c-1aa92c001414", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242970, "uuid": "277c95e2-7a12-455a-b33a-86812662013c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242970, "uuid": "e0638266-0001-44e5-be97-6d2a75204d2e", "value": "cc88acf3afc9ac6a553e5de15934ba7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7767ae0-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681208959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208959, "uuid": "4e93315c-a0d0-4906-8991-4793c1dc89ce", "comment": "Malware payload", "value": "c5fa8d4d3f173f8d7d5489fb99f2a37b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208959, "uuid": "d59d20f7-19c6-4ab7-b556-a2d794554e83", "comment": "Malware payload", "value": "2185ad0adb4d0e0fd1ed82e5cf358738812e87fd9a33a6894556931a06e235f1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208959, "uuid": "4ad8bc52-501a-4dc0-bb13-cb536b653ade", "comment": "Malware payload", "value": "fcb04c02e1fa3d9ccb44ea40a0c7708ddfd55d80", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208959, "uuid": "23d1019f-30f9-48e4-baea-d967803c3d26", "comment": "Malware payload", "value": "a73921acc7de0ff60e65003d44b5f3c4409d5738dc4edf037dc245309e1c5e3adc1e4eedf343b22688c72bb4bd396ac6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208959, "uuid": "06d0eb56-b231-4cc4-9c26-0e347e5a286c", "value": "T10835AFB875047DE62A6F576BDE96ACDD13B627238ACBA4CC806477C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208959, "uuid": "28fea147-6d40-4d13-abae-c1384c21face", "value": "24576:66VIeNRQ/6CRr78JeG2HLxfYEcUdDAq4rahvJ/8cfKKKcOrB:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208959, "uuid": "d5f93c5c-927b-4ba9-951e-7204b2c3414e", "value": 1124551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208959, "uuid": "2261b0db-2df7-4bba-aae7-2cf5e92e7739", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208959, "uuid": "f55b7b5c-e43b-4fb2-896a-472e62e4c771", "value": "Product List Inquiry_RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42b1516-d800-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681173278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173278, "uuid": "725ec52d-dbdd-4098-bcff-fd7b99cc83e7", "comment": "Malware payload (Amadey)", "value": "b8fc36f0953d97fcc28bb349630683c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173278, "uuid": "f42a3f1e-c730-4511-9273-00c1a1e816cb", "comment": "Malware payload (Amadey)", "value": "21a082385c2f00e08a57e7847963e71a9709f33f36ed7abf0f1d38b13b4c7f27", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173278, "uuid": "8e790698-404e-458c-a772-50c031b642f4", "comment": "Malware payload (Amadey)", "value": "5100949313ae0627f7d1ea1bfa83b4f22be33898", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173278, "uuid": "2198f5a1-3aba-49df-ba13-94f08a9f1aa7", "comment": "Malware payload (Amadey)", "value": "631d79b43b17e255d7a7d9c00cd099a00a99626251aada6dc357cddeee20ce86aa1a12d9aff61c95ccd77f2e0029c088", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173278, "uuid": "c2578ecf-2f69-4cbf-ad2b-a31ae9796e79", "value": "T13B151287A9EC8173C9B407B058F203D70F35BCE19974871B7B91A92E1C726C4A4B67A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173278, "uuid": "b5570766-310f-4218-b123-58499fbd7b4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173278, "uuid": "b32fd7d6-8402-45f1-91e3-b61530419e9b", "value": "24576:wyRc5X+c1RGZIW4ELyCkU+yCmgvsUlzk1Th6Vp:3hc1Ron4EuCp+yikUlzk3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173278, "uuid": "c2d17767-6fcc-4569-b0b9-90bd00ca1d6a", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173278, "uuid": "98a72ec9-bd09-4b09-aec9-523e64debac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173278, "uuid": "61756f23-43ef-43dc-9603-f113410d9c27", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c27735e-d863-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681215731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215731, "uuid": "6c64da17-2bd4-4ef0-95bc-a512316e79ce", "comment": "Malware payload (AgentTesla)", "value": "a8c400c5b6ffcca803a8c3133efb8d10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215731, "uuid": "d4939a2e-5a29-4d75-8645-258d46174238", "comment": "Malware payload (AgentTesla)", "value": "21b6419216ef4f5d9a18205bdea96b44a7f173053194e3936bb7ba991f72eb6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215731, "uuid": "d2e8b3db-e462-4989-86b5-eaff60b5b5c3", "comment": "Malware payload (AgentTesla)", "value": "d5480fd5354d4955fc3deefab9345d0a2a8ada02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215731, "uuid": "16267491-6a4c-4df8-9f84-7c0707fca15c", "comment": "Malware payload (AgentTesla)", "value": "020a9854b72afd939ad8d3ddfa235c7ef277bdd53b88fd619de2bf935ecc716648d78b2f4d8dece9a68121b41f2646c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215731, "uuid": "cb25758b-5e4d-4bab-b90c-cb6aa0a3e4ff", "value": "T1FA057CF41AD78B84C037B130B05AC6F2C7D21D2AE099DAE0F897758591F1E451CEA9BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215731, "uuid": "7c0884ad-30ca-4727-baaa-2c3674b96a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215731, "uuid": "c37d5ae7-5510-4382-8b62-ffba73ca4547", "value": "12288:N2iNRSw2BUK8xJYzmWW5bzipMZjJmSrPtYI3LhhYDirtClWoIu+AyVgh2eV:N1JGUXJ8m3bmparh7hh6gQlTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215731, "uuid": "650d9ca5-e805-4e96-bb6b-ecaa9729ec48", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215731, "uuid": "1f45edbf-9481-49ea-bd30-06c38d2a5fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215731, "uuid": "0e1055b3-e2b8-41eb-9534-e465a5e0b738", "value": "Equipment devices_2023Models_71829-51172300176.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12897fc2-d863-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215554, "uuid": "8ae31696-26c9-424a-a4f6-4063d9e60b3e", "comment": "Malware payload", "value": "d62bb88f38605a591c9e51ee9e823dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215554, "uuid": "5307d667-f25d-403c-b2ba-e033ba3aa15f", "comment": "Malware payload", "value": "2221ff7ad5fbb6e42a65b10f3317ddab5616e1c90ab40647075a17db5788f907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215554, "uuid": "589c783a-2a87-4183-b1d8-21905b820cd9", "comment": "Malware payload", "value": "38b45f0a6392955bd1a5ba92060d78fe35ba5203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215554, "uuid": "acadaf2c-f4b6-4bd4-a33c-f3769a94633d", "comment": "Malware payload", "value": "e09b7d6d51d988c9458757de324713b8f1c5f2043cf6a13d6fb04daea70eb897b8a69997866beeddf49cce8327bca31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215554, "uuid": "d26ec2f8-c881-4e61-8457-5fce0a218226", "value": "T1B995E00AB9648C64D593D5331054D6A39209E64EBE18DBCF23B05E0BFAF45A74F02BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215554, "uuid": "94cb1220-78d2-4428-b2cf-ae04b8b06543", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215554, "uuid": "00b47d40-ee66-4e5a-bc82-2ad39b491fd5", "value": "49152:+2hq2yIP7KfSNjf5UbCDGT2IZU86ChWlY/NfrGFtN:1q29KaNjf5rBIZU86Ch3/NCFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215554, "uuid": "f802cff2-445a-4436-bc2d-23b0fcc49b3f", "value": 1966380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215554, "uuid": "89a4ab3a-6b51-4147-979b-4959fdfa88f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215554, "uuid": "38c4fb12-8345-422c-9c01-3cec45998abc", "value": "d62bb88f38605a591c9e51ee9e823dd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b006b53b-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681214100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214100, "uuid": "db60a18e-0b01-448c-b7c6-8b21ec777255", "comment": "Malware payload (Loki)", "value": "c1fba12b3416f97c016b9772fdfd6898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214100, "uuid": "592b4a18-96cf-439d-853e-74d21f0db42f", "comment": "Malware payload (Loki)", "value": "222e95bb9306c62ed33d1385515aace6a020f71aecff8a3182b80a65d4861e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214100, "uuid": "51f0522e-c5fe-4f61-ab01-db48820fda9c", "comment": "Malware payload (Loki)", "value": "15dc262515927187b4e97d61ed839587603a9873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214100, "uuid": "a0e24839-8ea1-47e5-b4ba-ff77824e3dad", "comment": "Malware payload (Loki)", "value": "21b9dd09405f581c80a7defc4713da81d9d8962b1c4f0e6499e6634294601be7fa9c9b1abd51e8c98d9e6851d66cc8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214100, "uuid": "b00a3c6a-b71e-4cda-8a41-3c20e98c7194", "value": "T151040259F670C9A3FAB31BB00E7B572B6FFA9A0104E0438B67505F5C7D62201BA4E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214100, "uuid": "af872f58-a715-4534-8870-2bf7ace5b060", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214100, "uuid": "e6cd241a-013f-4d26-ae36-fccd09f5d675", "value": "3072:3fY/TU9fE9PEtuabZhfm3VjU2SyUY2en+Skn7pmQhE61eWtIbWD/+b9uQ9aU9Htc:vYa6K/O3zt+T1mfAeotauQ9tNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214100, "uuid": "ca6fdfc6-d41d-4f5a-b362-08ef69a68161", "value": 175180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214100, "uuid": "ccc93ba2-815f-42fa-9387-6c872fd5e223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214100, "uuid": "81a07c03-2e2b-4572-b4f4-7bad197ac143", "value": "c1fba12b3416f97c016b9772fdfd6898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6489c192-d82a-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1681191210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191210, "uuid": "34ba8a12-a233-4038-89ca-3772432122e0", "comment": "Malware payload (N-W0rm)", "value": "76455f383b351229bfef3d1097fa632d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191210, "uuid": "de5920e9-a253-4214-a769-f7a655d90acd", "comment": "Malware payload (N-W0rm)", "value": "23030ad2be9be643da67cdbedbcf615f1e928bcc6ff8eb4cf5df2c0dabf0911f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191210, "uuid": "1b7c0577-bbb8-4e01-b6bf-3fa40a331393", "comment": "Malware payload (N-W0rm)", "value": "b6646d1eb8d31c3415b9039563f8fa5a3f84ed09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191210, "uuid": "ac34ed4b-ee5e-462a-97e7-7abb4cccbfe4", "comment": "Malware payload (N-W0rm)", "value": "6655f5a1d25ca11634dc21b9f844318380475a6dfb388d54db3cc6ab006c20da55db5dcf628cc716974593c8f824af10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191210, "uuid": "f787ace0-edbf-4a9d-b276-6687163fba0f", "value": "T14234E151BEB1D0B3E45B4E304064CBB47BEABC629755869B271C27BE2E713C18B29317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191210, "uuid": "b5dc77bc-7150-46a2-8ce9-100ab213c596", "value": "4fa2892726d47130d81fc5e57831d465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191210, "uuid": "928aa03c-bd56-488f-a0ac-cd8c31e806d1", "value": "3072:paIocKqmZaVKQZqE/7Z2Ut/K40IjuFyseLhbiKNoPVb0ulWzXkFXpvrFIqmej:4VyoaV1H1piuukByVb04/xme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681191210, "uuid": "7eddee46-4365-41da-8fca-bc1681d52021", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681191210, "uuid": "83cc32ef-e79b-4444-aa2f-70312c4df198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191210, "uuid": "e998d8fb-36e0-4e7f-b627-da7c31a9b271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d072b5d3-d891-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681235629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235629, "uuid": "17e5c7ca-56bb-4830-af13-a5f22081bf31", "comment": "Malware payload (Quakbot)", "value": "2d2d41aab7c49d31930bb377dffea512", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235629, "uuid": "04ea04f1-0d7f-464e-ac13-7bf29735b3d4", "comment": "Malware payload (Quakbot)", "value": "2356ff629165a61de3c639fcec3d3bc5262eef6c5b5b002f0082e02aa921a832", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235629, "uuid": "ef6315b3-6138-4284-932d-5570e4ce705d", "comment": "Malware payload (Quakbot)", "value": "63843999e9fa0aa8a1214f6ee6ce830bd7cc1dea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235629, "uuid": "ee82becd-dc52-41d7-8617-589f5b31de98", "comment": "Malware payload (Quakbot)", "value": "b9edda38d09735e6dad8423474e7a5927575fdf3b1250af516496c1624e9d013ed80661e64cfa67a178221737bfed34c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235629, "uuid": "81383a3e-4c8a-413b-993a-a8d08df6d5e4", "value": "T13DC48D72756741F2D41356B22097EFFF4234A9268874A57FE698DE42FB732B03619203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235629, "uuid": "1e708184-a372-4400-bf6b-39f2c7088291", "value": "6863f3efdf3665c7c292b3dfdffa5eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235629, "uuid": "726d7ceb-8f14-4f60-8cd9-31c368bbc62b", "value": "12288:t1YEpoSVWkaD25m+RTLQwx7Y+g3D7exbnbq5cuzVtTVA:t1xp374mLbx7jg3fobnbkzVtT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681235629, "uuid": "76103416-aec2-47fa-b4f2-e4e1942be886", "value": 577723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681235629, "uuid": "51047bbc-9eee-4359-b772-ee59f5f7fbcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235629, "uuid": "14e04525-a08f-4f76-81e9-b77fe4360dd1", "value": "XMVwsCgfN.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f01ed3-d859-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681211640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211640, "uuid": "aa785161-7a29-466c-87d4-7a938f828ef8", "comment": "Malware payload (Quakbot)", "value": "1b538fb655d1ea772726b28a85ec7d15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211640, "uuid": "ba96d6f6-07d4-45c7-9692-495ea42d9257", "comment": "Malware payload (Quakbot)", "value": "23a5d13793ab459b6af65b981172dedc3ad6e2c745aa5eb79c3f1e948ee89037", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211640, "uuid": "262bc908-5e78-48f8-8ab4-1ffafbaee6f4", "comment": "Malware payload (Quakbot)", "value": "cfd966ba2f7c7ef654465c013686da1c7de6afe9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211640, "uuid": "0c7fe575-7661-487d-8027-ba0d6909b130", "comment": "Malware payload (Quakbot)", "value": "487e6974a7afc6bff3671db65e49ce45d9b4a9d346f8c05d9ae3cc012fc55cdf5d4cc781482e7c5d9f4abeb7bb60d88a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211640, "uuid": "f32e3ff7-fa76-43a7-90c9-fa57cf79ac7a", "value": "T12C83B5544AA216511737AB6A972F4A50EAAB0B3783009047F43DB205FFFE94EC4D9DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211640, "uuid": "1f8f3f00-164b-4883-9c89-6e213e85d429", "value": "1536:8AzaBoRHY+8SqpqbKyOxc+IWsEltqlqheN:8AzaBoFYnFp0KA+IWs2tqlvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681211640, "uuid": "cb3a6afd-4506-4c2d-ab4e-edb51e4f9fe9", "value": 84630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681211640, "uuid": "c1140eaa-b91d-421d-810b-41df6b146e58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211640, "uuid": "98b81415-47be-45e3-b94d-66cfa540fe0b", "value": "ClaimD_UkP(33)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e88cb6-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681195459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195459, "uuid": "c29a6369-c75c-471e-a0e4-161b7d4da3f2", "comment": "Malware payload (Formbook)", "value": "9b832adfc29accb3f48a791581dd33cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195459, "uuid": "fe7d1a52-c698-4cbc-82c8-d19f577462e8", "comment": "Malware payload (Formbook)", "value": "241c42aa6df24b11a6d52ef542e2f1c5eceba74438e26488b3e6d5b98e1ed8e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195459, "uuid": "c331e9c5-35c3-44af-82cd-e61fc2fef78e", "comment": "Malware payload (Formbook)", "value": "e7431343cd123eb25dc814d2f41e61299a80a74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195459, "uuid": "cb135331-897c-4242-aa2c-b1f158ffc958", "comment": "Malware payload (Formbook)", "value": "c9b08db73a8a69ac5ac42c7735b12aecfa1388ec46e6b75c83dd3884f63442e69a7430b3cc6366900f6768f5dbd0ec12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195459, "uuid": "72a378b1-6647-45ae-ad7d-74906ebfc0c2", "value": "T1E95413246128F13BD9D2033059752B97CF76A5689AF04B870B605D1F7C23B92D90FB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195459, "uuid": "60e2d786-d242-4cf7-843b-ed121fda1cb2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195459, "uuid": "60cfaf06-4bb5-40c6-a595-5c18eadda669", "value": "6144:IhtyHU22A4Ejh0ezI1qn/wf3RtgMPuLOJD70x5FCKp:Ih46E90f8YfBvGOR7Y4Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195459, "uuid": "db0426c0-5cd6-433e-a78c-a6ca9cf50132", "value": 289240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195459, "uuid": "bd37c9f2-a233-4ef0-8035-43c6493a2fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195459, "uuid": "e29b4897-7d6f-4d0f-a40b-57a7361d7dd0", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dd18b2-d8aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681246433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681246433, "uuid": "033f5bcf-a2c4-4074-b35d-e65a371a0d93", "comment": "Malware payload", "value": "3b1558f06f75ac9b5ec7911536310c02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681246433, "uuid": "cbb1c2fc-f847-495a-a8f6-c2bde1d9c173", "comment": "Malware payload", "value": "2533f5aacce514c69e8123c8570244589c9cafb81b3669fa37958c83adaeef59", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681246433, "uuid": "6fc6fee3-f45e-46ca-aa16-3a29fb62fd05", "comment": "Malware payload", "value": "80bb4085a70a3cb4a7ef9cfe27b272d0f7bf93d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681246433, "uuid": "089dc24e-61c5-4937-b675-df45acfac1b4", "comment": "Malware payload", "value": "ee2539a9a6f4e33ca57969d7ff1dbefc54892502849cbc917946652dc6b4c519dd5cde1e2826e0898cdc4b76e7c5a9ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681246433, "uuid": "e866238d-3487-4d8b-8d94-6deb13fd7346", "value": "T1B134F7648A51503A176B6B2FAA244850D66C4722C6C94117F8FE3209FFFF44CEAD8DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681246433, "uuid": "0af8625f-8906-4098-8301-93cd168f151e", "value": "3072:45vzQyBDzFEupkdVvFPg1PIZnviCnKtnorkJY30+zOTkkX2F8dA6FAv0zB39Rzsf:/yBD6zPg1PB/CE20B39RzsM796oYVfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681246433, "uuid": "f2648040-9f21-4b29-a38d-b088df22be79", "value": 233552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681246433, "uuid": "c9982210-f648-49c6-992e-ffb45b7dbad1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681246433, "uuid": "ff333a89-58d9-45f9-9da3-bd3720594e39", "value": "Kp_July.8(5679).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad0411e-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681205636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205636, "uuid": "b23e2fbb-c26f-40f3-97d9-ed3b6582584b", "comment": "Malware payload (Vidar)", "value": "0f05baf410acbdb5472a53529bf2000b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205636, "uuid": "da8e28f3-41e1-4eaf-953c-f670cf1f423a", "comment": "Malware payload (Vidar)", "value": "257f3227f28be3d46cbb43378f0c59bbbff01638b3935c704726ab7384e339cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205636, "uuid": "8e1c2254-1546-47ad-8a4d-091925a71a32", "comment": "Malware payload (Vidar)", "value": "109fe4c8b160e56cbdbcdb226b155013c2050b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205636, "uuid": "018b0dc0-1cc3-4250-bf78-8255fa127b9a", "comment": "Malware payload (Vidar)", "value": "af92c7d4adf235d23872d4087f193bfaeb96e64310c12a3fd271611d5b01f8104b6fe4607afb91d1969eaf63ee57a4af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205636, "uuid": "8b2fc367-4c95-4ab2-a4c8-1c3a05e4bf9d", "value": "T1A864F232B6B1C073C59F81340920DA606E7FB8A377B082972778536E1E207D19B6B75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205636, "uuid": "9720b466-507f-48a8-b8c4-bf71eca76332", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205636, "uuid": "f90bbcf6-0ca5-42e1-a9c9-5581177450ca", "value": "6144:pYisWyuxC0oU/CuV2npwuLRkMjIYBe0IgPYjafUfSgx2O:pYisexeUCPp1EYBe0IXasfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205636, "uuid": "f0e4192e-c327-43ef-9eff-3128e007664d", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205636, "uuid": "5a248b9d-918c-4672-a735-5560e01d69a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205636, "uuid": "3d922042-5b12-46e2-85a0-790f96a2ac41", "value": "0f05baf410acbdb5472a53529bf2000b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d2d63f-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240096, "uuid": "f4b40cea-4ad0-47b8-a598-de7b984ef13e", "comment": "Malware payload (Mirai)", "value": "9e7d462375acd2915bc9a6a69f16f745", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240096, "uuid": "ec4b681e-735e-4ab4-a2ca-f4d525810543", "comment": "Malware payload (Mirai)", "value": "291122390c1ca7a565b1dacd14f9d3dcd899dcf3af74016212bbfc05185c291b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240096, "uuid": "0d13ce49-0292-4ab6-84b2-59a12922e502", "comment": "Malware payload (Mirai)", "value": "491a1e90355813f4a7708b3099aa68ef47446056", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240096, "uuid": "58d493fd-c3d6-43a9-88c5-316e92313b85", "comment": "Malware payload (Mirai)", "value": "ba660a3b0aea00f01eaa24bcca086c6066c2d4a70ad89515a484933bff5ae0e59cadfcfd7da0573b899aa0b3b7e2b3d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240096, "uuid": "6119d426-3ffc-42ef-9b75-7c979d5f465a", "value": "T1C7632BC0F513D8F4DC2707702036FF366A76F1B92228FA47D3E699B3AC92602D542999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240096, "uuid": "76c8622f-76ec-4d62-ac37-17cdad9c4d31", "value": "1536:MhEEeC2WGT3Flj+bNWWiMXQQPPo7+WUJB4n0eqfHecYz1y+kf:MhKC2WGT3Flj+pWWiMgMXIn0JHryUff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240096, "uuid": "1be2aacb-a18b-47c1-a4c9-8786c2bebb0e", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240096, "uuid": "8a94a161-1e50-4ace-9bbd-762d8eac3021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240096, "uuid": "dd7fc216-6b06-473e-bfe1-618ac30ea066", "value": "9e7d462375acd2915bc9a6a69f16f745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b4f97e-d89d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240663, "uuid": "6908ff11-bd14-4d11-ab07-2464931b0447", "comment": "Malware payload (Mirai)", "value": "84b468f7efa5b1a137ccde1d251885a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240663, "uuid": "81eae7e5-e462-4a37-85cb-1225c99d9a86", "comment": "Malware payload (Mirai)", "value": "29268e751071465bbd825d4bdebc0570d6a6672c3a566dab43cbc69b4340076e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240663, "uuid": "491f0bc4-732f-49bf-aaef-48f291c35cc5", "comment": "Malware payload (Mirai)", "value": "5e6f593d838afd481f9f49e6561fc7de7e718274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240663, "uuid": "57d7def5-6117-40c8-86d9-0bd547362c7f", "comment": "Malware payload (Mirai)", "value": "062f4dd55460f47e9e715634fbcbc42a5193e351a154e1b5c366991031152a9d898043831e354af9e2c0f6c15e134b7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240663, "uuid": "3936fc1c-f896-4862-b831-710c8b84cb69", "value": "T15DE34B46FA418A13C0D51379B6AF428A3322A794A3DB73079D185FB43FC675F0E63A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240663, "uuid": "2a27a797-8ed5-4a9b-9448-71cbbecb4a26", "value": "3072:81NQqKuJkpLsEgOgtzk6lGDmYpvltCYqaWAaM/9yCg:81NQqKuJ4LsTXBk6lGDTZlBqaWtM/9Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240663, "uuid": "3ba2761f-c893-46ea-8cf0-c5b7565850e6", "value": 150661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240663, "uuid": "25015479-6ed8-4778-80b2-ce0fbecea45e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240663, "uuid": "3e5cf568-0f0f-4c70-923b-ac367cff09af", "value": "84b468f7efa5b1a137ccde1d251885a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a4c931-d8b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681250028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681250028, "uuid": "f9c708e0-e8a6-45aa-a7fa-3f8892ddb336", "comment": "Malware payload", "value": "6f62e2abb7558c83f2a4d3edefa05c7f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681250028, "uuid": "4116283e-1e24-47cf-944e-859a540a50f5", "comment": "Malware payload", "value": "294e2b9cea14bbbcb3fe59257dd99286d8fe75d5ed4d4629d56f1fd32702571b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681250028, "uuid": "43eb7dd8-4fb2-4b50-8c9b-147e94009b13", "comment": "Malware payload", "value": "3af927ca622068ecb4244afe132cfc1cacf5dd4f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681250028, "uuid": "f32ec830-693a-41af-960f-f300c776cd46", "comment": "Malware payload", "value": "a6d02846164bc7163ec9b1d47e9e31abd30e689c1291943d2f927e11212e232601a74a1aca30f457e91bea1e4c3fcc41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681250028, "uuid": "78309aeb-4286-400a-8543-97fc0eab3324", "value": "T1BF624B908BA8DA76CFBE0B714C3273000771CA857812FF6B99C4E06ABDA37D94595BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681250028, "uuid": "4aca7887-5d51-4179-9026-a9e8e9179647", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681250028, "uuid": "04b6809d-99b2-4111-83ce-8d6db3c55f5c", "value": "192:kjFXqBkc34OkXpQbRhyNZX+I+xCGOfiGbP4me1eQPns0xxpWPJfwU5aNE:kFqBb3gXKryN1+NF8iGb89/sIiVME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681250028, "uuid": "d7062955-318e-4e7a-bcdb-b71cde3ba456", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681250028, "uuid": "8b2906cf-e06f-4575-893a-b470a065ce20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681250028, "uuid": "33e8ebbf-59a3-417a-82c8-8a50e6f235a6", "value": "Fiber.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d904390-d800-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1681173079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173079, "uuid": "be301f9c-3aeb-4cc9-9c59-3cd946251a92", "comment": "Malware payload (CoinMiner)", "value": "6eaea6974cd276b74e4783fe75a98bb6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173079, "uuid": "d2ea542e-57ad-4c9e-a41c-be69c5a7bdb5", "comment": "Malware payload (CoinMiner)", "value": "29dfae95832708e0d7adae77c048b3537d402950a1460f2e589bf803889bc9e3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173079, "uuid": "5d44a44d-120d-4cae-9874-a7a8f24eec6d", "comment": "Malware payload (CoinMiner)", "value": "3587175eb64552fb8c76655d2c4b3ab9a83f7890", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173079, "uuid": "a12ba265-2664-4493-bbf1-499672d5855d", "comment": "Malware payload (CoinMiner)", "value": "1f70d6c41aee0fccf8726aad21ce9d468bf65d46a370abde332d7e370195dc3a5f3902212cc91a71ff635ebfc1384ebc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173079, "uuid": "5e465592-4ffa-463f-9590-48b41bc8bedd", "value": "T18954C06330809276D037C0F865FA86B199BC7879179450877BCC5FBA1A356F0ABB836D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173079, "uuid": "401981b7-eb3e-447f-8114-1f14dd7c6952", "value": "bde39906bf78343201f171548cac8e4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173079, "uuid": "b4b77b79-7acf-4131-8d12-290e57b3229b", "value": "6144:BBjjbn+rPoYJC/Gx8ub9yR2a9T7s2oQXRRKXFPMwSA:BBjbn+rzJC/88u5ba9kP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173079, "uuid": "20be7fc2-63f2-4583-9a48-810f004fe1a2", "value": 283560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173079, "uuid": "a099c27d-7897-4b1a-8fd2-3e4e812c7877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173079, "uuid": "2a74dcca-aaa4-4483-afef-a0b2412213be", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37f0206-d8a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242050, "uuid": "20e5dfe1-9f9e-4eaa-9378-cbbc3735e766", "comment": "Malware payload", "value": "f9484530eef5af91375b16ad1312dd29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242050, "uuid": "6aaad660-eb9f-47fc-8405-bbe2b269811d", "comment": "Malware payload", "value": "29e74d69dbe506f07c91cd245427379aebc67b1c24dafc2cd0bde49ed6fd5cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242050, "uuid": "5b08fbaa-06d6-451a-bc2e-39639fb709f0", "comment": "Malware payload", "value": "0bf165ea23cf50314f63efc6b1fe70dfc513fc9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242050, "uuid": "1f40ce10-4845-486a-a013-300ea7a59e4a", "comment": "Malware payload", "value": "b65c414efcd1cbe1274775b511cc3a53ffd7773c7832a66fd11f696e085c9f3e0761a3fd6827224a865f1211e3109de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242050, "uuid": "792d9232-3794-49c8-8bb1-94c2aa4f6e89", "value": "T17A6439045BF98A05F1BE9BBDC0B151608371B562A87BEB4F1EC4A0EA2E32350DD45F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242050, "uuid": "e8642f00-838b-40bc-89f0-f33a685d67a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242050, "uuid": "3d07eebc-b61d-438b-98ce-85b3be5f28be", "value": "6144:n+AC6MDdbICydeBWJaDNnqrMtt1KLIbldMWA1D0Usje:n+vzDNnqrqYd1Dkje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242050, "uuid": "7867e6ae-daf1-451c-a6bf-cbe3b8952c37", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242050, "uuid": "2d3e6c20-d5e8-42cd-a3b9-06517de73899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242050, "uuid": "b514c10d-4d7c-42ff-89f2-7c425cb92fb9", "value": "7zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488cceb4-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1681203618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203618, "uuid": "2f1e2f17-bc87-4de8-b96e-11615b54b06f", "comment": "Malware payload (AZORult)", "value": "13cbb50ab7baa55f69e537e17693105b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203618, "uuid": "84511b43-aac1-4ae8-b0bb-1e7fd86ce0fc", "comment": "Malware payload (AZORult)", "value": "2a65a7afa9a6340082fab362bcf95ddb3c18639069abca6f7b05e9dea9d00a22", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203618, "uuid": "9d8c1cd0-7c96-4d89-9ff8-d3e9189266a7", "comment": "Malware payload (AZORult)", "value": "9ab981e270944fafc2fca0e29579b6833fa9c17b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203618, "uuid": "3e4e6868-1942-4746-8532-9e2c8c013b8a", "comment": "Malware payload (AZORult)", "value": "ae48a4b48fa7590635f518314e6f2a939fabad97677e6993666da45806434a702be7ac8f101ffd17d60ff73c77fdc354", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203618, "uuid": "7b621fc9-519e-4ca7-8fae-6aa2e576bc8d", "value": "T1E2B5BF320386BED3C7FE4E7AE4B722150E54D8B76398C356F8C865AE19A57389D48C70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203618, "uuid": "d7d345db-a109-484b-9f21-09d5b6664d95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203618, "uuid": "8241c1ee-c3b8-470a-bdff-02739a8c0128", "value": "24576:kP2QIkaJcTdtNNAZ+iZ23d8h6vS8ToyL5zCmFiMtpCS4sj2NtELmMCnnPCYCT011:G2QIXJcxViiiJmfEbELnxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203618, "uuid": "97c8a097-4308-4e30-a63b-fe061035e925", "value": 2280448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203618, "uuid": "83d6042c-0008-4d26-832a-53dc3db8a6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203618, "uuid": "cd1f4e5b-8d13-4989-b125-95c604599c2f", "value": "Po Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afde7db-d863-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1681215675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215675, "uuid": "32b97d6c-98ce-4714-a7f0-fb0d9b9c5ebd", "comment": "Malware payload (EternityStealer)", "value": "a5550a3288df5de40aaa120f74effc52", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215675, "uuid": "e424f9da-b17c-49bf-8697-f95956242af3", "comment": "Malware payload (EternityStealer)", "value": "2b14b9728155381d588e6e960f4073b70ad8144aa74042b8c25a97211016e0ad", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215675, "uuid": "afc9623d-18e4-46a8-8292-b4a5f018b522", "comment": "Malware payload (EternityStealer)", "value": "f4671ae2b8f7d27c5dd2e9b9cee43852e7606625", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215675, "uuid": "46b9f34b-e79f-41ab-8976-c003a9d96739", "comment": "Malware payload (EternityStealer)", "value": "a83d549ae18b276436b7a181c44b3b1c8541bd9146bdfe0fd793e8ff6be231fc944781a3e7908932e062299667df8493", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215675, "uuid": "c64b374e-5f7a-400f-a969-3500a3899072", "value": "T10AA5012D1C4F4622E038E77586E18020B7ED9063371BFE6F98D265C54B52A82FDCD66E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215675, "uuid": "e053bb04-e716-424d-be63-cb2cdaabcfef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215675, "uuid": "d0352292-aadc-4454-ba3e-79907efd6009", "value": "49152:larBZdRvK10MNF6xuH5wxsuR1mC0zfcXt6PS8YsgyfsmSg:lGBXRM0MixGAsuPmC0zf8tSlgyfFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215675, "uuid": "74c8803f-8735-41d2-b0ab-edf259abdb52", "value": 2251776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215675, "uuid": "6557e4e9-2b4a-4fca-bd16-ffe68cf63280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215675, "uuid": "d2692f6c-8d1a-469c-a605-b45b2e5ad664", "value": "a5550a3288df5de40aaa120f74effc52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177b9bb2-d855-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681209549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209549, "uuid": "0b03891d-c504-4441-a06a-1c52a5c594c6", "comment": "Malware payload (Formbook)", "value": "a53c421182b205e300edc410e3a547a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209549, "uuid": "bfb76cf6-d52d-4eb8-ada6-c126e0e79f9f", "comment": "Malware payload (Formbook)", "value": "2c2cb78782d2957c4d20817778f7f163d0e76248f477d639ba2bcbac702c6c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209549, "uuid": "03afbbcf-f913-4945-abae-9bb8cd2be8bf", "comment": "Malware payload (Formbook)", "value": "6183c590aa4b34c3a5b553f4df1da5dbf00c8262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209549, "uuid": "1502cb61-a4f5-4f0e-a623-40f7d3c00b63", "comment": "Malware payload (Formbook)", "value": "18e72f3ed5e3d4051aa5ab2e883918e736925e002d18470119ce024ccae0a80338ed9bf60848eeeac54bec5d499037f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209549, "uuid": "ae2b70b7-b9db-48e6-9497-0268e91607ec", "value": "T16A45392439FA501AB173EFAA9FE475DADA6FB7733B0764191090038A4723A41DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209549, "uuid": "1b654324-3b74-48d2-98fa-c24de68d2707", "value": "12288:xfIwj1T/lMeHVainxlMbCqq1pAY82p+SRvyaqMeN8HgPYaE0Qcz3s9Y33iYLgEOQ:xfVj1N1DTucEh++yoe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209549, "uuid": "a540f1cf-28a6-4313-931a-fc4d969cdbd3", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209549, "uuid": "278457f0-77a1-4e61-aa67-dfe55a2a5321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209549, "uuid": "d9bb583d-22e5-432c-a609-3f1b1ce9dee8", "value": "KRP PO IONE-SK-IN-PO-0117 #22091403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6612f9-d889-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681231947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231947, "uuid": "5efa7fbd-4bfc-47c3-ad6b-6b9e96cf07cd", "comment": "Malware payload (Quakbot)", "value": "d936ede6784b5fe33158f962b85584f4", "object_relation": "md5", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231947, "uuid": "1207a24f-32ed-4ecd-b0ca-1b159d4747f6", "comment": "Malware payload (Quakbot)", "value": "2cca326763f1bdcf3ff3934e842f695c6f5c72020b9bf4e3c879bc18906f941a", "object_relation": "sha256", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231947, "uuid": "d90d3d03-7264-4660-b6d8-a781f3e266f5", "comment": "Malware payload (Quakbot)", "value": "79e23de0a29beebe17ccd3c3bc3f2a1c70b30336", "object_relation": "sha1", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231947, "uuid": "7951723a-d1d6-4ddb-8b46-ab1a174833e0", "comment": "Malware payload (Quakbot)", "value": "32ea9d36c1c8bc98d1fccf553ec5e922699aa044637b9a24b8715db0a1f937937292162ed7d9726bff7da6d0a4f33b2a", "object_relation": "sha3-384", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231947, "uuid": "cd0dcda2-a734-48de-86d6-0cc9ba8ec4b5", "value": "T11A14F8709A41403D2677672E9A195810C5384613C6990147FDFEA289FFBF488FAACDFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231947, "uuid": "d400dbc3-62e7-449f-a662-c425a817863e", "value": "3072:poFPMC0vODkFGFzLEh9/CVAhEQS9NJ16jphVg90EiryuATYrNOMmB:poFfN9LaENJ1ezK0EirgTYr4MmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231947, "uuid": "3846820b-7225-4e84-81d9-1d78429965e4", "value": 202285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231947, "uuid": "6619a727-50ff-4ee2-97e6-8e9065a77326", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231947, "uuid": "aa501225-e011-4e26-aaa1-6a304b39152a", "value": "UX_November.25(92159).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b422206-d82c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681191973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191973, "uuid": "c1beea62-8ff9-44c6-bd4b-c39632ae1a93", "comment": "Malware payload (AgentTesla)", "value": "96df0500a78574f0279d2fd08cb7c3ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191973, "uuid": "0f3a056d-8dac-45d3-84ca-7e940848c023", "comment": "Malware payload (AgentTesla)", "value": "2cdc0eea75b89d04c084921cdd5ddd756a26928b87aa91029470200326f7ed1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191973, "uuid": "aaea44f9-f74c-40a1-8db4-cb9067a4eb64", "comment": "Malware payload (AgentTesla)", "value": "4c5dcd2c7bb3d59548d57ea70897a2a5dd42a029", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191973, "uuid": "6f280dfa-ee85-483a-80f2-94c4ded6bb98", "comment": "Malware payload (AgentTesla)", "value": "0429defb7888494a0f73cf3ead7427970f4e8b8876f6096c16d4ffee8cd3fff97f0d9b8b35c2885e4b8372ed7e1c9cce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191973, "uuid": "6beb6fd4-89c0-4195-b30c-cdfefcecfd44", "value": "T1D855F1ECBA316922D82DA7F924431E8372BB9C452157C27B2944F3EA1D77603A9153CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191973, "uuid": "47cefefe-51e9-4bb6-b6ce-30d022a80c5a", "value": "12288:YHX6w0JxmukRONBqC+HB4ou3YKQRjrrpGXSQPLXWHej6fOQqH72w:YKwqxLpBqC+2ogzQF6Ja+j6W1Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681191973, "uuid": "d4e6da51-b366-4b40-ada2-d2d27216b553", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681191973, "uuid": "3e43fc53-eec4-480a-ae3d-97b81cbf243c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191973, "uuid": "16c96324-cc07-4e09-80fc-517c2ff70577", "value": "Quotation-934834388.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d309bde-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681205371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205371, "uuid": "7b18fa5f-78b5-423a-b0de-5f48c8c895f8", "comment": "Malware payload (Smoke Loader)", "value": "d21540fcd4d61c4dcbcd304f30584dd0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205371, "uuid": "86baff6c-fc6d-497a-876b-3029fcabbd10", "comment": "Malware payload (Smoke Loader)", "value": "2d9810de8d2043c225d93e85872d73ebbad7084a313d5b0f756354c300cef480", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205371, "uuid": "d1339a24-b97f-4045-bab3-f64855b5eb0c", "comment": "Malware payload (Smoke Loader)", "value": "0b3027d5558d2146366e2b612df9cf2d56fc6849", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205371, "uuid": "29f5b58c-d0d1-43ea-ade3-f1bbb425f52e", "comment": "Malware payload (Smoke Loader)", "value": "96a577dfa287e712085c77fc61605facc960bedc4b67095fdd9079acbaf28dab14fcdcb5dac590c70da67278cccd5b73", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205371, "uuid": "6762c700-b5a6-4cbd-a514-d16b05bc8dfd", "value": "T15214D0327AB1D073D49F42771420EAA47A7FBB685765865B339807FE1E307D0462A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205371, "uuid": "1f8ff0c0-a73d-4d8e-b9f3-cabbda9f2944", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205371, "uuid": "d4f1ff5b-c050-43a2-abe1-e942affb4369", "value": "3072:zWcTuAyOP1mMqYf7b5SnwFHEcvGdg/fRNPmd+v//eM:CyFPa9nwFEcO+xvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205371, "uuid": "2a5653fe-8b83-4886-85df-6173df5a8059", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205371, "uuid": "a920db0b-e13d-4a40-9470-6e6cb0af4d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205371, "uuid": "52049456-75c2-4ca6-8194-51c95d875acf", "value": "d21540fcd4d61c4dcbcd304f30584dd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb79057e-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239057, "uuid": "83852822-7308-40e6-a3d7-8909a5b04584", "comment": "Malware payload", "value": "4f3ff8bda700796c9128ed3112f65b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239057, "uuid": "bafa3634-5c4a-482c-8d56-bf5697c80562", "comment": "Malware payload", "value": "2e0382c0be98eb69839bbd50a9c7e446fd61c59796eec745ef23a8b461cd0a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239057, "uuid": "0dd67cd2-5786-4990-a549-701491c4d35d", "comment": "Malware payload", "value": "f303ea8a92a078c69a9f41f322b1fb1537007145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239057, "uuid": "529eed28-ac6e-4303-9788-622d0dc22d71", "comment": "Malware payload", "value": "0dcdc4f4e87bbfffcbcfbe7331b6d4b8ce7891ec336bba40373ba20f6a3935bdc60267afaf31d96e52d820ca3dab6be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239057, "uuid": "6a773588-c6ee-485e-bcc0-fc5e8ece5eab", "value": "T18BC65B03F99190F4C5EED230CA269262BA707888473433D73F619AB62F66BD45FB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239057, "uuid": "327c4699-d65e-4689-8733-6a624ac98866", "value": "49152:CUEcvUn6G0CVKfxODrb/T/vO90d7HjmAFd4A64nsfJZYVR5M7PjipoYCn6QJnbRw:7O788MspgH0iog1beoDiqTxE6/4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239057, "uuid": "58ccdef1-ff62-4b86-b4ab-9b565d9411ac", "value": 12192310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239057, "uuid": "767d7a03-114f-4a66-a244-576ca4d81e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239057, "uuid": "9e8b4b3d-e3a7-4465-be59-b692c606a2a1", "value": "4f3ff8bda700796c9128ed3112f65b1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78771df4-d8af-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681248367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681248367, "uuid": "6f44278d-64de-4eb8-a51d-0a856711df1b", "comment": "Malware payload (AgentTesla)", "value": "ad2d51577fa6754447ed5f5f5e6c19ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681248367, "uuid": "646e7b2d-83f7-4621-ba67-e40915d39383", "comment": "Malware payload (AgentTesla)", "value": "2e586ca0465bc9ea67899118a6256b25c9603e45d416c2fe9b6e6c9f30b6375a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681248367, "uuid": "f4ddda27-8cf9-41e3-b9e3-1e6f147c72ee", "comment": "Malware payload (AgentTesla)", "value": "d3f31a470a7a07f4682da496ca2b5452199a37cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681248367, "uuid": "46de2d8e-c5df-4410-8d07-5407d86bbc0f", "comment": "Malware payload (AgentTesla)", "value": "eb483590aaaa73b339d57c49a1137f046ac544e4c51393ca1e45da4e865bd7320d1e9aede0d179cff95590f8c08ff6c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681248367, "uuid": "d3acffdd-ffc6-46fd-bce2-7d7291f31d6e", "value": "T128D47C2D2C8F4266E178EBB19BE18024F3ED8453771BBD6F98C225C44B12982F9CD56D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681248367, "uuid": "49ddfad4-e86b-4dc9-9258-7263262070be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681248367, "uuid": "1c458416-73b1-4b7c-bbec-7c0c6c265112", "value": "12288:ycI0pW48+hNknKT7GJejOtysczjLdhys//HzrgML3OEfKvajdC8QinkfliadEIP3:e617GJrYvXLdhys3TrgMrOEff5C8Qikx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681248367, "uuid": "5f067020-2ea6-4cc0-988c-38b17837171a", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681248367, "uuid": "34ad660f-f13c-4694-8eba-90f1add9b3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681248367, "uuid": "df508ed8-ff7c-4434-af3a-a8ea707e4209", "value": "ANTEK-763652827033730UI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab68e6aa-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681221823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221823, "uuid": "31251657-1c2c-4b21-8895-5e05ef8b58b5", "comment": "Malware payload", "value": "7fe4c1b2687c7da95e50f318b8099b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221823, "uuid": "9e74c960-cd7a-468a-ba2c-b792a3395d40", "comment": "Malware payload", "value": "2ec755cfa5eda31d8971afb5426c64199d895314bf60fa780659bbf3beb9000d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221823, "uuid": "baec3b92-4717-4ef1-926f-436ccbba0bf3", "comment": "Malware payload", "value": "e3444407569192b9630e528629524d12b16fc040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221823, "uuid": "3a06fde7-a6ee-4c74-848e-550f3423cd4a", "comment": "Malware payload", "value": "fb25b41eee01ed9bcfd863368db178f3bb9f60f981174b6a7fb05984129c576c12dc8d6da6d50c41c2aea811774caf8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221823, "uuid": "03947836-69e3-45bd-bc52-eff61e8712f7", "value": "T10316230CA8D6C3FCC813153E852384AEB56E35E335E9B96C33C459426AB0E7DACDA355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221823, "uuid": "78da1e01-81de-4bd8-a398-b432d435a89b", "value": "6759e4028b9f8d1e0b32ee5a70a280d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221823, "uuid": "0a8f0c6e-951b-4a89-9e50-8fa7feccbe1e", "value": "98304:yJ+0s9sQJ908KEpnaOkv274KlgRDwWb4R5K37vaBjuFZaAi:9Iv8K6r7LmD3MqTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221823, "uuid": "c95bca7c-f5cf-4dcd-b689-5b3f5a2300d0", "value": 4062720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221823, "uuid": "4226c43f-0f8b-4ee9-aba3-581b23db6036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221823, "uuid": "2d760565-12f2-4aeb-8902-5bd50b633f15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24fe010-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681231821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231821, "uuid": "dba25388-7a98-4e27-b530-01e36ca68716", "comment": "Malware payload (Formbook)", "value": "a5789058c2b3d41b07b6a6f723600def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231821, "uuid": "ccf341e5-f652-4d64-a5e8-5dbc5a65eb11", "comment": "Malware payload (Formbook)", "value": "2f196c9bfd2bd38aa8769110bafa33e8e35a22c7ce8f6a98c056cdac11a5fc8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231821, "uuid": "3c9aa3db-4991-42a6-a900-9fcb012d50eb", "comment": "Malware payload (Formbook)", "value": "1c8021861a7dec3ed7be15d526f0830367d87c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231821, "uuid": "21c779df-b512-4b82-81db-3eb46aab671d", "comment": "Malware payload (Formbook)", "value": "a44cbeb0e930337dc2280c34a13e99230a205fa8b8afaf401b4e304c9277d3d19cecc49c4560969eb4cdd18818925795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231821, "uuid": "e7a1c46e-f86e-4991-a8ea-48eab7476653", "value": "T123740210BB68D4A7D8A21531DD79C5FA6AA2BE17D858628B33D07F4F7A32520CD0D723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231821, "uuid": "c78ca8c4-7b82-4bc5-bf53-64b889dc3035", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231821, "uuid": "c80cee94-9697-43a9-88a8-e55a3a320108", "value": "6144:xYa6W/7lUzDXMcU9THldhoMBoSphsUOwaEG/IcS+MBmxb:xY8xUzoJRHThy0laEGwcjMB0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231821, "uuid": "1db6a8d2-c5d1-4398-85be-c895d7fa45ee", "value": 341756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231821, "uuid": "abfdcadd-cb29-4218-9df6-c8dbc1f18689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231821, "uuid": "ef69cf05-01f8-4465-9cdd-662eb0845f7b", "value": "29302000039_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78155ee9-d85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681211859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211859, "uuid": "9b39a9e5-fce0-4038-b921-a45eb3c33494", "comment": "Malware payload (Quakbot)", "value": "193040d22f9ff64c2f14d9ca2f24e898", "object_relation": "md5", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211859, "uuid": "74ffc060-9915-4d26-af0e-c3bbcb35c0b4", "comment": "Malware payload (Quakbot)", "value": "30d7a69c729c8ee1c6559a51772450140cbe776a38d474d170caceae8b81894b", "object_relation": "sha256", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211859, "uuid": "c801c5df-e3e5-4555-a911-9cbce4635501", "comment": "Malware payload (Quakbot)", "value": "4940deaa30e35f0a34120b9b500edfeaf4afc6dc", "object_relation": "sha1", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211859, "uuid": "0d7e3445-2c81-4132-b459-82c39f6e7734", "comment": "Malware payload (Quakbot)", "value": "df6f107babbba95ca3167f3affb5a286ae8badb70b730e1dd07f8bb36774e57ce6e46f734745de95b0f466fd2c19ec79", "object_relation": "sha3-384", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211859, "uuid": "84835f50-0fc5-4cfb-962c-5339ab44e600", "value": "T164043A70AE0111212B277F2B96349C64DE2A5612D7410187F57EB144FFEE26CCAACEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211859, "uuid": "17e1ea32-29ae-427d-b1d2-2c1711a15a9c", "value": "3072:WgBiZL3kM6jH9EEw2WKZ5NbrD1T1NELi155AAUElPUS1kijnIyaaUC:BipUModEJ0ZvDAiTRZCS1LDyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681211859, "uuid": "0f74de70-1198-4554-938e-d78942266622", "value": 177373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681211859, "uuid": "ed053171-920c-414b-b78e-6b7d4b367caf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211859, "uuid": "96ba9ae6-4178-499e-a874-966cab5c6a8d", "value": "Sqrorw.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d9f75e-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681208877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208877, "uuid": "4701fde5-0b5a-4554-89a1-23a662c3977d", "comment": "Malware payload (AveMariaRAT)", "value": "d4d16161204b98e803d6c9fd05ba3e0c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208877, "uuid": "7170753c-b0bc-4ac1-8ee9-25828aa1c7a3", "comment": "Malware payload (AveMariaRAT)", "value": "326745ba0eb9019ac4d6cf06cb5667b3237fe185b096aff60d44f19ebd794340", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208877, "uuid": "f52f0b6d-d4b8-4035-9775-9fbd2be8c91a", "comment": "Malware payload (AveMariaRAT)", "value": "349eabf8a48c8557a3c08e03c0daae557335db34", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208877, "uuid": "cfe403c3-f96f-44be-84a2-ac44a4233029", "comment": "Malware payload (AveMariaRAT)", "value": "8c214c825be7e49ebc0a8d84a3b1dbf744de2f505bb9859cd01d0f4ab2b197d0432b963e22831d33a59bbc87d1f948f2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208877, "uuid": "dc22a70d-3bf9-429d-b121-e4c6d1779603", "value": "T15535393439FA501AB273EFA68BE4759ADA6FB7733B07A45D1051038A0723A81DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208877, "uuid": "cc8eed69-5216-4692-8cf1-44d29196cc7b", "value": "12288:1rA62fKzJ5qbpfEFsAIID4iyZX48qu202JybvgnPGxy9B+YOvpKNbMb1KSIE4Ali:1rA62fdj48f2JyboG3VZI+v9Z28q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208877, "uuid": "a395353c-00a9-4721-bb6c-ff85487c66e4", "value": 1067304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208877, "uuid": "d8fff2d8-2fa3-4e71-b5dd-bd4867d559a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208877, "uuid": "1a3dd868-aeed-445a-9c60-0ca6b5d61802", "value": "INQUIRY SAMPLES 20231104.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415e29a7-d889-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681231953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231953, "uuid": "23f73a11-f5f2-4ebf-be33-7d5de63bcf2b", "comment": "Malware payload (Quakbot)", "value": "b9f72ffa35f0e8a959ea9d037320ee48", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231953, "uuid": "6dc31bf6-61b6-4ab3-8f61-06d4412f5840", "comment": "Malware payload (Quakbot)", "value": "33eac34b75b28c73c3bf2234c05b51a71d4c5652407a1ee2f8d9ec1134dfe4b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231953, "uuid": "c9df6884-1afd-48d9-9cb8-9efa6a41dd00", "comment": "Malware payload (Quakbot)", "value": "b6b6ba0e6c4870694ca688cc126268a2a1c4db4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231953, "uuid": "8c8ef747-7579-4354-815a-f0e1df39b171", "comment": "Malware payload (Quakbot)", "value": "a4899b3e7a77e9206c34723e881212ed123472938032fefd67fe4228a83ce303e60c8fc61d3f2f7048087585f416336f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231953, "uuid": "cb3a2088-f2fa-4a60-b118-69805cd9c29f", "value": "T1BFC48D72756741F2E41356B22097EFFF4234A9268874A57FE698DE42FB732B03619203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231953, "uuid": "7cd3a131-8b8d-4e40-a7d2-2c9db16c150d", "value": "6863f3efdf3665c7c292b3dfdffa5eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231953, "uuid": "f0d3ac10-0396-428b-a487-58912e9c377e", "value": "12288:t1YEpoSVWkaD25m+RTLQwx7Y+g3D7exbnbq5cuzVtTVV:t1xp374mLbx7jg3fobnbkzVtT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231953, "uuid": "d3e9a98d-b69c-463d-8fc1-123adba484a3", "value": 577723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231953, "uuid": "beed7db0-c6c4-4477-9e14-b7eee7f134f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231953, "uuid": "8ba4514e-1800-425f-8ab3-813a8f51faaf", "value": "7sGFdRFCkgQ.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423afb61-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240115, "uuid": "b57945ec-86bc-4ea7-90b7-e77c6070d887", "comment": "Malware payload (Mirai)", "value": "48010abea943e1916ee34ccdb57ea337", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240115, "uuid": "6775812f-342f-4929-9ce2-8190d81d3566", "comment": "Malware payload (Mirai)", "value": "3471fe3f5700f0472655a1c2bc23c8182aad97cd9c628e490204a3989a34c812", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240115, "uuid": "730235d8-d85a-4bd7-beb3-63de6bfae110", "comment": "Malware payload (Mirai)", "value": "e62a43ef5260b05badc6005fc710fa4c69652a23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240115, "uuid": "92e817b6-4669-4383-a116-fd11042eb8fd", "comment": "Malware payload (Mirai)", "value": "b76cb8bd8533860d7ee62e2bb5280f3fed8821ee05d636c0405739c7307675491cb3510e54b664a810b514ef3e14cacf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240115, "uuid": "64fe76a8-e5ad-463b-9fb6-c47cd2669fc8", "value": "T1D763D781BC819A26C6E423BAA6BE598E332173E9D2CFB117CD214B2076D551F0D73F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240115, "uuid": "27fa1878-e152-4e8b-a168-ece4d68a7dbc", "value": "1536:iSl247Ls3BbcpVzgd8T9uG5YvdSnzefS+jGD:iSl3/s3GLze5qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240115, "uuid": "5e75b51f-3a4e-4153-9705-705ef0800d39", "value": 68220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240115, "uuid": "691e0107-d6ce-42dd-81b7-19616ab69fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240115, "uuid": "1defada6-fea4-41e0-871a-dc6023976ed6", "value": "48010abea943e1916ee34ccdb57ea337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7a5d80-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1681239137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239137, "uuid": "4816ffa3-253d-4f7f-8ddb-ba9ee5003472", "comment": "Malware payload (Vjw0rm)", "value": "511ba3ec38b7b845f1b7406686a30d0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239137, "uuid": "e220574f-b07f-4991-bdff-da004ce0067b", "comment": "Malware payload (Vjw0rm)", "value": "348ad8d4b2ad2379dafa00853c8c9069b438f7121f31475ec6b0ecdca8636353", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239137, "uuid": "3845aec1-216e-4781-8090-9b008af9d193", "comment": "Malware payload (Vjw0rm)", "value": "e9a6d7f6dba313a8cf19809d78bb2a4a3ae14056", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239137, "uuid": "fed2674a-748b-49ec-a77c-86df34b1ea06", "comment": "Malware payload (Vjw0rm)", "value": "831156aa1ef4570c1506c626499e8b17edf656a47eb308a5da73affd31384d7c99952d6df983b0779293eb717a353d93", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239137, "uuid": "408f4a4e-47db-4948-aee2-a0b123b55130", "value": "T1E725258475F42E2DE7D7D42DC312EBA39070322B2D736E44BE85DB0D8D79D98A9B8421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239137, "uuid": "ad048a2a-b3b6-484c-a7af-c40422c95e2a", "value": "3072:MQOYUQuE6HMWYiKuVVDGnCpsFpx0iu0cKUQbStdj7:MQOwuE6FYinVVDGnCpKpx0XeStdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239137, "uuid": "fef9f0a7-2485-4b64-9dc2-d60fee51d542", "value": 1056384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239137, "uuid": "f0442303-60b6-43d3-8b12-939623142fca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239137, "uuid": "1de5f11d-c888-415f-96d7-41ec93193697", "value": "Tax Returns of R48,765.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86525ad-d870-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681221415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221415, "uuid": "135b9396-6c53-4308-84a8-04c52a916321", "comment": "Malware payload (RemcosRAT)", "value": "27d4407beeb273caf373f236785ce4d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221415, "uuid": "fba90931-5d9f-4a5a-a478-5d19a4f98220", "comment": "Malware payload (RemcosRAT)", "value": "3547af76cc6e0a31226c990caa5620f64cfdc6d0d32243f709d532ee7e48d877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221415, "uuid": "de16a719-0b46-4698-a2f0-4873db48deba", "comment": "Malware payload (RemcosRAT)", "value": "a53db206f5a3e799469ee3e7e3d2d5ca2b7a03d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221415, "uuid": "4cfe6ff1-719c-4ffc-b083-02fd58b04e96", "comment": "Malware payload (RemcosRAT)", "value": "6a04f5da7b79ed20e7cf98fe3aeb2020612169f591880e09fe622f5d104927c5812179883de9d453d1fedd798bdee47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221415, "uuid": "6bd78f25-3d84-4e7b-94a1-4d848663acaa", "value": "T15074E0D4BB21827BD863D773CAF24E1919BA2C36B1C0195A466837F83413EF1A51778B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221415, "uuid": "5fbb7993-c8e2-4a18-ae83-6969ef6a015d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221415, "uuid": "b885420c-f758-4f16-bcb8-73685eb8cf19", "value": "6144:vRlWoKEPgXCiSs0sndk13ZWWVWJ49eVl0Mp6227OvzQsFG:55SSv0S14WVWW4VyMEOUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221415, "uuid": "0afffd5f-8533-4f7d-90dc-44930f32026d", "value": 363328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221415, "uuid": "2f15e291-4f56-43ce-b2af-cc10271808eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221415, "uuid": "2c878317-cf25-4baa-bf9b-25ddbd6a2433", "value": "Primarily.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0553e504-d836-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681196204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196204, "uuid": "f7530020-f3e1-4139-bd61-b8079f99d3b9", "comment": "Malware payload (RemcosRAT)", "value": "7a22c075e6bb86f3a537fd592925d0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196204, "uuid": "43e46ea0-4d9b-40bc-a14f-584441398c9f", "comment": "Malware payload (RemcosRAT)", "value": "37503c7646071d22653b6be7fdb8ec8d9abbfe8cbfca39650255c131b01f4fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196204, "uuid": "4afd5c21-1088-4ed6-a645-c05722277ba8", "comment": "Malware payload (RemcosRAT)", "value": "657dde8c6b11a14aa398481768079f3286e37360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196204, "uuid": "03e6f64d-7364-4c79-ae4e-877ceda835fe", "comment": "Malware payload (RemcosRAT)", "value": "5b6e18a25f1f457c58e57a2198059a92c7ca2338d35d42801369f89af75cfac9295801662b8ef54bb494624fe9238f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196204, "uuid": "55b9ef82-0add-4daa-950d-ac2c3115188f", "value": "T131E4AF17A2F08833E12717388C569269983D7F112E247A496FD43F7C8B7D661B82729F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196204, "uuid": "5cb2a60a-b335-4109-9b65-8c95ee33de9b", "value": "442d7ad4d476407400b17c9caa66accb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196204, "uuid": "45b2222b-cdf4-42b2-bbe4-4d4eaf5e4a1d", "value": "12288:KD+aLrg9LSA91a6XQYOg5f46XzsOpj2pMFr0sbOTWE:Ki08wU1a6Xv1B4oKMEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196204, "uuid": "66f95655-34c3-4a9a-81cb-e141587520c1", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196204, "uuid": "de942134-83a1-4b46-8ffa-57681f58ebec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196204, "uuid": "bda17ddc-895d-4571-8185-77c2020e809d", "value": "91489557012035DraftBLFmKNNBRecd07Apr23CFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ba343b-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681215126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215126, "uuid": "5dc76be3-2169-483f-977b-d04d60ba381b", "comment": "Malware payload (AgentTesla)", "value": "7792a1badb077a49592329467545e8b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215126, "uuid": "ac45d64a-1fd0-4c5a-a051-77243403b803", "comment": "Malware payload (AgentTesla)", "value": "3767034cddc1a47d2ca81f77f185af6a8228d6864c822f2e1e46672260ecbef2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215126, "uuid": "02647521-ba3d-4ab6-99bf-582a0f505883", "comment": "Malware payload (AgentTesla)", "value": "25738a329b27ec26971a775185b0068747ca137f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215126, "uuid": "6206cc57-e4b7-4259-a35e-5e1c2803cd06", "comment": "Malware payload (AgentTesla)", "value": "1b2a4e5f44d592f65b5add1a2bcbed3995d7f3bf1d1a81bee02ecc2c4c520a82c16a24aea8cddd7d4acdc75c4b3a1334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215126, "uuid": "11c25c1a-e8d1-4667-8173-5d6186fc2f5c", "value": "T17AC4011E62B5DF51E4880FB444A42C41277CA296F171EE5D8CD723E38AB3F56204A7EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215126, "uuid": "49a70e35-bdf3-43f2-a609-b98b4c5b9fac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215126, "uuid": "660da222-e77b-4e1e-be63-8808e6b33f46", "value": "12288:DEd4VcXa/n/MiRZAJdQMTH61YaGoDz0HuiqsMMDglfwMHhrJN:zcXliR6QAH+YaGoDsqGDFQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215126, "uuid": "b6d4bd04-291d-4b0d-accd-d0be5eb178b0", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215126, "uuid": "4eaa91f9-4949-4195-a256-4e4dfd5fe526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215126, "uuid": "95d27d7a-4322-492c-9d35-5f18926f6885", "value": "7792a1badb077a49592329467545e8b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc51158-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681194928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194928, "uuid": "25f4c6a4-a630-426d-adca-932ef782749c", "comment": "Malware payload (Rhadamanthys)", "value": "2d586407289689717a64a9618c5b1816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194928, "uuid": "54d9bb75-23d2-4f37-b9ca-6b1c8e111443", "comment": "Malware payload (Rhadamanthys)", "value": "3778411ff33576685f13f163cac7b3452ea7bdce7caa92924ff5194d4b5d0785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194928, "uuid": "fe847d8c-7b2b-453e-a5c9-f7a83dfac337", "comment": "Malware payload (Rhadamanthys)", "value": "a1202c00c23f40d1ad419bb710b6a8b49062f52f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194928, "uuid": "e6a335dd-284b-407d-9f36-1133fd371f5b", "comment": "Malware payload (Rhadamanthys)", "value": "72751a9a4312b9b6266c43236b4b0be6bfc8f4627c0f70bfd64c0015d5dea238c0d0e8779d9dc2e5770134a03b910fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194928, "uuid": "ec4302ed-90f8-4fc7-be39-949722194bf9", "value": "T141E4129A77399967C6BF06F98032540933736C266E02CBCA6DC5796EDDF37108406A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194928, "uuid": "5a06360f-ffc1-4e79-9980-3f44f3b5329d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194928, "uuid": "68e1860f-2048-431a-9a9f-1f7513626685", "value": "12288:mPtzLwrFy9kbv0j3psD8Hf53D+J4gMJK4uPEoLv1kYrXM9Y:tZKkT0j3i8l+J4gQK4uMYv1FsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681194928, "uuid": "3a5e8f40-3f2a-409e-8085-1c163cb4b166", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681194928, "uuid": "69a4567c-e4d2-4fb2-84f1-ce77efad039c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194928, "uuid": "d56b81e2-ea79-46d1-80c5-4a824d56790f", "value": "PO34730937398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f890bd-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195273, "uuid": "1434f5af-6d28-4944-9d41-c2ec1f325c92", "comment": "Malware payload (AgentTesla)", "value": "1038cc3d42ddaafc0ce600959582b139", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195273, "uuid": "f7520258-d401-4727-9f95-80229427f647", "comment": "Malware payload (AgentTesla)", "value": "37eda95e8e4f33010283becccc7313f454f1c34e28f30999f3ec643f73b68d4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195273, "uuid": "1038ebe3-881b-429e-9e8a-ebf96b93ff03", "comment": "Malware payload (AgentTesla)", "value": "6604aa43a408f5e02f093fa93dddda9f9c795a5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195273, "uuid": "dd4f1450-2f8a-4716-b583-2fd77032aa9b", "comment": "Malware payload (AgentTesla)", "value": "47bc4b13136da812f2dc3ee733e5c78736fa4d07ec7243a71a52ff8fd1e76724dcf7b328b8c56c907961b950f3e58ede", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195273, "uuid": "e565fc83-912a-410d-8cd2-11b1fc397622", "value": "T12585383439EAA019B1B3EFA69EE4B4D79A6FB7733B06645E1051038A4713E81DDC143E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195273, "uuid": "92606c2a-3e75-4648-975e-3ca946278eec", "value": "24576:DRLfkllsVrYhIVvttottLRRRRWGyYz16C:RGlihtttottqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195273, "uuid": "9a8bfe08-833b-4dd9-990f-a51a2b58cc29", "value": 1785752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195273, "uuid": "69b68b6e-dee5-4006-bc87-60309c8cec0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195273, "uuid": "6d46f36e-0ddd-43c5-9547-a0f924b6a2ea", "value": "RFQ_305310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb760b0-d874-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681223117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223117, "uuid": "02c77410-c0d5-485b-b504-a241e250832f", "comment": "Malware payload (RedLineStealer)", "value": "640ef63496d99e5fb1ba2cbbc6d3a82d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223117, "uuid": "551540a2-bce1-44fa-90e8-85a577c89754", "comment": "Malware payload (RedLineStealer)", "value": "3a89259017144981e29057fd5878c8738b83d5907b6c232e135caf641f6bf1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223117, "uuid": "deaf9bfc-ba68-45ca-bc3b-dc6fb57a5630", "comment": "Malware payload (RedLineStealer)", "value": "6f02fda1f5e20d49553f91f189a10c0ad76f341a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223117, "uuid": "cd0986ff-03bb-40a3-abf8-3c6b2b90162f", "comment": "Malware payload (RedLineStealer)", "value": "18cbfb2a82f4a12ecc56d77c8df4ced56d09ed2d50defe6ca56e78a8838dd5f18459aa2a20f6bcdf0941b4e6ae97eb94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223117, "uuid": "a1b40f8f-c580-49c7-a7fa-d37939db14eb", "value": "T179352302BAD58633E8A15B7059FB52A70934BCA2683586773706D04E4D73998EDB333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223117, "uuid": "353c1945-d13f-47f2-88c4-d99eeb67d3a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223117, "uuid": "4eb10955-5f60-4846-bff2-cbdac2615705", "value": "24576:yydKPVk7S0+0Bfans/R/6FCK6EYs96ubzL2EhUyan+P41xs:Zob0+ysWZV1ubzphUyg+PGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681223117, "uuid": "756c14f1-2946-4bb0-950a-55dd684bde70", "value": 1154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681223117, "uuid": "cf72d630-202d-48a3-87b0-0e234629d73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223117, "uuid": "22435452-b0c7-4f06-9488-2552924cd6aa", "value": "3a89259017144981e29057fd5878c8738b83d5907b6c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf199c6-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681239115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239115, "uuid": "c74d288b-6a93-4e45-9fe7-b720c86944b9", "comment": "Malware payload (AgentTesla)", "value": "fa7596a3fa51f89185372498d8336e96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239115, "uuid": "9b16724c-7794-4fd3-b870-d14423e1a7b9", "comment": "Malware payload (AgentTesla)", "value": "3b43d428f7ec121f4c0f33a1ccd521cac197729c9e169d1eb2f4c6f7383ad031", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239115, "uuid": "87476ea2-8b33-462e-9529-561fa9811b29", "comment": "Malware payload (AgentTesla)", "value": "1e22c8100fc4fad4470f49a3d96081552bcec1ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239115, "uuid": "a0aaefaa-96fb-4c2e-a2a4-4dab33df2c6b", "comment": "Malware payload (AgentTesla)", "value": "5ac67a3badba9b9de0c1fde5082e934d6d9d156ee8443c3a98fe6b90b09f7bbf17e525669f4febe4ff62f9f83a004f6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239115, "uuid": "c34be661-f530-463d-af21-7c8ef418a811", "value": "T159052272B21E8B55DD1997F1E8A39016079CE75B2273EAC73E5C40890F233E90799B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239115, "uuid": "dce9764d-ee80-4a07-bc29-a4e8773ff663", "value": "24576:RxoFGeAwbcK1Wr2jwWQOYCgQGzM8zgx8VhKbnQ:RSF/3bcK1eAwW4CiMr6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239115, "uuid": "fdda1914-7a8e-4cfe-9cc2-ffa23b06ddb3", "value": 807144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239115, "uuid": "a7e74d12-6da3-4017-9368-bd72d84c9f07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239115, "uuid": "ae3446ef-8975-4eca-a651-66c8ef6c40c7", "value": "44090014546_20221209_00071716.HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f615c35d-d828-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681190595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190595, "uuid": "0d886523-4f0e-4399-9846-ca34a4113b00", "comment": "Malware payload (Smoke Loader)", "value": "24a1c74e38c8189bca515c51d5d53948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190595, "uuid": "179ac730-188a-4c5e-bd3e-69cfc13d937b", "comment": "Malware payload (Smoke Loader)", "value": "3b7e53587f37c46e763b81e682bc3c88b3ec53a41814ff8f73a7970168a3c7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190595, "uuid": "2717da83-66c5-4eb0-9e2d-0a2311e69dfa", "comment": "Malware payload (Smoke Loader)", "value": "8955d3fb7f6d987f0e7b5c405a89a914ba1f6b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190595, "uuid": "fb12b23d-f65a-4df9-a300-bb40dcfa03cd", "comment": "Malware payload (Smoke Loader)", "value": "312f991e92b02272b42852949a9495dda611c1f67f6d56fc2fa61e63552f77e4cea42739341b40774d9a7efbbe537832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190595, "uuid": "a2fe6e60-bb7f-439e-8a71-c2d8f5575b06", "value": "T19814D121BBE2C073E11B05B54468DAE07A7EBC2193358A9B73A457AF1F307D08B29357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190595, "uuid": "a5c1871d-051c-47a4-89c9-f45132685cb5", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190595, "uuid": "0d6ea572-6a89-42cb-b79f-fe93fba8afa1", "value": "3072:33D3i4COmljHlIHdDahYCjKerLy/CFO1FZ5ZfAmu:HjVm54VCfiTZ5aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681190595, "uuid": "cefd7389-2040-4b46-b9cf-3560586c2f9b", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681190595, "uuid": "359f1937-f3db-4689-9597-e10f1eff0372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190595, "uuid": "40dad55f-d7dc-4fba-8702-f08129930564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2653ea-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681208936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208936, "uuid": "f8ad937b-b280-40b4-9f96-dc44d98eb720", "comment": "Malware payload (AgentTesla)", "value": "daae473a86558f7227ed7c7f8db4b962", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208936, "uuid": "14185d90-31c3-4565-9d8e-02a659eb1738", "comment": "Malware payload (AgentTesla)", "value": "3c25fa2e61f0267ebf1a1b49846abb806ea365bd4a205bfaf635035cef58d135", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208936, "uuid": "7f33c155-a29a-4f37-8826-3eb4f5a3ab78", "comment": "Malware payload (AgentTesla)", "value": "55312ca7214ccd7da801a32e69ef405adcfc1d80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208936, "uuid": "141ce638-561d-47e7-b4b6-23ec964c1643", "comment": "Malware payload (AgentTesla)", "value": "80c4fb30b802446a68befe587e0df6e581beaffa3eba6a6ea41dd64ad931af6dc5e275655d06fc742feac75842c083f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208936, "uuid": "9149522e-59aa-4033-b380-3072bab10f08", "value": "T112B5D0326AC2BED6C7BE59B4F88333500DBCDCA7AB1DC359B9C8165514A7718AD84CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208936, "uuid": "c5588d84-e2d3-4c3c-9959-72d22cc3b1ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208936, "uuid": "21322e8f-a1e7-4373-9a04-088ce2f3e375", "value": "24576:9Pnef1alZ8fZmRUfV6BLS2URUcm8f2AhJ1KpMYcsl0FgpIzqaDLGlPa7//tRXdPt:9Pef1l2cmMLm2uuRNo9qdMmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208936, "uuid": "59c8b338-db64-4461-b45e-0f87b27c5d2b", "value": 2340864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208936, "uuid": "29608f8c-a79d-4508-ae42-302bb901f9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208936, "uuid": "cbe2f8f0-cab2-4949-bb01-48fcb22dde9a", "value": "RFQ no. 235-22-QN22110077\u00b7pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1793d89-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681239067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239067, "uuid": "518fdb58-7160-4f55-931d-b852866437c2", "comment": "Malware payload (Smoke Loader)", "value": "913552a288f8ba2a6cea037e0a099aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239067, "uuid": "8db99cf6-db83-4510-bb41-5c6c85c57ebd", "comment": "Malware payload (Smoke Loader)", "value": "3c9519d11e7a987995d21c0f20ae2d9e0505c68639060868cc2e2f0608124118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239067, "uuid": "c54694aa-95bd-4abd-82c3-535925bfcd01", "comment": "Malware payload (Smoke Loader)", "value": "2b7a87dc8b1aac108d6f7f5e7eb0a7f76f6dd85b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239067, "uuid": "89e9cb32-0392-4698-89f0-2185c08dc60a", "comment": "Malware payload (Smoke Loader)", "value": "d6a26e75f3ceb7f017fce1321b78423744938f0b3c369bc2572bd6a35416fd4abb07d66540c3f8d43d3ce1fa5affdefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239067, "uuid": "a4bea069-05a6-4084-b2d3-4738dd125b7d", "value": "T15814C0317AE0C0B3D56B41710571EE706B7EBC729761C68F33A867AE1E302914B7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239067, "uuid": "4911d1fa-1d11-4e39-a209-038e22058a98", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239067, "uuid": "bd4b4197-6a03-4cd2-bcc5-e1ec07c5eabe", "value": "3072:DYch866OZY2RV3Izq4ePOcyNXZ/5Avya0ufRoJBFF:8gdZHV3IRelCp/+vh0Yob7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239067, "uuid": "848c0072-e24b-4ebb-9fef-39e0d07309da", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239067, "uuid": "2d7b6ed2-bfd4-4812-aa42-206e4b912726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239067, "uuid": "15d502fd-8192-41bf-8aa4-399d5c28519d", "value": "913552a288f8ba2a6cea037e0a099aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2427e7-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681240155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240155, "uuid": "df2185b9-09d9-47a2-b55f-9749e72a9c85", "comment": "Malware payload", "value": "9dbae196e71be5ff14c8d6982d8063ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240155, "uuid": "4ebd4543-114e-4685-a748-9835c6c949ce", "comment": "Malware payload", "value": "3cf30ccc1557b27d163fad806babc5938559d1f2937f0ff96f453141285c0841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240155, "uuid": "2ef7ee2e-ff1d-4153-b437-03a2acf1c454", "comment": "Malware payload", "value": "d84c0b9fa24c036503c093ae1442168a208e5eef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240155, "uuid": "7f37035f-3380-478e-8ded-dc05be1dfae6", "comment": "Malware payload", "value": "1407c3402095c049eb13e075053a72ba4a186bab0a096e06b2cb93b3dc000bcb0ef9d0fe30cbd4a05c84b7dd28262dbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240155, "uuid": "b38389c3-0f1c-420f-8af5-3fdd3c76f968", "value": "T102252382FBDC8033DCBB27B029F70393163A7D6A8C746B576B86595D193166078307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240155, "uuid": "cf4f87b3-b70b-4a7a-90c3-f0f0b445fab0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240155, "uuid": "60af98e5-08ed-4dea-9636-35a8a9e1c85f", "value": "24576:EyDZCvE7WPdUPKs3nmz+WGP4BA1i/w2cKb:T1CvEWPKSj+xTgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240155, "uuid": "8d5d2ca2-14f8-468e-816a-ffa3d6b59dfd", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240155, "uuid": "dc0c6774-54dc-4df6-9b54-deeb7536e0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240155, "uuid": "eeb8c3f2-a168-4ae6-af5f-f8fbaf672457", "value": "9dbae196e71be5ff14c8d6982d8063ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511a7100-d865-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681216518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216518, "uuid": "ad3b7a6e-9d9d-4d39-8669-350afe21bcf4", "comment": "Malware payload (Amadey)", "value": "5f9b56e7e3eb12e5b4787b1d229e8353", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216518, "uuid": "d67abb3d-5466-43c1-a97c-64d092098e75", "comment": "Malware payload (Amadey)", "value": "3d9b40a5f8d752b2029908197f8b5a0fcacbd43e01f50bfaa5576261af4e743c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216518, "uuid": "492cefe2-ad6e-43a8-85d2-896378845981", "comment": "Malware payload (Amadey)", "value": "fb6b1024b6ac416fd2f2c1308f880d18215e5eef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216518, "uuid": "3cf80ef6-7760-4124-8f0a-83317d4b600b", "comment": "Malware payload (Amadey)", "value": "bdb51c644aaa2fb38a81121874bedf3bf6901712a29762d73d023b5d5fb3cd64d4373448f9b8efaa0960e6de145f9297", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216518, "uuid": "64c1e671-9d0a-4c95-8501-e476289b9c7f", "value": "T1D3F41212EAE49033DDB2437159FA02870E35BC625DB9435B17C6AC6E0D32BC4A67636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216518, "uuid": "9b94a28d-8f60-4370-af00-f2ad45b2e07f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216518, "uuid": "b06e5096-48fb-4793-a4e5-e15905f864d5", "value": "12288:HMrPy90ogB6r860o6AElda7tVL9+zsvAP/7fMxdIwjcNoW34vstymXKKLSqP/Aa:8yh186VZZPL9Y4OfsdFjoH3/QmXKeSqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681216518, "uuid": "5ef74b32-0912-449d-9761-93dd1a75de63", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681216518, "uuid": "beb187e0-3136-4c6c-b129-6cac813658c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216518, "uuid": "af46f2d0-98b9-4d7d-baba-081ce50173b3", "value": "5f9b56e7e3eb12e5b4787b1d229e8353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed559855-d837-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681197023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197023, "uuid": "e7ffa947-d449-4616-97e7-a47369d60b55", "comment": "Malware payload (AgentTesla)", "value": "6912d3a6aea42af1d132d1164a80e22a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197023, "uuid": "ace9ec7f-1afb-42d8-bdc5-d79adcf4047f", "comment": "Malware payload (AgentTesla)", "value": "3ed4210e705d48d9dc598caf26cdaa6c94148d2159d28ede66c51af52daae77a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197023, "uuid": "30a308a8-e5cf-462a-b95e-c372daa20cf9", "comment": "Malware payload (AgentTesla)", "value": "59db492914ec5318f6529f29048ce0e968ecf06a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681197023, "uuid": "8a3a3463-ad00-4ca8-88c6-bdc98a195db1", "comment": "Malware payload (AgentTesla)", "value": "3912175d0008226499fbc8740c9e09efab6aecf3a8b81266626a2fe67921aae25838ee3387208a54374b80e811ecf1b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197023, "uuid": "f8fd3de5-a145-4fe2-9b6d-f3e8656e0940", "value": "T18A0106198B7AF080C18AF196A30444DB69E681BFD5C3711FB4E0489663F8AEC193C2B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197023, "uuid": "69a2dc34-702d-4bd1-ad40-6597843acc0a", "value": "24:BDU9DUkOLkMGdgGWoCJcRgirDMDB7D1WDXxloDuDkD6/rDU7:BDU9DUkckMerCw3rDMDB7D1WDX0DuDk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681197023, "uuid": "f4b9d399-77d3-443a-abda-c9931620d1ac", "value": 846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681197023, "uuid": "12d85588-4c5a-4940-80e8-6ee9b5612171", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681197023, "uuid": "22e65db9-cb62-41e6-a14b-0ab9ffc61a08", "value": "Facturas Pagadas al Vencimiento.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdc4f61-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231702, "uuid": "022785fd-605a-4789-9a8f-d0e50bc09c2a", "comment": "Malware payload (Mirai)", "value": "866a8db1b82dba8fe5eda0d4ce8d9398", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231702, "uuid": "34d51058-b651-4b04-b2f5-9f2803f9853b", "comment": "Malware payload (Mirai)", "value": "3f8992810e5d0cfe168f76e10d7414e932c79f3351d679ed83af29b826769215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231702, "uuid": "f80ec32e-a733-470a-be19-0372f3895f48", "comment": "Malware payload (Mirai)", "value": "edbaf4ac9843dbe4529ab28df4ba1b3660e3622a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231702, "uuid": "9804d969-3857-4682-92f8-1ba03dade13f", "comment": "Malware payload (Mirai)", "value": "3093b7928a60992b7a4d8ad315a0fbcf34dfb6d3540fb927c71bd52bdb7247e0a9ff1720fb30334af6f84d456514bdb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231702, "uuid": "1204fd44-0123-44b6-8c1a-165b004d0fd1", "value": "T19AC2F1699228C032F1745536FDAF0503A776CEF8CAAF363622144735E487D22D6B4B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231702, "uuid": "f8b61274-9bb1-4f9c-82ee-438064fd8935", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plN4rhymdGUX:byNUQUfhQllxlaH0MFjlOnGs0s3Uozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231702, "uuid": "e192613a-d709-4ec7-8ac3-05410a7fdaf7", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231702, "uuid": "55d0cc67-f11e-4138-ae51-83531a143f8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231702, "uuid": "e3c8ee00-4e24-4691-a5e1-28cfdf52dd12", "value": "866a8db1b82dba8fe5eda0d4ce8d9398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b7f838-d8a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242569, "uuid": "5db74811-a4e7-472b-b7a6-151844f028ea", "comment": "Malware payload", "value": "482f1fc089c81d8c03498c39dd01792c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242569, "uuid": "252c8538-5eea-4bf7-8d63-c709247bc801", "comment": "Malware payload", "value": "3f91550c1c6253da76c8167540a793d32351586197a361d3c4590a19d0bc9b0d", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242569, "uuid": "325c5acf-1d95-446d-8387-ba272293cf26", "comment": "Malware payload", "value": "d487303a46c4aac5ae531508eb578c1799222241", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242569, "uuid": "a30a432d-60b0-475d-977b-d0fb49bf9b8f", "comment": "Malware payload", "value": "1c7237dbc3cb4d9342b245b4f37353ee47943a6f4f947e61c9821d00a7dcc782503a711ee3d0aa496a14ed8c706a3a72", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242569, "uuid": "3d61fe0a-b1a0-4b0d-a63a-db9f5bdef137", "value": "T1F763F1218646594CF4D3AB0BE231799DD42C3023EACD21E174354A437C62A5ABF56AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242569, "uuid": "426bf765-de5a-4a2c-8084-866bdf64ca93", "value": "1536:n/yZKHMYbooMhtBxoMZBSp4Z4oR9PCsT10/3pN:n/yMs2ooMhtRZADoDp6/3pN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242569, "uuid": "70ff8499-939b-45dc-849b-367600b70a77", "value": 67813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242569, "uuid": "18587e45-e8d6-43ec-a14c-128b91757343", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242569, "uuid": "1abfee77-0048-47ba-8ada-a7c0406a71d4", "value": "UM-March.6(2634).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b6b6ea-d824-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681188816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188816, "uuid": "f0403d06-793b-44c7-b7ef-3103f475f810", "comment": "Malware payload (Formbook)", "value": "30a0fea5d5bbd50ec74273d50b87f973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188816, "uuid": "cb4a008c-257b-4d67-b99b-fea4de6732da", "comment": "Malware payload (Formbook)", "value": "3ff8da989c0463e0eca88964ea38876e1b9e1e3dfe7cbab96297feadff54713b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188816, "uuid": "3accafe2-2727-401e-b486-654b26a3a92c", "comment": "Malware payload (Formbook)", "value": "dad77adf617f58164646ef4c2b1ca2cb304eb906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188816, "uuid": "1882f61f-0ec7-4c80-a9b3-db694c019e74", "comment": "Malware payload (Formbook)", "value": "2750efa2486329be6e9e47c388053e1282ecc8e0e5aa88dd609bee92bd22495e29f726ab729c5196d1bcd54d2a85cd23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188816, "uuid": "5b7c68b0-ed7a-4935-b6a6-4797b97540ea", "value": "T1EAF46B520C6642D5C8BA0FA854783A485B799C938FD4903E7C82797FCFFAB4B54893D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188816, "uuid": "91e1a4db-f13f-46de-9d78-970ae262ce91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188816, "uuid": "52f57e98-28c5-40a0-95fa-89123b253bfd", "value": "12288:yEdW2iNWx01eukUUqYMbRicgiw9HHsaTP7/8m9Y2MqphsX6uVD:/W1A0aU8MbOvHsa//r9Pphs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681188816, "uuid": "85e461ee-f1aa-42a3-9d70-6c82fc0af598", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681188816, "uuid": "371c5539-4a02-4157-9a04-739507ede082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188816, "uuid": "e6e035c8-2cc4-489a-9bbd-b3079f5d6ac4", "value": "Request for Proposal (RFQ) LA62023087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157202f9-d855-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681209546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209546, "uuid": "bf16d320-ff7f-4997-8b9b-a9cefed1d587", "comment": "Malware payload (AgentTesla)", "value": "f667743cb02952cd7585ec920a12b614", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209546, "uuid": "cfbbc443-e2f8-4d29-91dc-d562d79052d6", "comment": "Malware payload (AgentTesla)", "value": "407f54957a33129d654047de0169d1c2111313bc5ac796b1ae38f6620eee2780", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209546, "uuid": "361796ad-f162-40a8-beac-71fdef40bfd9", "comment": "Malware payload (AgentTesla)", "value": "c41e5a27de665784842bfc3082c528b67c83192e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209546, "uuid": "edf39a6c-dcf9-40a5-988a-dfbb62a767d9", "comment": "Malware payload (AgentTesla)", "value": "b921ea08f7a199a3d21f989995e455f8d45bc42501e3b2ed095de95face019c3a2a5f1b3df110d4106a0ab88e009f12c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209546, "uuid": "74a0ed3f-a57d-4557-b9d5-768d2c06f5ac", "value": "T1ABD49C23F5DC96D5E0AD0478EC29F3AEB521AC1148318E963EA1F8096A3574724F7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209546, "uuid": "53420e39-80c1-4491-b2cc-7ffa8f378b95", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209546, "uuid": "bb4d5d67-3df9-4066-a9c4-903d80161c75", "value": "6144:0Ya6HrwKSeNI0eD5/BVtvVk7UgwtFP8YKJTrDg/F9eg:0YZNILDzvVcUg0FPDWDg//T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209546, "uuid": "72d07fdd-2fcd-4efd-a371-ad36150d2549", "value": 641132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209546, "uuid": "487dca8f-7b9e-4004-8173-b02274a8b3d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209546, "uuid": "a5665cae-ae2a-4efb-a137-c7a68e9b9f14", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41478596-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242690, "uuid": "f025626c-ee2a-4ade-9017-725f2efad44f", "comment": "Malware payload", "value": "eec291d32909f3fe6c0ab1ab59e8a855", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242690, "uuid": "d74f7dc8-59c4-4b16-b394-2240dff1179e", "comment": "Malware payload", "value": "40df81d314927c5ef781f107812b0fdfc616b7130f6ba1c8808d8f77dd48fcca", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242690, "uuid": "719f91c2-5370-4e35-bd00-8cac79348bb6", "comment": "Malware payload", "value": "f76ccf71c1edcd43f89b5eaede73c7443efe7278", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242690, "uuid": "773f2e58-ec4e-4eb0-b39c-7db51ee0a12c", "comment": "Malware payload", "value": "ec3ca95d3efcd9fc7ea8caad0aec3508b2b37aa002bed08136f15179de53f1c8f1c7b655258f0fec2aabf9518143a2ee", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242690, "uuid": "ee5d878c-bf6d-46e6-81ff-2ae5e5410f60", "value": "T10163E1E6CA5C5C6CD8E3C355B13A35ED816CB032CEEE619670B12F5438E48059BA2D7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242690, "uuid": "c3fb9591-eae8-4057-a6a2-a2593e25b1ce", "value": "1536:bT+4gUMkvInxl94SQAMlTE93FCsV8BMuety5J:barHITEpFpVI3ety5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242690, "uuid": "5bb84a7b-2cd2-4066-ab03-e19e675c23b8", "value": 67935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242690, "uuid": "89279aaf-e849-4633-b8ef-f15a32b91dbf", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242690, "uuid": "23c5c359-7475-4647-a1c0-ca0e92b494dd", "value": "Cb-August.22(93).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf926a5e-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681214126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214126, "uuid": "a350d3c2-d17f-4fe9-9488-c79f8487f29d", "comment": "Malware payload (GCleaner)", "value": "dc14233281f6c0306264fbbf945b0fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214126, "uuid": "5c437ee7-5c5b-4277-9fca-791179fe6cf0", "comment": "Malware payload (GCleaner)", "value": "4271f1ac4b48e05e4724832b7a1d19fa9423d93c3eb995f6a6b4ad0d0eda7af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214126, "uuid": "4b790776-eeb9-47d1-aa51-a7f3df99b667", "comment": "Malware payload (GCleaner)", "value": "8dceb07853678dc09a257285ebfb89c261a83702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214126, "uuid": "c352ebd5-1e05-44a6-918a-697a07dc3fef", "comment": "Malware payload (GCleaner)", "value": "83622430cee5ee709ea06cdffbee5c4e2460597dcbe180f6d12a85c12dd0ad614e10f96f93d53a8fb1b57eb26d457e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214126, "uuid": "ae1625b5-ffa3-446e-b8a7-1a048e8047d0", "value": "T1F7E5330106A654F3C5624A393F4BDFA4429EBD6D78309590B8EF35BA9F3768BC0DC621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214126, "uuid": "20da9963-7fe2-444f-8c4b-bdb84551ed53", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214126, "uuid": "208c73ce-620c-45ba-8fe7-769c85516b98", "value": "98304:qrMyiMbTaRCawrzaBtNVRzt4YWRz+YgWSt:9A9a5z+vRzQWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214126, "uuid": "b70f1e9c-3de9-499d-8141-98cad4a26a6d", "value": 3155238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214126, "uuid": "437f4158-236f-4a8c-9018-96d6dd39a307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214126, "uuid": "77aeaa53-4e66-40d5-8e01-47330531e9c3", "value": "dc14233281f6c0306264fbbf945b0fdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a9dd4b-d84c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681205649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205649, "uuid": "63ddcfdb-5dab-4fc6-8471-a938bbf0fef7", "comment": "Malware payload (Formbook)", "value": "2819516d8a8e7f8e0b9d188a6d5cb44a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205649, "uuid": "92255a53-3902-4f61-a76b-b7a3dd796908", "comment": "Malware payload (Formbook)", "value": "42f025f744bb97509425ac749ada6c20ef6439d193e537a013b981ad4d21e124", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205649, "uuid": "5ccecd28-cd16-439a-86ae-d23383b318bb", "comment": "Malware payload (Formbook)", "value": "8fff79d4dcc22321b7e67afea5169d92d08a2ff9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205649, "uuid": "7dcacb1d-1e27-435f-849b-1669a92d7c80", "comment": "Malware payload (Formbook)", "value": "c69294e96daacc311c73d64080dbd39ce6e1ecf1f83188c92d59b69b82ad088bb86977c493d1207460eee94139b7ab86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205649, "uuid": "7a467f5c-42fa-4207-9785-4eeba8b815b2", "value": "T18CD4012D3BB28F21D51C47B91040054163B4A18ABAE1D72FEF93A3C6AEB7B425D493D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205649, "uuid": "7b7c8717-35b4-43c1-88de-d20ce77d5c08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205649, "uuid": "1357ef45-7668-4597-b047-3afcdf2a88da", "value": "12288:FrIX6XeBNCUHrJVXDorlxxnnpY8kf0qbqIhUdkuoMZbyu7FlcyldbzhQq4:F7XqCUrzoBxxnpY8/qb3ZMZbD7zcyTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205649, "uuid": "b77b273a-5fdc-4089-8727-d55c22cdfc09", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205649, "uuid": "f6209b6d-2a9f-4ec1-8e7f-9a95be32bbce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205649, "uuid": "f51a8bf6-4d3e-4667-9544-0e4bcaef1c0f", "value": "2819516d8a8e7f8e0b9d188a6d5cb44a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e700d5-d86d-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1681220119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220119, "uuid": "74897092-a879-424f-83ab-873b6d2dac70", "comment": "Malware payload (STRRAT)", "value": "4871f9a6c35a9103e0cc7b0763706c5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220119, "uuid": "72bec9b8-7675-41fb-8bc9-c1624282c396", "comment": "Malware payload (STRRAT)", "value": "4379e36bd5a2ac62378610e3c338e3bc1eb55a6e06e5fb39409941e4204938a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220119, "uuid": "38c40ba2-da25-4a0f-a36d-0094c7190266", "comment": "Malware payload (STRRAT)", "value": "5227594b4e1e100bc2b81d6641bef5009461bcdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220119, "uuid": "6fd19046-c56f-4b15-bedd-c4d838629faf", "comment": "Malware payload (STRRAT)", "value": "c88530f8b1d086e4026fee0e27ab3512e7a1354b6143e58f4f633ced176a919f74b17e95da80abbd45768acae61da9dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220119, "uuid": "8bc50c97-a050-4c75-aa8c-f6521353db64", "value": "T105749C0897C62F37CE781175F4FA035A42A4976A90C87F7A25523FCE6A93648323FD49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220119, "uuid": "d1f2c1b4-952b-460b-804e-39e7b088e6a3", "value": "6144:MQPNk4y98TwDuT3AvAkq1WlP5CEeS1VhfA9o3gXA3ofG7bOm:XPNpymTwiDf14deS1LfAVBfyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681220119, "uuid": "fb3430c1-b8c9-4780-ba9a-6b2420c6e834", "value": 347790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681220119, "uuid": "c5a38167-5aa8-472a-99f3-7a577f5afdae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220119, "uuid": "e6aca29e-69e0-42f6-877a-10677ca1243e", "value": "ZANTY PO. JY20230405.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365d134b-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215184, "uuid": "082def2b-361f-442c-b33c-a828069578ee", "comment": "Malware payload", "value": "7961db72beb4532999a8df214aa861db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215184, "uuid": "0911471a-c032-4f7e-9c37-5b82cad7b29b", "comment": "Malware payload", "value": "43cc835a3d3e16bbfc70994c4842c86318699005ad8de42fa5cb436c5ffdaf20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215184, "uuid": "b3fdd661-f631-4cbf-a49a-82d9b2a1cd5e", "comment": "Malware payload", "value": "71bbcbdbd7bb6810e5d30e56df6308d7a49e3200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215184, "uuid": "a60a86f7-0b41-4ea6-a3ef-7ad64d122aa5", "comment": "Malware payload", "value": "6e86895c7afdc3cf675716d7b67f9e6d987c1263937f924c5079792affc97b0e3e964a048872b2b58fd0afd7c59be5b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215184, "uuid": "5b1008a9-1667-4ad2-96f0-17875db1f04f", "value": "T172765CE613D66994D2BB2E36A0B532054F65EC238B5DFB1B3088A0FB1E65F116D12733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215184, "uuid": "cb3426a1-092a-469b-8a3c-3b2334166ff0", "value": "49152:A1H4VI6/UGwPVGv8i5aU0Bc21/K2Xd8nGozc30kaZt3DJIHo1fmHp+d2Zcxb2W7F:TD8GwVAn29XbozcEX7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215184, "uuid": "8c8de507-8050-4d59-9a8f-e7277577ae50", "value": 7318839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215184, "uuid": "11234881-d1c9-4e7e-9568-d6e17f436696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215184, "uuid": "54cf32d2-a5e4-4e04-b85d-01db0d0e6f1a", "value": "7961db72beb4532999a8df214aa861db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91623997-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218773, "uuid": "64cb8327-8d03-48dd-b690-ffa54fe37e23", "comment": "Malware payload (SnakeKeylogger)", "value": "6e1473042fe16e2bc644c6f78610b802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218773, "uuid": "93efee44-1206-4956-a631-555308c2d845", "comment": "Malware payload (SnakeKeylogger)", "value": "44287432a3d063068dd3119d3a89398a44c14ec36411636595d5b1e01dd7d1cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218773, "uuid": "50f1b48b-2490-4099-a75e-9073d0e10385", "comment": "Malware payload (SnakeKeylogger)", "value": "cb9f7357d8edc9787425840d90ac17b27d35c00d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218773, "uuid": "57f2ec6b-33a2-42ba-acc3-185b916e1474", "comment": "Malware payload (SnakeKeylogger)", "value": "647e148d5aab079f8d9411ae5adc482be8b846f671786a2ae788cfa203a344423b12ce28aa32354b5cc8ced0a0843319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218773, "uuid": "acc557bb-b671-4a57-bc07-ccf0a0d3f16e", "value": "T153C4F0DDDAB1DBA2E0590BF0C04C58441778A156A361ED988DDA13EB8672F6ED0C83F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218773, "uuid": "fbbf61d6-a69d-44b0-8295-f08281aef12e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218773, "uuid": "26f6ca10-1bf2-49cd-ae1a-217313d582e8", "value": "12288:w5AyYFenCjDaTh3do37pqwd3sIZUM0kgpyx:kDnCjiNapCIZFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218773, "uuid": "9b274dd7-5932-4481-a3d4-b9ded5ca6c47", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218773, "uuid": "7b57f3d8-18d6-4002-b925-9389a679bcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218773, "uuid": "3f086731-06fe-462d-8170-e98299ca5e1e", "value": "SyZJctWTToOCTeX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee6dfc1-d8ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681253021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681253021, "uuid": "0e409118-b583-4596-a805-6e29e26f749f", "comment": "Malware payload", "value": "7aae870b3d36a75ffaaa993ffefc24e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681253021, "uuid": "4634f67e-0894-451c-a3ed-1d43c104f4a0", "comment": "Malware payload", "value": "44848d787f773479019035c93ef3791d20d163c840a67655663d02111b392aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681253021, "uuid": "1cb23d5c-0ada-4062-9718-691bcbf92c26", "comment": "Malware payload", "value": "0864f74dcd6712b95d7f744c70ef15b1e5f019b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681253021, "uuid": "202c3b26-7a05-4b6e-b893-e8729964af94", "comment": "Malware payload", "value": "ec44bb045fa74fee9241e025f25df70353ecc6005c2a87d4b302b7c296c9e5f14cfeb84c4c9d466e104e31d064f76054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681253021, "uuid": "31df2973-9f4a-4927-b701-6dafd1eae6e4", "value": "T15C052392A670EE60D2E240B077909D699B6D3E257BFD807270F4B8248FF07C8547C96E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681253021, "uuid": "63030dcf-c6e5-486e-b6c7-0d51ec38c157", "value": "f4a2dc409ce44da3465d00b2745676e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681253021, "uuid": "414360e8-5471-4613-89f1-d0c9344788b5", "value": "12288:8ihzIYnerNITYUF0BPbrmQNpglLtODCGbBPN1g15YpCok9t9hGSDdz0k7:8Mneh+abrVpglJ8/a5YpCBH5DdJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681253021, "uuid": "67e6a668-0ac3-4206-8acb-b2e48da4163f", "value": 797440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681253021, "uuid": "e56525c9-7233-401a-aff6-61d9257fb1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681253021, "uuid": "9c806528-8a11-47d5-97fd-0f22a279b445", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02598e5f-d854-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681209084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209084, "uuid": "5d453f1f-baa5-4b62-89c0-75f049d6e80b", "comment": "Malware payload (AsyncRAT)", "value": "88f560e2bceb0f539d0e3a678ef07463", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209084, "uuid": "6833b035-ce69-479f-a1df-59bdb872fc96", "comment": "Malware payload (AsyncRAT)", "value": "46299f04f527e845b9c0c8ce5666c708bd8e4db7e3aaa3eb909f8decbb30df9d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209084, "uuid": "d2814cd1-e9ca-4c23-9fc5-879b3df28e43", "comment": "Malware payload (AsyncRAT)", "value": "d99a803f4c3fb4da94e165a340c93e560b11696c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209084, "uuid": "183f876a-6d85-4035-beeb-f7d072dc8023", "comment": "Malware payload (AsyncRAT)", "value": "46f89cfbe32028f9e6babe338d36eb4cae79ffb02297761d15dabbb1fb30a548187e0fee426f0eefee4efe8ddd10ae65", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209084, "uuid": "cd8c355d-bd1d-477f-bcb2-639337636fce", "value": "T1EC414B145EE62320E7B6CB39B8BAF30185763C2AEA16CF9D0180858C1825615E5B5F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209084, "uuid": "d340f15a-6b36-4091-98d2-8b41842829a9", "value": "24:8ztnHYVKVWRJe/CWRHiyoPE+PuEFrWVkj9ufClzH4o0Clurab6:8xHaRyQE+PuEFaVkj99lzYoTlMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209084, "uuid": "2f018330-637d-49ce-8cf9-244667c0d3a2", "value": 2282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209084, "uuid": "5ea0623b-366e-4666-9bd7-071a4b5b992a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209084, "uuid": "9d643c6d-10ee-4f72-99ee-a25a34f6c225", "value": "Odeme102023.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c19094-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681214106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214106, "uuid": "ab5d79d2-e5d7-4897-9ec4-78f2c77c4d25", "comment": "Malware payload (Loki)", "value": "b775af08e2aea70ada9d55ea66627fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214106, "uuid": "49cf6ce3-8008-48e9-9b0a-7e06d592065a", "comment": "Malware payload (Loki)", "value": "4669e3e29315d6c6a58e7911bb6776ce27ee9619261829b4f6c7d7c2d1c991aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214106, "uuid": "15ea148d-91bd-4e81-8099-4ba7606d66a0", "comment": "Malware payload (Loki)", "value": "4bd6c27588be4d18884c2362849a6b2d1eaec0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214106, "uuid": "d526e4ee-f3c7-4c3e-8c02-f2cfaf14c9a9", "comment": "Malware payload (Loki)", "value": "cedcf8856275aedad02bfafb3c273185aa51a72054feba31d1c80c89c8aee0d0afea4fb85dcf2beb74c4f282548f9b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214106, "uuid": "e09ab616-217c-455c-8a02-ea52ee6081ac", "value": "T1861402103BA4C8AFE073467019795327BFEDB92B18BC970B27602E9C7D467429A1D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214106, "uuid": "6e3396a2-01c8-4e37-aaed-d2c9ac01de38", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214106, "uuid": "ed6ba50e-4e5c-413b-a8e8-5bebef0f6336", "value": "3072:XfY/TU9fE9PEtuMb3wBCS3x1esP9G89XBIvgTeGzSZ0s7mlD3xglxtuyNs2RGUj:PYa6w3wBCqx1emCvgTZ2ZuD3xg5Zs9Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214106, "uuid": "056c4b55-e8f4-4ea7-978b-cc410ffdf5cf", "value": 204276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214106, "uuid": "d0c0042b-b501-4d2a-a008-a475cd85c977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214106, "uuid": "d42efb49-61b9-4c5a-a8ae-03ee22398912", "value": "b775af08e2aea70ada9d55ea66627fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e5b02b-d856-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1681210218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210218, "uuid": "54219dbf-bc86-4f56-a16a-98c2126b4898", "comment": "Malware payload (N-W0rm)", "value": "a2907061ca015b7f7fecaefc0ba99122", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210218, "uuid": "374be1cf-f3c6-4dda-a623-b538fc2554f9", "comment": "Malware payload (N-W0rm)", "value": "4781c5d0e619760ec4f21defbf5fe348767517d2452a0e48a47ac275562b5330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210218, "uuid": "ad7b6860-cf99-4a1a-8633-d3a1d4c79e50", "comment": "Malware payload (N-W0rm)", "value": "8401bf8fcff276e4816c85901b18e129d438a357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210218, "uuid": "6d4946b8-53e6-4213-a6ba-e281f66d7aca", "comment": "Malware payload (N-W0rm)", "value": "aa27306f7458409cea268b3bf70586ef5530e8f9a1fcbe16ae5e0e35ca01aef659923effbb2846eed74c07de3abd2a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210218, "uuid": "4b2da45f-3fc5-4be8-84fd-b64ca490036e", "value": "T128541B23F648D631D8EEF0B946F1949A869FDA355F4461CF16AE22F7C804210A5FC26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210218, "uuid": "f6ca25a3-ee84-4e47-a4fd-f040841b103f", "value": "f206bceae653170f260a5a8caa10e809", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210218, "uuid": "2d1c8270-a5d7-4d65-a9e4-7b8ad093812f", "value": "6144:f/ht7HT/0Vn1sPdWWwU913lyg8YRjTC/1tpTV+d:f4sPdWs13lygp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681210218, "uuid": "0268070d-9379-4aea-8fd2-57a0fbfc6bb6", "value": 286368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681210218, "uuid": "4f5c78c3-8fb2-407b-8af1-e03bc24800b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210218, "uuid": "addeb554-1633-4c3b-93ed-febbde2e6ef5", "value": "a2907061ca015b7f7fecaefc0ba99122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2cf6f5-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681221826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221826, "uuid": "69011c0a-ee40-4812-8f03-48b406735fe5", "comment": "Malware payload (Rhadamanthys)", "value": "d22a32af400f6a2dfb0bf40e32cdf9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221826, "uuid": "5ca6e86e-cc46-47de-b3bb-a54ce7ddf8e7", "comment": "Malware payload (Rhadamanthys)", "value": "487060876782c6dda3c662f1fde72ff75c177264b4b9db99f813c685a0e9524a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221826, "uuid": "aef51222-09f3-42dc-929b-b2ddbb85d09e", "comment": "Malware payload (Rhadamanthys)", "value": "428030fee8075451dadfb8d4e2d86829c80b8257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221826, "uuid": "e7411d32-9c57-40e1-9e51-9f2fc9c637bb", "comment": "Malware payload (Rhadamanthys)", "value": "4eae35f49a5880a2c5c46837b389b60225e20ff8c3465d16bfbcc5bf87cf2eb48b2a3dea4e11aa317093486cb463d2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221826, "uuid": "1b21a589-55cc-441f-b703-1f1f97f9d4c1", "value": "T10B54F1327BD2C4B2D16B44345520FFA4693EFCB29A69C19B27640B7E5D20FC1936A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221826, "uuid": "9cf78e3b-33bf-4635-89f9-06f2028bdf96", "value": "ab082a716c28869a457cab71ba8dd878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221826, "uuid": "57013efb-05fe-4eed-8d2a-d478dfed384d", "value": "6144:v53cdyIqg+SysXLjg44dZtFekcVDDaOK:v5wqg+Sysfg44dJ0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221826, "uuid": "49891e37-785d-4f18-8d55-e639413dda7e", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221826, "uuid": "fae56361-1992-440b-a611-3ba71d951c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221826, "uuid": "ff724d29-febf-4999-9ce7-047922d2d79b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6765480b-d8b8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681252203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252203, "uuid": "d6794e2a-6fa3-4f7d-ae7f-e00c9e677dd9", "comment": "Malware payload", "value": "64acfe2ca1514a031b4f84ebfe5fbe1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252203, "uuid": "aa6d9807-038e-4062-b100-6ebb4728dbae", "comment": "Malware payload", "value": "48cf37f80e44977179e453e05e695e83f30677519088567772efce40354676fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252203, "uuid": "c6358eac-de5d-4808-a27e-37f71b73c9c9", "comment": "Malware payload", "value": "a00bf9878221967f1ccd81b4045389a91f52c519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252203, "uuid": "84a006e6-a8e2-4527-bcb0-f265f943a594", "comment": "Malware payload", "value": "151d29b98ad6f40b4bb4da49b00cb75400450230963f9d9dee97d19f8710f638f164b322082ef11a36fad443e3b1a65e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252203, "uuid": "aa37a80c-ac7e-45e1-ac95-d56f4387d076", "value": "T16C24DF32BB91D076D45B04744820DBE06A7EB83197A5C6CF73985BBE1E343E253BA316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252203, "uuid": "20faf874-4cfe-4a81-bfee-4a95426dcbed", "value": "b1fdc126cbffd1158f4f7e2df2177ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252203, "uuid": "e1d69860-b849-4a17-a47e-d20301a59634", "value": "3072:6Ol8+qTtnKfB2lbYZSzJPZb/dqXD13aqUIIU0k5NwNJ:Jq+qwfBYbdJPZ7AXJ3aqUIGM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681252203, "uuid": "a3763475-d4e8-4892-81ff-6ab27177d1a6", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681252203, "uuid": "f3224f20-690c-406e-ab81-56a55037e7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252203, "uuid": "4b60ba07-3b0b-4055-ac68-1ea6a72d498a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa610f2-d803-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1681174666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174666, "uuid": "bdcec9d6-ad00-46a5-a9ea-1ee0a3d7959d", "comment": "Malware payload (njrat)", "value": "9f9d2d9010f6b1c6b3aed56995d412c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174666, "uuid": "508dcf89-e8cd-42c5-ac45-c9bff4ef6708", "comment": "Malware payload (njrat)", "value": "48d5f62e4f66656d94f16ec17b150591abb61308b46e47030a248f06804dfa3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174666, "uuid": "87e1f9e4-e545-4f8b-9e24-02885b72d42d", "comment": "Malware payload (njrat)", "value": "5eef0ff52ece164b6f8de1c3bed749f7eff3f469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174666, "uuid": "92d39817-4a25-453a-bd65-9f8e7243563b", "comment": "Malware payload (njrat)", "value": "ee7aaccda3b47a9ede83ae3be925c1c84bcb07f44ab761464eba2a813357662499178043c5b95b1487a1b1f99f8d8b22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174666, "uuid": "a94e125d-6472-4f42-a825-b5c37991b134", "value": "T1C935330FE96057DEEB44D2338DA00E0B2F6989C876B37028621C5427F56EF1F9618BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174666, "uuid": "ffcbd282-9d8a-42de-a9b2-9be42ecfbbc4", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174666, "uuid": "aedb96ef-7b22-45b1-a2e1-b1a09c905d1a", "value": "24576:N9d74ynGntT0MltBjq+uOlXGjY+koIrpRxl3gmnIq:B74PntT0guOcjY+krrpD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174666, "uuid": "97a61d35-f25c-43ae-942e-6ebda58a6e80", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174666, "uuid": "2c664e4a-9410-4cc0-b4d1-a3996d15cb0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174666, "uuid": "731dabc5-75c5-41ba-b8f0-3c72c05ca889", "value": "driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdd50e8-d80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681177774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177774, "uuid": "e998bac9-e1a7-448d-b99a-0155cbb7e0e7", "comment": "Malware payload", "value": "f5d61a0ccf96e07228a4818918aa33e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177774, "uuid": "2aef00b1-fdab-42fd-aa30-b686ea4ce7b2", "comment": "Malware payload", "value": "48db195007e5ae9fc1246506564af154927e9f3fbfca0b4054552804027abbf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177774, "uuid": "53babb39-a0a0-4704-aeaf-b254300152fc", "comment": "Malware payload", "value": "20b449283834503363e00f773e43676edc032d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177774, "uuid": "c29fcc49-809b-410f-8b1e-20769b28d4a1", "comment": "Malware payload", "value": "3bb721b20a03717577fc9ac49554f726f49b9d7fa58a468d01f8bc96d7dcc56a1303285fa9650d2972040ae9b1cf8163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177774, "uuid": "c3889525-f6f3-4e2d-a49a-fa9b8ccd36de", "value": "T11B251812A3E79175E6B2367016BE3275D27AFC22183DA74F8740EA2D6D30541EB34B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177774, "uuid": "6fb11fa3-b53a-464e-88bb-e882340abb78", "value": "c3eb9567e9430e65e703dca7bb8343fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177774, "uuid": "7d9002cc-0416-45f6-ba8d-0b0989846d2b", "value": "6144:XFHmncoC8xhAuAcAla/+As4/YZ6p9P+K/+6Y:VHmcoCUyuAvAs4wZ6rPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681177774, "uuid": "713ad118-b45d-49ba-8a32-bf9d3b6a7a40", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681177774, "uuid": "b30b982a-f2b1-47f0-85b6-d0a4ef103c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177774, "uuid": "f84f3716-5f30-4b62-bc70-8b6a338e5919", "value": "executable.1484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6cb55e-d804-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681174766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174766, "uuid": "38d3d9cc-6999-4de9-84a3-4df01df8709f", "comment": "Malware payload (Rhadamanthys)", "value": "f8f1b46c1659460698f803b03b643e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174766, "uuid": "a4146ca4-bc95-4b7d-a28d-609f85d2f519", "comment": "Malware payload (Rhadamanthys)", "value": "490882436bbf9e815277c70fac1608197821c84381fd40c377f10c9b84eb405a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174766, "uuid": "f4f01380-204d-4a17-abf2-454de45e5f8c", "comment": "Malware payload (Rhadamanthys)", "value": "f8f450f8cbc6123745491380d6ee87d6e658d81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174766, "uuid": "b94c92d9-0218-4b52-9068-04d647e90afb", "comment": "Malware payload (Rhadamanthys)", "value": "f3b18739abf61a7880053fdf57d209936ba11edbb3453ea9801113dc02cd502ae7780b4da5b8f22a7d856e465b16a644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174766, "uuid": "4044ef3c-6bdb-49b3-babc-b6b0348730a6", "value": "T15744E022B7A1C4F3DA5B8531D964DD642EFFB82266A5824B33549BBF1D303C14A7A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174766, "uuid": "9b0074f6-7c72-45ec-89c7-1566f4bb433a", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174766, "uuid": "58392696-ca1a-4ee9-a1f9-24278bb560c8", "value": "6144:I286/F/TIGiawJAWzFFtUqIXKn9EY20S8B7:K6dFia+LtUqyBu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174766, "uuid": "17bae8f0-16f5-40e8-8d4c-a6bd55584fcd", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174766, "uuid": "9b9abb79-91e9-400d-848c-c2d5e6aa2076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174766, "uuid": "76fb6a40-5842-42bd-89df-54fc9501bd4f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e7799f-d89a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239334, "uuid": "8ee5f579-b0b1-4e04-885f-a9fdb93068f6", "comment": "Malware payload", "value": "d161ce6338ce9caeeb5ec59cab80d064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239334, "uuid": "612a1176-67cd-488e-903d-296b032a2e8c", "comment": "Malware payload", "value": "4a438193a415f2c4eca1161b7ac94ed6531288971dbb2c202704f7b8a72cda4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239334, "uuid": "62dbba61-1a08-428c-a2c5-e2d97b7881f2", "comment": "Malware payload", "value": "72c6d994951abc6147e2f4c0544f58669bf613e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239334, "uuid": "101cfeef-5769-40a1-9c57-4d4f0ebe7631", "comment": "Malware payload", "value": "d1f58407b2b32da987599c59e02e1a08d13c4ca93b553f3cacc2ef6ea7fe4ec0374f9c716481ca7468becb59a60948dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239334, "uuid": "1a2667d8-10cd-48be-90a1-b5c25ffb026d", "value": "T1045633E5A1499EBAC41414B8349F676598B20F217143B8D92827BE3F37CB9D70C1E62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239334, "uuid": "943c6da8-47a3-48a9-a08f-f92a9205f496", "value": "348773d00220e600aabe04ecb8803881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239334, "uuid": "c3a25314-6fe6-4661-975c-d9a83ce7ff9d", "value": "196608:3MbVsQOQKuru9q0kB1OGvE5sZ22tf3HL9hf10h:eSgS80kB1OGvBftpht0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239334, "uuid": "25236222-c51a-4059-847f-4fd407808bb6", "value": 6456320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239334, "uuid": "912d49ed-1d15-4ade-8dad-b80c30cf034d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239334, "uuid": "fff1aaa8-ff22-45d1-8b16-04c62685fa16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d9a203-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240125, "uuid": "e5df68f1-2722-46a8-a774-63083f4bfd74", "comment": "Malware payload (Mirai)", "value": "d7aba1186042f1df93807ce17e2912e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240125, "uuid": "33ab7cf5-645d-4126-8d5b-d49cd036cd2f", "comment": "Malware payload (Mirai)", "value": "4ab687f1881036789f439c0a8ecbcc6c6d09ba223ad7ef254f9e986e23ec144a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240125, "uuid": "354408cf-9837-4bdc-8471-0da6cb689d82", "comment": "Malware payload (Mirai)", "value": "965be7102408a1c2891780931d3a77b5f08fc697", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240125, "uuid": "a730ca4d-48a4-4a99-8321-1d446df229e9", "comment": "Malware payload (Mirai)", "value": "fc55d137ceb68ae01f1a6a83df61a86d4ee3777a891f40748b16fe8ef0d4bf8f386a6dc955bee49433aaf11488b73c5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240125, "uuid": "9c99448c-2d5e-4cc2-a71e-1d270447df7c", "value": "T1C7633902366C0F57C4E24A74253F27A0C7BEE9D121E4F689655FCB668AB5E371086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240125, "uuid": "01985ceb-d168-4ecd-a415-63bf2344ca94", "value": "768:EJXsWyrWs8XBC4lgpR8U4swTpGRavwY1jq34RmOhM1P7WqVhWceLyZZ/PAFLdzOf:UsRpWo2fQIU7UcIcNYtAaDapuQqGnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240125, "uuid": "5604f789-115c-4d14-bf19-1df7ab9117c2", "value": 71248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240125, "uuid": "6ed7a80e-4ead-4857-ba60-663b3e55b493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240125, "uuid": "b08ed61e-f0af-4813-82ae-8821658cbd89", "value": "d7aba1186042f1df93807ce17e2912e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e33064e-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242632, "uuid": "4868c69a-977c-4bd5-867e-5e7eec7d92e4", "comment": "Malware payload", "value": "db9a1a2831e164c350a187439f728689", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242632, "uuid": "0c971631-d6a7-497f-823f-55621eef5ec9", "comment": "Malware payload", "value": "4b7508bfe5fbe78343965f3af90b4478e470bdcec899b91bc3d313e3f20680f9", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242632, "uuid": "b66ac8f8-a226-49e7-afcd-ef4d4e1f6061", "comment": "Malware payload", "value": "513a2fcbe8f8229eda010f0a15878829b56e9f0f", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242632, "uuid": "e6d39a9b-dc14-4182-a986-4a1d31ac1dc6", "comment": "Malware payload", "value": "8b1b815214e0b80a93a1978bddf08dcacfb55c2d78f395f06ceda632f401f41d4c05d1facca9300f6971346ea8c38134", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242632, "uuid": "cb959fec-50c7-4699-81fc-ced63e9ee281", "value": "T1BA63F1D9D67E2C6CF8E28B0B9468791B0CBC32238AF99156B0355AC57C39A0C63541EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242632, "uuid": "077d5bfe-89b2-4203-9a4c-8072df67f02a", "value": "1536:NyfSaLHM/x8Ni9Viced32tNR30aprgnxInl/AMzIXMCsRDC7O+UgC:NyqaLHM/iNy5edmtN90hxIl/fzI8pJCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242632, "uuid": "66502a18-0590-465e-bf41-00bd2196295a", "value": 67726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242632, "uuid": "7ba78325-2e51-4757-bbeb-2f21aefc6fbf", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242632, "uuid": "03cba018-3839-4b9c-b6af-347472cb8522", "value": "dm_January.19(88).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7a7adb-d896-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681237822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681237822, "uuid": "733374bb-76ff-443a-9b78-c7403802d20b", "comment": "Malware payload (Amadey)", "value": "deff18a0d9f78862f870664f62edb9e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681237822, "uuid": "8c50000d-1238-4da8-9c14-c58e8c67defe", "comment": "Malware payload (Amadey)", "value": "4bd1836adcff61bac8ff474604467e5326235810a804165a89189b91350ef275", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681237822, "uuid": "49edffb0-719f-4f34-8438-5b426a3c3f4a", "comment": "Malware payload (Amadey)", "value": "1aa4ebb473fec21210d8f9223bf0bc0664c1aa4d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681237822, "uuid": "6d4550ac-6727-4e05-9c85-723823c6596a", "comment": "Malware payload (Amadey)", "value": "03fd6bbb80dfc7b97eed6c5c3917a7b3f48773a90f4eefeced4a1c37c6930011e91d880e6a992955c00be84933460149", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681237822, "uuid": "0047276b-4515-4e3c-a8ed-315951d716ad", "value": "T130252223EBD50673C9B523B00DF603E32A32BC945E7897462285958E4D73750A973BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681237822, "uuid": "c2be71d8-4071-4dc7-affa-b0ea653496c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681237822, "uuid": "27bccb27-0224-4e51-b81c-ce4224624987", "value": "24576:hy0xokS8RcTlyU3lBjzMQob5spn9WwE1Khq3QD:UgHWQUVpybUnwwExg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681237822, "uuid": "d7ac9ff1-aa1a-4cf9-9775-368a3da011c3", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681237822, "uuid": "586bc473-a2ea-4e91-b634-7254440bda73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681237822, "uuid": "ca191f1a-c086-40a5-9627-e6530c082697", "value": "deff18a0d9f78862f870664f62edb9e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b925a360-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1681204237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204237, "uuid": "656ea7fb-a01d-4e63-b224-1a3e59173246", "comment": "Malware payload (SystemBC)", "value": "aff1ae0263ad833a893669799581e2cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204237, "uuid": "3d9f27fd-2eb0-44e9-862e-5633b251a3af", "comment": "Malware payload (SystemBC)", "value": "4c95b642310f82c6a7779a2b561b6cb9a27ca22db74c66378d8a61ee8d32f758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204237, "uuid": "e4e1c2d1-4097-476e-b915-48a957f68d4c", "comment": "Malware payload (SystemBC)", "value": "9d27b0067be38667fa018a69ce4057533e2c1c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204237, "uuid": "ffbdd441-a613-4ce6-a5f8-54f143e9a096", "comment": "Malware payload (SystemBC)", "value": "7da2c561827149e0890bc8c9a3a321e03d253d3203bd793244ebd4a88da1908b1b166f62cf3070bafb51e9125d64b433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204237, "uuid": "ecfcbd47-8f80-45e4-b333-5e377e999b88", "value": "T1A5F10822BE9151A2C337E6FE3B4F9361E47F5932A330A419DFB11D5024798B3CB66609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204237, "uuid": "5525212a-b62c-418e-a612-245ff90b5252", "value": "c43eeea4eb37b541724563a3273bc88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204237, "uuid": "821c5d55-dcde-4dfd-a2ee-d80b90a816dc", "value": "96:PNoCMDnHFBkGNutaR/3Mnh/MM4odWLqhZAoUyLh/b9U/nWo2i4gwnbw:FoTH7kGsaBc/ZbdNdhCMi4Pbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204237, "uuid": "c166c643-7111-4ca9-8639-9270fe7b561f", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204237, "uuid": "1e0e2266-6bac-44bd-8f65-3b3b71c07fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204237, "uuid": "743f3a08-bac2-4c73-b0f5-aba49bc7081a", "value": "aff1ae0263ad833a893669799581e2cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a126005-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681204480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204480, "uuid": "8371fbf5-4c2e-46b2-9dd5-866edc353dd3", "comment": "Malware payload (SnakeKeylogger)", "value": "a165c563051980c263c61ede267ebd11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204480, "uuid": "21375d0c-7db2-4fee-ba40-d34b31a5f4c7", "comment": "Malware payload (SnakeKeylogger)", "value": "4d7b05ea50909e4882e13a4bd9c9041daf1bba1a70ff6d7068765bffc92c4292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204480, "uuid": "a28d9806-a857-46c2-a4fc-f40c92c453d7", "comment": "Malware payload (SnakeKeylogger)", "value": "4bb74f7a8aeb848d466efa19e5822694131b19f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204480, "uuid": "f8e74f01-2801-446e-8f74-7bce2526eeeb", "comment": "Malware payload (SnakeKeylogger)", "value": "d656d1348dd091cb076f72454bcab83d5c14c10a313898498b495aa66971a2be9d231977b8abe8677ecc663424eae481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204480, "uuid": "40cbffd0-3c37-4836-b99c-1afce7630933", "value": "T124243A5A7BE48410E5FF493304B09561CB3AFC521A2ACE1F67D1B52A1F78690CE16FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204480, "uuid": "c02a0299-7e2c-4f3f-865b-2ae5a1b30d38", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204480, "uuid": "d093ecbf-2fd9-4058-9535-11b925d18ab4", "value": "3072:IGybM97hOQ/iK2jrOyips/XbKjvV18gUAgAEcCv/IgOYrvQZM4b8FpTwBWjOvFba:5DthOzj8szKPdFyI6+bcOdba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204480, "uuid": "65849e86-4bf1-4b57-8f39-eb2e500ba163", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204480, "uuid": "a4775c5c-180a-4c29-b215-fe960a2ec27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204480, "uuid": "a5620dff-f582-4e8e-b756-a6962603b404", "value": "a165c563051980c263c61ede267ebd11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2060ab-d82f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681193451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193451, "uuid": "abaa729c-6de4-4964-a8c7-4368010e9985", "comment": "Malware payload (RemcosRAT)", "value": "69d172f61b364623011def292952c0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193451, "uuid": "7473c09e-a46b-4527-9a02-add7d664380e", "comment": "Malware payload (RemcosRAT)", "value": "4d8274e888e5e74818b1f5b13ceb2a11ce585e97b53faf26b690f35a4a446b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193451, "uuid": "f6840409-ce30-424a-aca1-39a9721dce20", "comment": "Malware payload (RemcosRAT)", "value": "3b0df9acd8b2825b44fdf31608c2a881ade21d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193451, "uuid": "1eaa810a-88c8-4340-9c0b-2ab2b209d3f4", "comment": "Malware payload (RemcosRAT)", "value": "74ec07943f550bf14b6e157b5260e96be9a85c235be111d90cd169abeeed24243a02d2bdbf4875c6a2da5f4f19b8edfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193451, "uuid": "35c83577-d063-42f6-88d3-f3244bbff88c", "value": "T1D05412020262D0ABD9A29F7A1D17EA07B575F50038B0198F23D0EB8D7D2778799D83A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193451, "uuid": "14594054-3883-4136-bce5-0c701ac53f1e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193451, "uuid": "0a23cc35-daf9-459d-8ea6-697ade1f8cef", "value": "6144:2mOPuoXlo5kM8wkAA8MKyz2DlkSfv8VBhuwuBcdoLkuB2b3aBL:ToVwOt9/qkim+BO7b3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193451, "uuid": "2900d51b-7d51-4eb4-ae10-d8cea70f19e0", "value": 297960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193451, "uuid": "e9a6c31d-e7d0-4485-a67b-6257252f1ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193451, "uuid": "16cdf6b8-d202-43bd-8884-936848bfcbe0", "value": "69D172F61B364623011DEF292952C0C9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0c5fb7-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681195195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195195, "uuid": "014e3ba1-081c-415d-b7f6-41dbf776e5a0", "comment": "Malware payload (GCleaner)", "value": "257d7d884cc81e2c43ffe6d23af1a9f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195195, "uuid": "8e4c5a8a-3f04-4298-a987-e3e7358977c5", "comment": "Malware payload (GCleaner)", "value": "4dcab49deaf93aa7386c646505c3854c058e7fb9132110168a0dc62b44fe943a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195195, "uuid": "79ee1f38-c261-40ca-a936-2a02f0f131b8", "comment": "Malware payload (GCleaner)", "value": "e109a8250a1ff9ffa6b903048d9d16a9308d256e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195195, "uuid": "64f47ecd-d193-4620-93b4-11fe14a410c3", "comment": "Malware payload (GCleaner)", "value": "7b5dd1002ad9050579e979e59e2bc9b56845050d312418081d21ea6fe80e7548983f36bcb398b1680d2f7e53886a6d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195195, "uuid": "f5e9f6c0-960f-4ed7-8a5c-56846b3a15e1", "value": "T18B936C52B5C1D471E536193214B8EAA09A3EF9600E619FAF37581A7E0F341C09E36DFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195195, "uuid": "6bb011c2-21eb-4327-b390-709f1f83b926", "value": "9ecd31d95fcf8e7a0585267af62cc10e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195195, "uuid": "d1d031eb-c983-4635-9a02-3f433866662c", "value": "1536:KysX4CQLdwXXGSVJxRrfppj8UncxVUj+ofOUxcXv7qMZRgsWI/z8cde0nH8pQC7u:KHQLdeGSVJnLpp+VUj+ofOUx7MP7pe0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195195, "uuid": "004110f0-345d-4550-a195-feb654a6bf3d", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195195, "uuid": "67914d06-f734-42cb-8b49-0d84b06a4a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195195, "uuid": "0bd7a8a1-5260-4bb2-ac35-dd14e083c44d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be20fc95-d832-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681194796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194796, "uuid": "7216d852-7344-4eeb-a161-34a77357ba04", "comment": "Malware payload", "value": "d3dc726f051359d67a6c637d2417260a", "object_relation": "md5", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194796, "uuid": "3d390ba1-d055-4692-834e-88f7ebce351c", "comment": "Malware payload", "value": "4e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3c", "object_relation": "sha256", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194796, "uuid": "2f496786-96c4-47f2-abf8-bf2e35837ec7", "comment": "Malware payload", "value": "450e76995d4447e80fbce8693f60b79cbfbfe806", "object_relation": "sha1", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194796, "uuid": "12031f39-0f68-4185-93cc-37550252d864", "comment": "Malware payload", "value": "46f2ea29becc08a2f513e005a2d7d909a14e3f2c56aa752e2779b666213780b9d2ec7c9412afcaa2fbb594817a75aca1", "object_relation": "sha3-384", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194796, "uuid": "9949a4e0-6f45-4a07-ba97-723da0c30107", "value": "T1ED86F2514A78BBA2ED12093467A12EAF219D2D2F07E732CC585DCE4F3263C9E359F845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194796, "uuid": "0880c351-cfd9-46d3-a563-ce571e403361", "value": "196608:Qp7cLRD07oXk7XQqZ0SyoNdumLPZ443pjXSJdIQz:ZFKLZ0wNHLPZKnpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681194796, "uuid": "06348cb7-9457-4202-817b-165bf9781eca", "value": 7877174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681194796, "uuid": "61a2c49d-8167-4b79-b0bd-e51f81daf129", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194796, "uuid": "aa7bf949-5628-4780-b4f3-4c44ab9d0e61", "value": "EILI Laptop Stand & Laptop Stand with hubs 2023.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9eb01-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240076, "uuid": "05e1f899-af33-418b-9c29-cd24e98e0167", "comment": "Malware payload (Mirai)", "value": "5bb9c36edd4412d4b5de201a862151fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240076, "uuid": "4c60f10d-2ea1-40c6-8c25-305ba3f408c5", "comment": "Malware payload (Mirai)", "value": "4eceffc3c7adc3bdecdbfa9cfe8b33dde4648bf4bdec3c4e8e4feab7b19b2f74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240076, "uuid": "ec4eb522-0aa0-492e-ad4a-362811828c9e", "comment": "Malware payload (Mirai)", "value": "bdf5d40b14502fd667dea6bebaacf01ed3b82724", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240076, "uuid": "98424037-c044-485e-91a6-67fa9b9cbf12", "comment": "Malware payload (Mirai)", "value": "f8c492546a471138c3d40cd0c7d91d013d6b4e5b8cb33a8b3b0ef8f21095a8bd00b207f9c0cf9ab53b6e37798dce57c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240076, "uuid": "84be65bb-7583-4a10-93df-9d33e7aebc79", "value": "T105A38308BF654FF7ECABCC3709E82B05288D550A21A97F367934D458F24B25B69E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240076, "uuid": "dc7eb662-8c02-41b4-a4c1-4ddcaee383b3", "value": "768:hXEv5gZqgrkOE05oZNDlfJLQM7G4BHuivnp5RQejUeKMJAdZ1qAXi6gbuS/qwe2:m6kOElZNRx/tvnpgaUZMJ+Z1qtuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240076, "uuid": "20ecd75f-c8ff-4dab-a0f0-e16270dc594d", "value": 99740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240076, "uuid": "69123526-ec12-4e72-9b7d-b28bfc0597fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240076, "uuid": "85c6ab5c-0d6b-412a-85a3-79d9f36e04de", "value": "5bb9c36edd4412d4b5de201a862151fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4da3a3-d882-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681229156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681229156, "uuid": "1cd4b0cc-d3f7-479e-9d4c-f7ec43de7d92", "comment": "Malware payload", "value": "a5a8e2a8c41e69a0a360f2eac255c77c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681229156, "uuid": "263b3b15-d83e-4a7f-899d-8837367b2a9c", "comment": "Malware payload", "value": "4edf82162fc866d405ccad0a2613ebda88dfca83b1714b33e4ef56bb105b6195", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681229156, "uuid": "436c51a0-262c-4c6d-b9aa-da3d09df85f8", "comment": "Malware payload", "value": "f8a5c89c428c63e946bc2af34846a4c269825cfd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681229156, "uuid": "de7a3504-1002-4db1-8ed7-bba791cadf7f", "comment": "Malware payload", "value": "60ff6f7a19280de33e21e81431f45c3e34331c3fbb3dba703579d2d8a89ac01d5a801de30676ff24774fe8c04344113c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681229156, "uuid": "ea4da20d-fc9f-4b8a-b770-749f4eefd9a5", "value": "T11D15239D37E5506AD369DAA9E103502DBCAAB55B0D10F27B9CF3E0CCCB1E5618CC21E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681229156, "uuid": "a321915c-bec9-4a9c-810d-e1d09f9bc2d2", "value": "24576:wXmvPaLCXsBqu1GvfIY5fs0zxACI+nF4JlHf:YmqCXsBqmGvfIMU0zxiauHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681229156, "uuid": "9764dab1-fc77-45f4-bfcd-ece02d4acb44", "value": 899773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681229156, "uuid": "61336898-e5c5-44de-9ff1-fbbd66a05719", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681229156, "uuid": "3bc02429-6728-43f1-ae95-40d26e361e86", "value": "confirmaci%F3n00.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7baed0-d801-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681173777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173777, "uuid": "b4d980c1-c7dc-45a6-a578-a6f21331a1c4", "comment": "Malware payload (RedLineStealer)", "value": "ef1e559056be35e9ddf6a351f98d4a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173777, "uuid": "c454c6ad-974b-4eb6-8099-4a36940cec02", "comment": "Malware payload (RedLineStealer)", "value": "500e80088a849b49ec0d71d9f1b6b9738d8c0684b4ae1ab70a8a871bbddd6032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173777, "uuid": "ce89360e-4941-4b87-a325-6300f3e5fc96", "comment": "Malware payload (RedLineStealer)", "value": "a75d537e622493429ff336b263b88e70de3be860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173777, "uuid": "8ac109cb-dcc7-432b-a18c-ac417445d436", "comment": "Malware payload (RedLineStealer)", "value": "96b2db24c0f23b586cbb8bfb0b5abe3a7812a601a35f14840646c607515a6e185249d277132c482e8a77f961669609f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173777, "uuid": "5b601950-bf66-4001-98ef-15d95419536d", "value": "T11F052303B3E4C6B7E5B52BB05DF613430B36BCA14DB8176B2B46592A0E73594287273E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173777, "uuid": "cd301acb-9b00-43b4-ab58-c1918d8ddc66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173777, "uuid": "7fc8c692-b825-413e-9217-9c01cdc9bf08", "value": "24576:VyKUlay3FX5/UDqfpQ0/1IcV0ZomydQzXD4Y+TJ:wPlUDch1l0SazH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173777, "uuid": "642a8540-a3dc-4b3b-b08e-2c6daf6ccb6c", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173777, "uuid": "bd22b0a8-b9be-4e66-848b-3f8188c8c03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173777, "uuid": "8450a8a3-1d58-41a3-a647-a6d04d0d01c7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325abf99-d844-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681202293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202293, "uuid": "b6f0ae11-90ca-4491-9637-93049326d5f9", "comment": "Malware payload (RedLineStealer)", "value": "b4366bb38342bf5092ecc110684d091e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202293, "uuid": "5c416fef-9042-4300-b58f-6788ba9b014e", "comment": "Malware payload (RedLineStealer)", "value": "5098edc4249c3b818f3d99da1491aa8e51060f8714641bdf7ee7524a4df5ce4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202293, "uuid": "176479c7-8e3f-4ce1-a567-40a594c167e3", "comment": "Malware payload (RedLineStealer)", "value": "4abe6534a59472bb469b5d65d6988a9ac3baaffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202293, "uuid": "06af9b23-a2a4-4eca-89a9-87983a1900bb", "comment": "Malware payload (RedLineStealer)", "value": "309366990b5cc9e367d8578dd2c9e25e5f2b9ca629a94e5dec680008139ed5af53788f9de7ee6355e2e4c0b92ec142f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202293, "uuid": "8b64f216-6d8b-4c23-b3f1-e979d4254cd5", "value": "T13F74D002A3D2A830E21747318E1EC3FD262EB4616D657F5E1BA51A7F1D343A2E16273D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202293, "uuid": "02a8f410-3845-45ac-9cf5-bd71ab402861", "value": "83e69607867f7fb532446fb6de8bb0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202293, "uuid": "e93e1f27-c6e0-444d-9a95-504466944297", "value": "6144:tZO6UaE2WsWx6+t5WY/G2uQRxbqf+NU9GsCPaW:tg6rE2W3lLv/aAGfrGZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681202293, "uuid": "b30c7ccd-12a4-40ad-95f4-1bb919e8f28f", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681202293, "uuid": "8f65069b-730a-41e5-994c-747b0b9c67c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202293, "uuid": "29f2a1a3-7aca-431f-9f98-9b29a3fa43d1", "value": "b4366bb38342bf5092ecc110684d091e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1a12c0-d829-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681190797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190797, "uuid": "85a7f30d-1dd4-4080-a527-d7d6d08d177a", "comment": "Malware payload (AgentTesla)", "value": "af0b9467b52db9217e38dcbc00d5861f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190797, "uuid": "11a5e706-e510-49f4-bf7a-57dc9e8b7537", "comment": "Malware payload (AgentTesla)", "value": "50f611f115f000ecb7c67b68a0a22e519ee6d275ea5532558b041feec6a3752b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190797, "uuid": "5f6fcd3f-3ead-4099-b36d-b853709d57da", "comment": "Malware payload (AgentTesla)", "value": "d64ea7b0ffbda80060c775dfce160c7154c64fdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190797, "uuid": "2fb3c7e5-3eea-4f68-9fc0-7a390c44ee06", "comment": "Malware payload (AgentTesla)", "value": "406956765125528693118e0014d2e02959cac4a46eef8fcd728ab998e9b4ca9e4047664cc1bb7f849150405fdc613c99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190797, "uuid": "6890ada1-f8d6-4b87-9e42-a5682cae2e22", "value": "T14FC54AB102A3FE84E77F1E94C01829409C645C2797AC9798FCC935AB57F6620EF5CAB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190797, "uuid": "ec36dbd6-43f1-4042-a01b-d495d7bad262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190797, "uuid": "1326833b-512e-451b-a7dc-362a86f05882", "value": "24576:mBG+SR9+vuowwryVR4igCHYEUhRmYAKtu1Dze6HDpL38+Qa0IUAHT0uaNyL6pgVd:mBpL/G8+Qq4jGiNu4MZZZ35hBmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681190797, "uuid": "27b4f59f-204c-4718-b3a6-4e4df3e515fd", "value": 2534400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681190797, "uuid": "f23ee590-450c-4f3b-b30b-750c0583880d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190797, "uuid": "52d23bfc-7d15-4a16-8bf8-7d0e2d3a631f", "value": "IMG_100783133pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c113ea46-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681208975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208975, "uuid": "a82a90d1-dbfa-4360-8b87-d7a074ac7891", "comment": "Malware payload (Formbook)", "value": "a3c7eee749c29ef97ca345c50ebcc3f8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208975, "uuid": "202e152a-13d4-4232-a279-205d253b46b0", "comment": "Malware payload (Formbook)", "value": "529ebe4ffb398f3610005b26f83941e754add3685be6f8846515e105b5765fab", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208975, "uuid": "c401a7b4-7596-4421-bf0d-49233a7c6f57", "comment": "Malware payload (Formbook)", "value": "eb39b4ce39bded0fbf2acd16d2b62e2b91a14e42", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208975, "uuid": "efb94062-0668-47d3-9d9c-ee1cffcbac2e", "comment": "Malware payload (Formbook)", "value": "6726c727e54fc9580c551d38c536570304562bb0d30f5caaa2a39cb2f0cabea114db6790d93ffc224791b3b123c923b8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208975, "uuid": "a3e59f61-44c3-40bf-aeaa-f8af722257a7", "value": "T133B4122683F89756C5BC63797E7532604F7D93183426C5213C48A0EAF5F2B02AF929E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208975, "uuid": "705bf276-8c79-4239-97cd-35f96aad4bbd", "value": "6144:BHx5W0WIQir49nmWKzpu4xEBEK+znwHjrGpsB2k43YZJHbgtPCjhJ2bEomd81BtM:BRtSIHz/4Dl43KJHbQP8ObETdOB7bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208975, "uuid": "ecc98165-69f6-467e-ae63-7f7be9f46ecd", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208975, "uuid": "9c9badf4-311e-4927-aeb6-d81e07c2652e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208975, "uuid": "dbf67731-3b12-48df-9afc-0d7fc9138680", "value": "DHL_SKMBT #KV19RE991-A5471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fbb201-d854-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681209087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209087, "uuid": "500b7387-ac90-4ff2-8e8b-d73076ebc612", "comment": "Malware payload (AsyncRAT)", "value": "088df64cad4c7acad300c78722c5b510", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209087, "uuid": "42a216e3-3b67-47d7-bbdf-7e84cc18d55b", "comment": "Malware payload (AsyncRAT)", "value": "5348860038f0a63ef4bf27a0a9a648160c731f048b205a48f583e7cdc1725c2c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209087, "uuid": "c73bb120-733e-4933-89f4-6aada326138d", "comment": "Malware payload (AsyncRAT)", "value": "34d4b5df88d5818fb0e0e7b968e1aa6609610548", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209087, "uuid": "b490ad67-d010-4491-a9fd-48b7c20bdba6", "comment": "Malware payload (AsyncRAT)", "value": "cc88937e639d1c765a6e53e0d321a5700e6d49802b35e75102914e96be7e378b546f85ea08bb909c26a9eccfaf2b23d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209087, "uuid": "d0b4aee7-9470-49b7-9946-c7e79b7b1f01", "value": "T1E0515B281EF65724E7F2C73AA8B6E31185357C1AFE12DF9D01C082881825B15B5B6F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209087, "uuid": "74897a5f-7e6c-4865-80b9-7b018a023948", "value": "48:8xHaRaQE+64J4qtFytVotj99lzYoTlMa:8xHKFeCpkUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209087, "uuid": "8d5fd4cf-50cd-4124-ad77-3eac547e40c0", "value": 2468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209087, "uuid": "a0bb1879-3819-46ca-8e89-61e39611a7cc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209087, "uuid": "c600f7c5-77ac-46f8-b1a9-acf11732ec0e", "value": "TT_Telex_492023.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0d381d-d82f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681193447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193447, "uuid": "f6c8d1f6-46cd-49f4-815e-d4266dd61045", "comment": "Malware payload", "value": "3ce8004e91f0312d0bdca24843fcbdf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193447, "uuid": "5f653a06-0fa2-4f0d-ac40-89e3c7d3817a", "comment": "Malware payload", "value": "5359a7d476ccac26472ee8eebf812ceefc19dc37b84b5af7540ddf46a5d70f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193447, "uuid": "b0c22d4d-0913-402a-bb71-3e3703d7a7b6", "comment": "Malware payload", "value": "be16a04dac5624bd34a9ac5f3425bd64a70ba7e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193447, "uuid": "ec203e1f-6918-43ef-ba0d-240cb965dacd", "comment": "Malware payload", "value": "dbeea4735785dd2e32a764b40d0e49f98a373460f52ceb640ee47de252c0f555e3b4d39b9ab98c220a28d0ba8bb9be32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193447, "uuid": "2389c7a6-df03-461f-a864-b006675ef2d3", "value": "T149B46340E2D5ACD4E096A13A9C3AF53874B9FA4D9037CC1D1E6D654894FB382782BF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193447, "uuid": "8caa11e8-ad42-4915-9e78-a0a109808ea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193447, "uuid": "dc5e03fd-df3f-46d4-ab84-8808c5bd8232", "value": "3072:xoDrJTHFpQz54ygHlYc5ff7HLwcVWYkTC3TWit8zTxLek6W/BIraalOWafTS+9/A:xgJ5pQlQ+YkTrAW/BIrapfT6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193447, "uuid": "b3962863-63fc-4eb5-b582-b5d48e2e2b74", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193447, "uuid": "c14c452d-588d-4986-af04-5a0c726f9222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193447, "uuid": "7ab3d476-d76d-4fd1-bf67-79cbf6c1201e", "value": "RFQ-0037723Y4YRT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c7829d-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681239015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239015, "uuid": "ab88b36f-22b6-4a24-bbd6-2049afd229ae", "comment": "Malware payload (Vidar)", "value": "a5acac0e10f831c7542601b3853cbfc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239015, "uuid": "18adf64b-e311-4a77-9f0e-80c2b04018cc", "comment": "Malware payload (Vidar)", "value": "5468a2d108bad22641d97c8a34b1362f7c91a49406c051071893b650105c1422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239015, "uuid": "39f78c67-5964-41d3-acb3-cf16ff2433df", "comment": "Malware payload (Vidar)", "value": "c22780a9b638e6c0553018cc4cb4b2ccba89355b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239015, "uuid": "fb655574-f0d6-414e-9ccd-945c09c6dd0a", "comment": "Malware payload (Vidar)", "value": "a4c20ac69c6680c0920e353f7d58676f551c0dbbc3a1fb0e5ab31603ce2105bfa918233ae395359ec7db56196245f9a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239015, "uuid": "b5a26e46-0f85-4095-bbfb-6e96b029ccd3", "value": "T1A5640223BA90C473D42B06705821FB98EBBE78619761C17F23241BAF1E32B909B75757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239015, "uuid": "c230460b-028d-4c47-9706-d11594309a2c", "value": "a1cd3e7956f73508d7120d1c096b4596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239015, "uuid": "fd12a45c-a629-4efc-b523-943e8fccdefe", "value": "6144:928Jd2+NqVGSuXznNaMA5niXOAGp35fZo+e:9P2+NqHuzNavsO1XfZoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239015, "uuid": "307f51d4-612c-49e8-a4b8-0fa871b57291", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239015, "uuid": "fc52bece-a692-47f1-9d72-618cf4d8954a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239015, "uuid": "99605931-eb85-4d07-873f-fc1e2d8cbfbf", "value": "a5acac0e10f831c7542601b3853cbfc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1131380-d801-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681173729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173729, "uuid": "d5b126f8-d888-4858-98f0-bfb3d7075606", "comment": "Malware payload (Amadey)", "value": "0da0a90f1e9363fab3bff3a0c3663dbd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173729, "uuid": "8eefff54-8dc9-49ea-ac18-83cf79db7485", "comment": "Malware payload (Amadey)", "value": "54ac00e3b16984e23167808833b18e14b30a448141f5852e717b35b88f8a916c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173729, "uuid": "25b1684e-4205-45e6-a1c9-2ca33926276d", "comment": "Malware payload (Amadey)", "value": "3ffe6228c7748a531270fdf1aceb94d061711dfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173729, "uuid": "666f1d83-8cfe-48cb-9110-550b63ba7838", "comment": "Malware payload (Amadey)", "value": "5486cc6f759dd99e231969cd080b7a3699067f0d9b998d6c7b9878cffead7acd753bd9d0fe74577f3e7754c6ca983731", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173729, "uuid": "f92b14aa-5990-4eef-86ea-f34954f9f075", "value": "T1E4152397E3D98073E9756BB424FB23870B387D610C39C60B5780682ACC77691A5B639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173729, "uuid": "b838efb7-68d7-40f1-968f-a657463d0f16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173729, "uuid": "f86a1230-999c-4e16-be8a-bd785313d56e", "value": "24576:qyIvo1MGVNDql1RIap0wZVsptV1nljBEppVH:xb1xNDqlkIvTUVlAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173729, "uuid": "bbbdd5fa-ccaf-49f7-bf01-331524c725df", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173729, "uuid": "3cb52759-83c9-4cab-b726-f44babb2328b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173729, "uuid": "0323d039-a0ce-48bb-8c22-ccd0b80a26ac", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d03633f-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215330, "uuid": "3d984255-7a62-4f0c-9a2c-daf5ee51dbf4", "comment": "Malware payload", "value": "596078c194ad525275dbf0787b475c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215330, "uuid": "148822af-72a6-4947-9ecd-7feab441c458", "comment": "Malware payload", "value": "54d01da9e6fbd81837ce2800be97a57d750e97e9d02aec4b34341b4c8684ba0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215330, "uuid": "9dc5e033-4d3b-471b-8525-44b4739ccd24", "comment": "Malware payload", "value": "ac5aa802506f8128c51e828ca1fc9c6d0a1c1b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215330, "uuid": "07e3680c-d485-414b-8f54-1f1466ed34f7", "comment": "Malware payload", "value": "803c3242c48b8a8bd72d79b77e832f7b949478f1a73884265aa5d9785cef7e2d94f2cf8933e66722fa251c476ecf9e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215330, "uuid": "573f17ec-aecb-426c-bb22-7e919f2f2316", "value": "T1323629C657AA6995D2BB3E37A0B477054F75ED228B5EFB1B1080F5FB1CA6B116C00223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215330, "uuid": "69e38393-e40c-46c3-8d35-fb4f73cd3e94", "value": "49152:A1H4VI6/UGwPVGv8i5aU0Bc21/K2Xd8nGozc30kaZt3DJIHo1fmHp+z:TD8GwVAn29XbozcEX7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215330, "uuid": "6f81b13f-d9ae-453f-817d-94a22e6fd443", "value": 5327559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215330, "uuid": "e976b4f5-54e9-48f6-8baf-3d00a52ef715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215330, "uuid": "b2cf630a-7520-40b2-a7e0-1fe29505c2d8", "value": "596078c194ad525275dbf0787b475c50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a31dc4-d87c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681226273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226273, "uuid": "b4771cb8-7c3e-45ce-9520-668b8c339700", "comment": "Malware payload (Formbook)", "value": "edf82f3a3d4887fd2490efbca13f763f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226273, "uuid": "9afe32d4-db43-4104-bc30-06be06087960", "comment": "Malware payload (Formbook)", "value": "564bbf886f8ca5cb5674f3d073bc27faf96cd76e234eface059c53e676d8a6de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226273, "uuid": "ffdaa508-87af-4ae7-83f8-ed2ce1a15d4c", "comment": "Malware payload (Formbook)", "value": "9bd2c756f7cb0a7e4f7f187416d0e944339c59ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226273, "uuid": "c0aadf35-7923-422b-99f7-4fd3a4eeca1e", "comment": "Malware payload (Formbook)", "value": "0a8b68a29f38262e3401a8134d42a0511505b532c179d03ff88853210f3a1d67336fb7b0433d8f127877a16aace2c73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226273, "uuid": "4eb7b8a4-782d-4210-ad45-77f608283cff", "value": "T1224412096260D8B7DC825A720A7B06239FF79D1518FC8A9F67745B4E7F22382931E331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226273, "uuid": "4bb1fa94-5fe3-4e91-bd4a-c4ffefff156a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226273, "uuid": "47b882f8-1900-4251-a107-618efbdb106e", "value": "6144:/Ya6o4DzaHQ+4M50TpQlqGgO4888Lv+G8lR7X+2XGUzwLytqPiUqp:/Y+ukQ+XCG6Otb+G8/XLGUzwLytqfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681226273, "uuid": "67e1ec97-a6f7-47a8-baf5-787aaabb71ef", "value": 277449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681226273, "uuid": "7159c7b2-33f5-4f40-a82a-e0bab38b3ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226273, "uuid": "e2f16762-8395-4827-bfb2-c82478054251", "value": "narcher7655544pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3db142-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681239004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239004, "uuid": "a73f5509-211b-4df2-9fb6-657075d0d12a", "comment": "Malware payload (Quakbot)", "value": "4c4f6d3a47196c8f2f438cca9e6b6b63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239004, "uuid": "9eff042d-73af-4148-ae98-203d2ecd95f7", "comment": "Malware payload (Quakbot)", "value": "573e70584557ec0c1d3d7053f3d689683b871bf904d0dc4560d2dc2ef6b44c55", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239004, "uuid": "4f51eff3-76bd-45de-8e95-a3a4bf7bfae7", "comment": "Malware payload (Quakbot)", "value": "607559142cac92b2b227eb049c64785d40052f28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239004, "uuid": "e2bc2575-88ff-46f9-974f-a4005e66fb24", "comment": "Malware payload (Quakbot)", "value": "d53e7661a2999171f9d96a51583fae44de00d059df9b11704b67b09731f8d071fbb3b61a6a472cb1ef4c99de3af288e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239004, "uuid": "cc1a64c4-7417-425e-b8cc-f6e773b4ff6c", "value": "T19EA42916E10390FACD5A2BB64947A9EF3524BB09C4341E5DDA9C0C19F73BD02762D2BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239004, "uuid": "14928e86-1087-44d1-aebc-8cb443908731", "value": "12288:FNg5j3vw+WqFlWJfkmVwe1UL4hsao3Oowg9P/z:M55F4lhrgOon9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239004, "uuid": "b40862fd-4a6f-44f3-8ea4-d6bde33575d8", "value": 493448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239004, "uuid": "d0f6ccc0-5de3-4d83-a598-2e1117ba5ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239004, "uuid": "76e2788e-68c0-4504-a9a1-853a0f1cad93", "value": "4c4f6d3a47196c8f2f438cca9e6b6b63.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72787596-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195528, "uuid": "864974d1-19e3-4b25-9206-bb1ebf40c585", "comment": "Malware payload (AgentTesla)", "value": "b525100bfcaa997ec745d2b37b236bbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195528, "uuid": "febff2f3-a4bd-4543-bcc4-b5d49e89f51e", "comment": "Malware payload (AgentTesla)", "value": "5762d98de35eb91afb9d86bad2f0c88e31732dffe13f187667b43a66e33f7e07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195528, "uuid": "aeb727cb-e1f1-40c8-9b75-aca2a3932432", "comment": "Malware payload (AgentTesla)", "value": "06faa4c6d5a317acb8e08fe4a749e3d859190361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195528, "uuid": "ca00b67c-9f7f-47aa-90ae-01d1a3d19c3e", "comment": "Malware payload (AgentTesla)", "value": "4a10cb5f157c2f3ac9aa86dea0a7d5102f3fffc8bbf3582dab5689910fd47c39971962836fec70ed36bb7e4c48ee5d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195528, "uuid": "32dfc0f0-513b-486b-9417-97ffad41e912", "value": "T18B057B2D6D9F5622D279A775C6D24024B3EE9043372BFA1B69D221C00F02BD6FC8D95E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195528, "uuid": "22d68ba6-6cd6-4d4c-9415-7344ac91c173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195528, "uuid": "0e6dc3a2-11e5-4b98-85e3-8abbe46acce2", "value": "24576:8qOQYa7GGJ8Qil59rYvjLdhyoOEs3TrgMZ6pEXlcPFI30oo1AkPiKLtJ/oXjZ:8H2FfqkFho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195528, "uuid": "0017dae6-9646-4737-876d-504702d7a409", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195528, "uuid": "b088b88f-945a-4663-8c7e-d12ff9c19d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195528, "uuid": "e5986a31-b27a-48ed-a452-84eae0454551", "value": "FIYAT 0000 CamScanner YEN\u0130 TALEP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65af95e-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1681208957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208957, "uuid": "bbd8d5d3-3541-4e41-bec9-2240e5e5f0e2", "comment": "Malware payload (LaplasClipper)", "value": "2de83135f9c732a1563ba36d73444109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208957, "uuid": "0b16a4ad-11cb-4a72-acfb-7dad31ea4f87", "comment": "Malware payload (LaplasClipper)", "value": "57688ebad140cf112323fd5b1fc4fbe573603f6c4f16e8d8a50d6e1f75100bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208957, "uuid": "53c1d05b-3fc7-4d02-9a49-ac7e56e3d678", "comment": "Malware payload (LaplasClipper)", "value": "b0b87a94c42dfafaa913ed3b8ecae5410ec48e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208957, "uuid": "a1976afd-b293-448d-b668-401b8b884bd2", "comment": "Malware payload (LaplasClipper)", "value": "386519679789facf2bd46e1ae695707e82bfcb3c56ee22016450d25941f454b57959c7131c2d36b472bcdbb284f277a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208957, "uuid": "debd4045-38d4-410a-9b15-cdfcdd9097ba", "value": "T13126338E5E31E130EC44B4B0D9E3913C67C9CB0D2A1FDA375A4352928D1B6DFB25672A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208957, "uuid": "eeaf29f3-f789-455a-840f-42f291e2eda3", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208957, "uuid": "7fcf5773-706a-4af0-8755-cfd07481732b", "value": "98304:GPsyAq0rTgjHLNieY4KejbEJp2s/FrIz+bAKsB5krAwCsqfGKOr:GPMqC+HtTK4Y6wdLyzwChir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208957, "uuid": "4fd7e5c2-1d0d-4624-9967-efb072226497", "value": 4710400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208957, "uuid": "07df3e8c-ce3c-4eaf-9e13-c38c48ab7775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208957, "uuid": "be89c1c9-4780-4850-89ea-e52c9b1dc53e", "value": "SecuriteInfo.com.Variant.Lazy.208008.18204.7130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b557d5-d861-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681214989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214989, "uuid": "2b4f7451-ac67-4dec-898f-230be802c48b", "comment": "Malware payload (RemcosRAT)", "value": "47bad3e0edb0a83b9bbc50e6a6766262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214989, "uuid": "4111b1e7-76df-4b9c-b343-42c3871104c6", "comment": "Malware payload (RemcosRAT)", "value": "57aa68fae986c755354f5a288bec6dd288f43d05823ef2794f2754d9841434b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214989, "uuid": "16cc11e8-9f54-472b-9bfa-9ce3e4643058", "comment": "Malware payload (RemcosRAT)", "value": "cf89c050fde7e946671ec8263d19f250cd7d8240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214989, "uuid": "6fd32065-f086-42a0-82ef-6f28d42a6c1b", "comment": "Malware payload (RemcosRAT)", "value": "b6f753d49e1aaca8cc499892de44bf5741ca3bb2f7e4164db038818b4dcdf5fcbe329eb9da43e77686da860d40c2bd5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214989, "uuid": "9be986c4-a72e-416a-bb29-2d8acf760118", "value": "T1E8F4AF673160A1BAEB6716374E48D61E91A07E7928029E0A22733F7F7D7C7435C406FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214989, "uuid": "240073fb-161f-4e45-bf5a-5486257c07e0", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214989, "uuid": "50424b6a-1e62-4ed8-aa29-69646d62ebfb", "value": "12288:aMwq9DFYaT5b+KJV0gI9zNjtdtVQj+BtWugo:aMwwYa5RszltaBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214989, "uuid": "78325281-5f48-4194-a78d-faf071d62bb8", "value": 735416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214989, "uuid": "5568aaeb-bea8-46d6-a4fc-5f355de3055d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214989, "uuid": "6971710f-92cc-45d5-b010-2a32af27c20b", "value": "NEW PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d178ba-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681239130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239130, "uuid": "9d9b2bb9-bb0c-4629-b264-34f51ba0c8a7", "comment": "Malware payload", "value": "90d603855bbe6723100e5d2b01b54f73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239130, "uuid": "ec573549-24a3-44d8-babb-8812f7938681", "comment": "Malware payload", "value": "57cd5a691bf610a750e19789456d074b65896a95caf9c05fbc865691c23e46ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239130, "uuid": "acae6c26-3c19-4fc3-9390-48d5140781e3", "comment": "Malware payload", "value": "9d032ca142baa17d266cb8f252a52bc4ed55640f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239130, "uuid": "5483eef1-439e-47c6-8103-f5f144c6bd89", "comment": "Malware payload", "value": "de08956dd8ce1785d1a3b23e910b6d1fff48cd9c63ca4cc6a1c9b58825decee8d6a58ac255c3f5713e76a1a0c5162c01", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239130, "uuid": "e6c7cc01-d35c-4289-9c82-f7a19b947f2a", "value": "T194513C0277FD020472B32B555AB764700737BFA8A83EDB8D41A04D4D0BF1E549896BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239130, "uuid": "7326330b-296f-4e30-88e0-dad64450686f", "value": "48:JiAUuqIPVCEG62jRn5ErbA3G0Lg2a7Mj+1D+wU4o5YYFfIfi50U2ZCI0VC2:MUxCACfeIG0R5YY9mHiC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239130, "uuid": "b97fd310-e262-4949-9a6d-37c83a14cb88", "value": 3024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239130, "uuid": "c646aa30-3294-4ce6-80d4-6956d3f42fc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239130, "uuid": "689b7778-661c-4cdf-8ddc-6bd6bf8da2de", "value": "signed charter agreement.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abb681d-d854-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1681209125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209125, "uuid": "83833cf0-8ecc-4272-af19-6f00e4433b71", "comment": "Malware payload (VectorStealer)", "value": "75aa7df4538982344bdb81ce03f6e525", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209125, "uuid": "c5900338-eda4-436b-9fa1-bb01030ca289", "comment": "Malware payload (VectorStealer)", "value": "58014a69ef857a99dbb6485f9cc5a1c4d5ae04fb09bad3ab04ce14db2c4cfd1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209125, "uuid": "38d50a0b-afff-4305-868f-fed442611540", "comment": "Malware payload (VectorStealer)", "value": "3a35ee8901bc1ce10688b331de15b8434aec3717", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209125, "uuid": "48cf8f33-e3e9-42b0-afae-6cfb5177aef2", "comment": "Malware payload (VectorStealer)", "value": "f3f457d3f3a6ff7521bd3f6f0f81243ae674fad6e4aea8f9debdbefc7f9b2499f380252ac214f40b0a8f7df33493da76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209125, "uuid": "20cc075a-7de2-413a-8abf-b2bdaa48f121", "value": "T14006D6F839035077711C62376A10B08F8AE4785BA24D8D9FA64D3969A08757CEEDD33E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209125, "uuid": "ef17008e-f9ac-4f7b-b157-f292128d55ef", "value": "24576:tw8ql1zgxh9yqqHtGfWxutGtsyFQ0T6AmsIgHVia+XTloaTn2b597xGbfQlG5oqd:y1uecjQxN9Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209125, "uuid": "b63b2664-bd83-4ba9-a67e-d9df057f3330", "value": 3654918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209125, "uuid": "5f8a8317-46d8-4d32-b2ef-22268836afd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209125, "uuid": "3888a82d-a1dd-40b8-a2eb-abb8fe9b9d46", "value": "obfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2aa1d25-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681195690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195690, "uuid": "4603526f-7d83-4794-8551-6f223b857a25", "comment": "Malware payload (Formbook)", "value": "a37dc47f86e84e5d0d2e6414c3cd5272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195690, "uuid": "825ec21a-db15-494f-939c-43cb6a6dc5b9", "comment": "Malware payload (Formbook)", "value": "5902402fafb4be22faca64535718137ce5afd70004a14657daa9e7c6c3240feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195690, "uuid": "b8b2ab80-9cb9-4caf-b1e2-a4e0336cd99f", "comment": "Malware payload (Formbook)", "value": "7c9a14ff443cc5de805200d6bcc750d64fb4b677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195690, "uuid": "62518ef0-c8b3-40ab-9bc0-11597faf9697", "comment": "Malware payload (Formbook)", "value": "f43708a2f9006d112446511d921580460b8287a974ed967b1ae834723944527029d9fb22de023043808b013aab36e351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195690, "uuid": "e82b40b0-1dcc-46b6-aa0a-d9173d019155", "value": "T16E6423A20A70E437D8E246315A79917F9FF2BB2311F85B4397C0A6193D322D1AB1D70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195690, "uuid": "200bfab5-fa84-43d2-9dfa-3aa99a1e643b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195690, "uuid": "be78d707-2f34-4746-972b-522d160d12ab", "value": "6144:XhtyHU2Gthj3FRzxZckklMg0GGOvGmADclkMo6xkHwQEel:Xh4G9NxWBZ0VOvGm+cpRxg/Eel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195690, "uuid": "30a2979c-7389-4c47-b84d-7f71766d0896", "value": 315768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195690, "uuid": "3a09dbfd-9993-48a3-889d-74ac59fefeab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195690, "uuid": "bb518483-3398-47ca-bceb-1b56c820f32f", "value": "ekstre_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc82e28e-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231730, "uuid": "ad23bcb1-b1e7-4b80-8bf1-e6508a1a3d08", "comment": "Malware payload (Mirai)", "value": "22492cbd1a7a05c36f3505e60c263926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231730, "uuid": "be4a7739-c7df-4676-852d-106100eebd87", "comment": "Malware payload (Mirai)", "value": "5a4d97755502d7cd770c40bfedd4edc948710c62bb1fab4cb34511000dd65b63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231730, "uuid": "1aa5ff08-3d99-40bf-b4e5-feebcaa24b1d", "comment": "Malware payload (Mirai)", "value": "30f248dd8b17ad26525de5c57c0454f0a5b142ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231730, "uuid": "92c93082-0c3a-4d2f-8037-94b26a0d2664", "comment": "Malware payload (Mirai)", "value": "517763b6749bd99f3a777f7a2c4e0264408306e2b2323343f836d11b6cb54a6a42226a894da92ac8f8d15a624dc46eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231730, "uuid": "f799f926-0bba-4466-a26a-092f527d0022", "value": "T1BB33F1BA429BAD61C2B056F7153D549D64162738E3E5F00366250470EACB2F35AFEBC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231730, "uuid": "f006fec9-8fab-4e7f-93b3-fadd3987269a", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JCL9VE8amFZP7R3Q:Soqs2Twh6P8JCLJ9ZP7R3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231730, "uuid": "48480743-0eb9-40d4-807c-0e4c2ddfc6aa", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231730, "uuid": "f3e113ff-7ecc-4560-8d9a-8461e877012a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231730, "uuid": "8ceb59ae-75fb-4c2a-a731-65302d298b56", "value": "22492cbd1a7a05c36f3505e60c263926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c413726e-d8b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1681251929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251929, "uuid": "9ec31fe8-9ad7-4526-bedb-56397cb5df92", "comment": "Malware payload (NanoCore)", "value": "b8108213532749bd6108ae3567dd0f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251929, "uuid": "31ec6976-4b58-4be4-b049-64d38283ac8d", "comment": "Malware payload (NanoCore)", "value": "5acff739c079031087e40678c6a469c7e6db7e49447dbab5d679650c52f1f326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251929, "uuid": "d99b398c-686b-4984-af43-113069c77a42", "comment": "Malware payload (NanoCore)", "value": "0999006988315880cbb7458b00d9681236f79966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251929, "uuid": "a5acca36-4ca6-4486-bf1a-3f801564b686", "comment": "Malware payload (NanoCore)", "value": "b1704924320fbed4c3a0167e4156f5f68afdf6ea6c703f7e4782eba59f1b547b8e6690d414ffa8fadb0bfce6d935ed65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251929, "uuid": "cfd8d5fc-efa8-425f-a4b0-750830663297", "value": "T11665C043B3A580B2FE46A2F3BD65B786477D5D354133402F23A93C79AE721B2421E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251929, "uuid": "ea1bc31b-c28b-4fe9-b812-35921484f852", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251929, "uuid": "67ed2d81-a98c-4312-8ae1-f68468eee3a7", "value": "24576:dA7LDMKOYac6idXy2xwO6cJ0qzaEOhm3Au5ZUYbqU2Kj5A:qMKO3cVMIwbcyIaEk9IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681251929, "uuid": "54664605-edb0-4db0-b218-c0330584308c", "value": 1486952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681251929, "uuid": "b138d72f-56d0-46ba-b29c-40e6618fec66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251929, "uuid": "145b27bd-7cc9-443f-800d-ac5283d15fca", "value": "b8108213532749bd6108ae3567dd0f15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4d577d-d801-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681173854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173854, "uuid": "d75dac3e-de35-430f-9611-2c2de1dc250b", "comment": "Malware payload (Amadey)", "value": "7ba493942bcd5acb4bb739deba097d6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173854, "uuid": "ec549343-131b-41dc-9233-cdcf7e02c4be", "comment": "Malware payload (Amadey)", "value": "5af367329e970fc924f0ad370490c6383a32faf73ce67e3e167c2e101ee91fce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173854, "uuid": "80ab330a-5a62-4962-9dba-09dadf8c0b41", "comment": "Malware payload (Amadey)", "value": "a70b7e1925268c4b0dba4250d4f4fac00b62a55a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173854, "uuid": "ece25327-4b02-41dc-b177-fe348aeded53", "comment": "Malware payload (Amadey)", "value": "82dda9bcabd8018beb6534e0903f9f280b372eb1da826ac4fdcc00aa8935649051929b096d3f13c3bef326520fff4775", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173854, "uuid": "7bf4c85f-d839-44fd-b910-9136f07ce58b", "value": "T174352303A2C9D033D5B41BF059FA46D32E31FCA295D453AA3B82AA2A1D325D5B07177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173854, "uuid": "1a266752-7e57-4505-b7d6-cab865347133", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173854, "uuid": "499ffcf5-3f77-42f6-8d73-79fdfc913f24", "value": "24576:UyD4bM5vV1jfyTvodWmpVWxefFdaXv/HVSo5bzKo:j0A9yU0m/WxedqXHcYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173854, "uuid": "82968752-4c2f-4439-ba5c-79d588a668d1", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173854, "uuid": "83f71784-3c47-46f9-8b90-f4150ca45eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173854, "uuid": "b74673a0-7ae8-45ba-b033-d11f6e192bd8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45078d94-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1681204472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204472, "uuid": "a96331f6-2d31-42b5-8d67-7a90acc7f5d1", "comment": "Malware payload (SystemBC)", "value": "37887c9dce52b5f8926515cd07e14319", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204472, "uuid": "38854503-e96c-4ce3-983b-3ff0787c5a83", "comment": "Malware payload (SystemBC)", "value": "5bd7522d5fc9974eec5366697ee99480abb6910302d0250838022d6758024fa8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204472, "uuid": "2cd9b72d-21fb-471d-afc8-d5ea471ac297", "comment": "Malware payload (SystemBC)", "value": "4d2e946233a43d028cde5b9f4a5dd032eb44b2c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204472, "uuid": "4abc41a1-2e84-4cab-a62e-6219b4c98e5a", "comment": "Malware payload (SystemBC)", "value": "f3b8acf4ce34c738054bf49983081dc201c1f4c17b9062ae0a75ff65047310abfb04e6945aa279a9d148ece9bafb4085", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204472, "uuid": "dc4044d5-1e12-4cae-8388-35c754f3cf20", "value": "T16765DFD62B4A140AC942D630A4D0B66D9BA21CF8F955197D7B80FFBCF43ADD436C2932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204472, "uuid": "86a9f5b2-c0eb-47ec-b73f-38d9d929e97a", "value": "a2833106949ae6e20c40ed0128f9df4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204472, "uuid": "819af646-ee53-46d6-8915-4a151ee07fea", "value": "24576:f73hUyP/uQ00lVmJLWr6pOvcZwMgr3GRsFmAFjbc9IiLR7s9XP65HvefXN2wD:VUyWSZ6kUZeGRCjYI2R7If6e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204472, "uuid": "2baee03e-e742-4077-a67e-c0038cacce0e", "value": 1536608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204472, "uuid": "2089edc2-2e38-42bf-a23f-5a8f817459cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204472, "uuid": "68a1ed15-1259-426b-b1f1-149aac8e2a99", "value": "37887c9dce52b5f8926515cd07e14319.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84579a7d-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1681214027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214027, "uuid": "06c7a9ae-15e1-4a05-9cda-7df0254aa048", "comment": "Malware payload (Tofsee)", "value": "3a746974da0c50d746aabe922ec4e7d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214027, "uuid": "e95ba430-b5ca-476d-aa64-5d15f4ce914b", "comment": "Malware payload (Tofsee)", "value": "5c3c394e210954a18fab99b23fe51d874d5395a867ffcacede8286dacf463960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214027, "uuid": "f066ecd4-9582-40bf-8c5c-f08225ef2dfc", "comment": "Malware payload (Tofsee)", "value": "c37e1beca1da2866961a51a75a4358c78e32997b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214027, "uuid": "7959ebcb-a74a-49b7-80b2-6238420948b8", "comment": "Malware payload (Tofsee)", "value": "6397896af2ebd5b3ffe12669cc8ee5e57df2cde8d031262bc53be7c028048ffb3f3e2f3f83c3d7df68536d71f793f425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214027, "uuid": "88577022-4e95-4ded-af8b-6643d4872364", "value": "T16414C031B9F2C076D5AF85B80571EAA06A7F7C71AB64C58B33A417BE1E20390572B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214027, "uuid": "f2c2f588-7ffe-42b1-bc67-b52c7c4f1679", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214027, "uuid": "41967620-791e-450e-849e-ad9f212bbdaa", "value": "3072:5LcFddSO6u+H+dNnMRbbue0bdY2NC0fRBdFX:5cl6ujdNnMNbP0bbCOBdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214027, "uuid": "6d72ec46-2f33-485e-99cc-5bf8fdedca82", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214027, "uuid": "38c884d3-81a3-4bb6-9d9f-037344557ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214027, "uuid": "dd3dfb55-619a-423e-b855-e7d9ff85694f", "value": "3a746974da0c50d746aabe922ec4e7d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb88646-d89e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681241211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241211, "uuid": "dca0415a-2d90-4dd7-a83c-bb7ac0049f60", "comment": "Malware payload", "value": "1a24924e061bf81546a26f3f14fb185b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241211, "uuid": "e0a8047a-07bf-4357-b720-04995ab8c62f", "comment": "Malware payload", "value": "5d1ce3ae54e2ef9b7075931c1cdd2f81242cdaf9658dc00631b9cc177c6279cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241211, "uuid": "c8aaae11-1735-4305-8a47-e80e21113e11", "comment": "Malware payload", "value": "b297631a138b42a56ffab1d0fb89ca90d2d145a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681241211, "uuid": "0e6387d1-a66d-422b-93cc-97d70ccecf82", "comment": "Malware payload", "value": "821e9cb9a0d3fd66e7b021eb490020855827a687faf7fbf830f094ccad2c0aacd32fb9156d7bdc62ec0682a5b18fa4b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241211, "uuid": "e2f1470c-5d2b-4319-b008-12735ec5f77a", "value": "T15E745C316453C73DF99199FEDCEE52A04FAA255207B120EBDB8C03994F228E1E53D19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241211, "uuid": "679d6326-1f2a-44f6-b404-7455993af0d6", "value": "2284a2d8a1a144e12997e0416861622a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241211, "uuid": "2956d433-20cc-43b6-bbc3-cdd8c996e7c4", "value": "6144:VC442p39MVyooBAzqQmtpxqNE/F+xaICc0ko9:VCD28VrqQWqG/M4ICHk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681241211, "uuid": "fe46203f-5a8c-47da-b5d4-8007ec4aa845", "value": 340232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681241211, "uuid": "6324fc72-af64-45b2-a867-fb2c5b1c2b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681241211, "uuid": "a4705841-4fea-4336-b9f8-b5ca17fa19df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b620f22d-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1681218835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218835, "uuid": "902e4c35-98be-4d7d-a57a-32293eff745f", "comment": "Malware payload (ModiLoader)", "value": "6a5f45b15eb2ca3a5e924048cc8e24c0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218835, "uuid": "fc27ce86-1ce4-4084-9bfd-399ff0fdd6a7", "comment": "Malware payload (ModiLoader)", "value": "5d4660252f2bd91774a064553be39c605713e6d4da8d9a1a0a3eccdd377cefdd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218835, "uuid": "1aeed8e2-42ab-4895-a12c-d3c9ef7d732c", "comment": "Malware payload (ModiLoader)", "value": "31cdc14336e718427478052d13f26d6d431b1001", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218835, "uuid": "55ac8821-94c3-401a-b9c5-d334a1826f89", "comment": "Malware payload (ModiLoader)", "value": "6c3b842f0f8cada1fad38bdd15dd7e2432816424b457cd39bca9b022ac717bd5687ffcb222b42aeaf75d18178f36ea2e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218835, "uuid": "95272c39-6e08-4461-9e8f-32b784a94eb6", "value": "T1D3D23F5AE79F02748F5112B2131E0AC996BDB23EB35154B1786C837433ADC2E46766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218835, "uuid": "8747738d-533c-4b40-b5ca-d853c3c3674f", "value": "768:6Fx0XaIsnPRIa4fwJMnKRNn4JXGZJEqEYAJ:6f0Xvx3EManQGZJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218835, "uuid": "e447903f-98f9-49b4-9aff-9948f2d91dca", "value": 30682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218835, "uuid": "2e5cb888-f599-4810-b64a-6ac2dc727101", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218835, "uuid": "e78c886e-e013-4670-9915-dcd22aee4b1b", "value": "INV-PAYMENT-SWIFTMT103.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc29650-d88b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681232729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681232729, "uuid": "d2604cff-56bd-407e-81b9-71ace2f1317d", "comment": "Malware payload (DCRat)", "value": "79066f3b2ee843768595cee53e1ba578", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681232729, "uuid": "62e796f1-bf8b-47fe-984f-f95e3e6d4026", "comment": "Malware payload (DCRat)", "value": "5eed5d475bb5edd1c0a850f5f7466bd0d7f0e1041b348cabbc25993409df3c92", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681232729, "uuid": "0bf7cf43-4592-48fc-a049-087844fc6f1b", "comment": "Malware payload (DCRat)", "value": "9d1f84f65d2e46de7d649d113ea22af27de3b9a7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681232729, "uuid": "9e2912e2-cd03-429e-88b1-52a6c2a3e8c8", "comment": "Malware payload (DCRat)", "value": "93c60e70211da28e3228f05ff6a92432d6f0550f3626f813ce876072b37381fd0a429ebc70d06a987f37b48d6f5ac90e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681232729, "uuid": "465a2b7f-0c58-45b0-8a8f-3eedf24054dd", "value": "T1E846330B3AC2A6F1E4B112765D1BEA355DA0AEB13B1587D361E05C333D719C97A3C28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681232729, "uuid": "bd3a929d-df85-455b-af28-f581e5b10ba8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681232729, "uuid": "51bf72e4-f0b8-428c-8e33-80fb168114d3", "value": "98304:AA5q86kOXLsq4ziq6HOqs6ll8lBcX8vbYe8xgxorYlubp0DgN:AA83Bz4B6HjswYcJ6cp0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681232729, "uuid": "0ce935c0-dc11-4a14-85c1-630644e6eaa2", "value": 5604056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681232729, "uuid": "c36bf5f2-dce4-405d-aba5-79b987c78973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681232729, "uuid": "13e51e7d-2b72-4b8a-a710-72c9848c95ee", "value": "5EED5D475BB5EDD1C0A850F5F7466BD0D7F0E1041B348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f679528-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681214072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214072, "uuid": "21ae3868-f911-4f13-ae4c-a8fe323c1222", "comment": "Malware payload (RedLineStealer)", "value": "b76bf391392987fcb77029bb49b0b790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214072, "uuid": "e6825c5a-638c-4204-ba45-e2e91b71031e", "comment": "Malware payload (RedLineStealer)", "value": "5f39096e0d82e84b77fdd6e4b82becc807943ae78c4d7b0fb349893bfde37d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214072, "uuid": "9b9c0dc4-150f-4f7f-b9ad-c81bd2282b56", "comment": "Malware payload (RedLineStealer)", "value": "9c0f990fb694e77ed514d40ae70f3df15559116a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214072, "uuid": "024c8b2b-d88a-42f1-8b38-cc0f148d8ee4", "comment": "Malware payload (RedLineStealer)", "value": "65f0bcc606fdf5ba0b1e6a6364d0125f056185ef8ea0b677de9bec4aaaad60f2dda601388957fed5037fa783441a7fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214072, "uuid": "5f97dc22-e41d-45dc-91c0-3cc4d1f54cc6", "value": "T111F41213F3E88063DDB0277049FA16D30A367CB1AD79563A27869D4B1CB3295A53077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214072, "uuid": "6311b144-2d75-4818-9a70-7be2e9a0c4db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214072, "uuid": "70181536-3c89-45b4-a59f-cc1a2c48be1f", "value": "12288:XMr1y90gFYbc00WvENemP9goX2ODsz3Ec/P15u7tmPT4p52Wv9R6BkW/g:OyTF2PvEN5P9gRPz3Ec/95u7eTQuBl/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214072, "uuid": "82683c9a-45e2-4a6a-9250-97d0d83e2027", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214072, "uuid": "55a1b4f4-8779-4223-90fa-960582b838bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214072, "uuid": "4e0c05a8-355d-45a5-9865-242bcc91e9a1", "value": "b76bf391392987fcb77029bb49b0b790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9e976e-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195596, "uuid": "e0380ccb-4012-47a3-8a7a-bc73edfdd24f", "comment": "Malware payload (AgentTesla)", "value": "487a74205880d95f9cc0336b64cbcb49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195596, "uuid": "07f1f575-16a1-43b5-9c5f-714cd9be9554", "comment": "Malware payload (AgentTesla)", "value": "5f96b8f9f8017b0e1061bca5915de149e5e715bd5213d787b1660ddcd6bd8bcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195596, "uuid": "3ee619db-05b7-4067-8acc-3bf2abf34ff3", "comment": "Malware payload (AgentTesla)", "value": "7737f966346b5c11daf9c955235c35a8503f680d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195596, "uuid": "4b3aa93d-22bd-406d-bd7e-25aed3c89330", "comment": "Malware payload (AgentTesla)", "value": "7cda9092664017077d553df14a713c08a71f2d68a0c65b85bf373b1473b8437ca593c270566b1da4d840644b9e3f65af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195596, "uuid": "cd69828c-8f60-4c6d-8502-e939bddcbd50", "value": "T17C059D2D6D4F4622E178E7749BA18060F3ED9063771BFA2F6CD265C40B12A82F9CC56D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195596, "uuid": "2e832950-b940-4adc-b82f-d9b9b59895c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195596, "uuid": "b017e48f-582e-40b8-b525-46afa98649c0", "value": "24576:UD617GJrYvXLdhys3TrgMrOEff5C8QiQg359GCgbGqpA+kx8twm4x8NfsadVi1gJ:Kg3rdZ+3twlKfsmSgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195596, "uuid": "049f4ef9-8b32-4919-9ea6-aeb6fdbc5054", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195596, "uuid": "ff822de7-24bf-46fa-a4ac-e6f89a661940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195596, "uuid": "1790fc57-5171-4948-a4d6-d2c9123b8eeb", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b68584-d85e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681213672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213672, "uuid": "742e2e5d-8330-44b6-9dde-949373ee9080", "comment": "Malware payload (RedLineStealer)", "value": "decba982a30f783c2ab5b031a9c62917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213672, "uuid": "4aa380f6-039d-40b0-b0a6-1e11744029c7", "comment": "Malware payload (RedLineStealer)", "value": "6044fd753298adf002b66cb2fb1f237f73678b7422637c0148adf891a975f0d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213672, "uuid": "ab2cd642-3407-433b-8a39-a76476b5b4a0", "comment": "Malware payload (RedLineStealer)", "value": "2a740df10598434978649c343cf7bb4ece2a48d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213672, "uuid": "e3d3a818-21e8-4b3c-82ea-7d3cd3032add", "comment": "Malware payload (RedLineStealer)", "value": "a78763360948b21531eba23214ac80aef1b9e2f901c620de77bde8088e3ec3263507caae59c602d6a32e1bb125823366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213672, "uuid": "866066f4-2945-44ac-99b0-6499fe8fbf9a", "value": "T14E252351E7D8C032E8792BB0ACF507931E3A7D95AE34427A174AAE4F1C735D4B47232A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213672, "uuid": "ee56864e-07fb-40fa-a99c-4d865b5a31fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213672, "uuid": "3617994f-e557-4172-9a42-f7a2560dfb97", "value": "24576:oySyHBlJ8craC/5pZmEeITDo75azoqrA9B+HG:vxhlu+kEeITDo8rA9Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681213672, "uuid": "a001b9b1-3d5f-4402-b0e0-ca83664bf518", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681213672, "uuid": "a7cd725b-27c2-4b70-a434-79e94ee69605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213672, "uuid": "a9a22bf8-1af3-4911-8206-420900f756f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b7656c-d836-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681196262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196262, "uuid": "76b12252-483b-48ea-a218-d303aacdf9df", "comment": "Malware payload (AgentTesla)", "value": "a2e925e4ae63d82a78ba64e4e0fa8b1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196262, "uuid": "0896d015-55ae-480a-80f0-ce7c16e569ab", "comment": "Malware payload (AgentTesla)", "value": "60590830a45ab11321b23c2ad76fc7ec1eb407beda099da07364cc2358d00504", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196262, "uuid": "f4430f46-a631-413c-ba6c-003f59e1e5e4", "comment": "Malware payload (AgentTesla)", "value": "e3aa80e4982ed2141197bbaed9f9e29b7350b33d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196262, "uuid": "a9631c3d-8bfb-4dae-b116-4d66ec2c285c", "comment": "Malware payload (AgentTesla)", "value": "d2653a751028989c6ede0d471756135b91d101d77f285f5ecfa4bbf5d74dc7d50636715b7850ae648856e6eaa5e9749d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196262, "uuid": "0f10565e-c14f-4ef5-9a91-12d68356169c", "value": "T171F48DD42AD68BC4C037B170F05AC7B2C3D2152EE099DBE1389B5989E1D2E511CFA9BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196262, "uuid": "e71721aa-e95c-4a64-a7d3-072e171ba1f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196262, "uuid": "15f6af01-f460-4154-a803-ef9f5071ad3b", "value": "12288:w2iNQe7wh7Rh42xJ7FzamyQI9M6EWArX6pgJX/SZ3kdKuyyVgh2eV/y:w1Uh1h42xzzamfI9fERX6eZ/SZ3kdKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196262, "uuid": "7397a306-ae3d-4a70-88e1-16883d0adad1", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196262, "uuid": "44b5aaa9-93e7-45b7-85ff-cbd05e09a9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196262, "uuid": "16d3fccb-702b-4da7-baa5-6ff4c94e7269", "value": "20230406091109722.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4ffaa2-d857-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681210473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210473, "uuid": "28437f78-573a-426a-a93a-ad07b4fbb5d8", "comment": "Malware payload (AgentTesla)", "value": "637e3496384188cc88c9de07f82dacce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210473, "uuid": "894b4bb6-4ccb-463c-9ea8-b396dc3b075c", "comment": "Malware payload (AgentTesla)", "value": "60c9b621b11318526760b148c7abb264f6b1be5202d5fe9e5833aa744c4cc401", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210473, "uuid": "f41631c7-cde6-4aaa-8bf2-d47313de6a3d", "comment": "Malware payload (AgentTesla)", "value": "5a546bec7bb3daaa1806bf69a1a0191db079bb5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210473, "uuid": "6d05112c-1faa-4d8d-b0d7-59fa6d4b752d", "comment": "Malware payload (AgentTesla)", "value": "f6f48210c03d634dacd95b3ee014ce7e559d78e5ebc8bb011a7ed0b31cb3cce33ceceacc8bdeee4f696d1c386d10fa36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210473, "uuid": "40c38144-0f25-4f34-b3d6-e16e8d5d81a4", "value": "T16954014D114247D3EE6A063AB3368908D3F1F6DEFA43E31B29C86CBA48DB55C4A4D52D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210473, "uuid": "daf71ebc-8327-4586-b8f1-03c9b0b11577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210473, "uuid": "8bb89172-727e-4fa9-b3b9-49d02c912b59", "value": "6144:RXq2Wvc82rFAolO2har7mvDVN0WaIBDy0O12udoEUA:aUTRjZJa2DwldE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681210473, "uuid": "c854f8a6-6813-44e5-9877-554183b69e77", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681210473, "uuid": "022abb06-05a1-4b11-a6c1-85bcb3b63d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210473, "uuid": "10d49e05-4fbf-40e5-aa64-591eb95fc7cc", "value": "637e3496384188cc88c9de07f82dacce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bf71b9-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215430, "uuid": "d149b2db-97f9-4783-87a7-3a04855a83e5", "comment": "Malware payload", "value": "aadeb73cba9aadae0b1ece8d6cac9a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215430, "uuid": "6292ca3e-7987-4ce3-a96b-fafcebb793fb", "comment": "Malware payload", "value": "60e0b9bdeb80607d09ef8bdfd837bfcf07ea61aa0b575beab13478c208bae72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215430, "uuid": "cb09f2ba-7135-4765-858c-81a43625d9fa", "comment": "Malware payload", "value": "304111cfb2d390df07162506c47b422afa63aa13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215430, "uuid": "7b4a0f8a-bbba-4630-a0ec-3e8357e4da50", "comment": "Malware payload", "value": "24e5160fd54f9b2358aaf770bfdb1834a48619c64164de90455d381cc54605244a3e8d5952fb6742b62d2b1f1c6a1f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215430, "uuid": "f766ef02-db22-404d-9f09-1e3e40603cdc", "value": "T10BE5330A5E66444FCAE60BF8E02BA1E057F01D06FD61DFEBB49D294B2CA535D911388F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215430, "uuid": "25c48d01-0970-4d32-b890-1b3494f71bd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215430, "uuid": "771f4d1c-49f9-4b29-b0ff-ca5189d8c9b3", "value": "49152:AcpB7q28Vf0E/1m6zizDreoqqiNURbs9nLyXPUNvpXJULKHVF18dHmp:lsVsU1vzibeoSU8nLUMtJULKd8dGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215430, "uuid": "e138c6f3-ed2b-47a5-97b8-0f181e527044", "value": 3238912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215430, "uuid": "33344ba0-7f24-4e0a-b7b0-292f9a39e21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215430, "uuid": "b1365709-16ee-41e7-9d86-32bce4007248", "value": "aadeb73cba9aadae0b1ece8d6cac9a40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aec571-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681214051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214051, "uuid": "3b0ddea7-1dd9-4f46-9f3a-64c79ec6fe43", "comment": "Malware payload (Smoke Loader)", "value": "575220368901de2c6875639030dcb376", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214051, "uuid": "f1d3a7ae-30bd-4d00-8007-9bc84d9582d9", "comment": "Malware payload (Smoke Loader)", "value": "61222e013d7a74058e5b4ee838dd40912008e16c7dac4bcb76ef3a8f2e0d6851", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214051, "uuid": "18f93dcc-2cbd-4338-9708-222ddd2ce686", "comment": "Malware payload (Smoke Loader)", "value": "b2556ffa30fd616e088609fac51b02f171775c4c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214051, "uuid": "df06f392-bac9-4fac-9b9f-a3abae74ea23", "comment": "Malware payload (Smoke Loader)", "value": "e879386348a432e238e2181a7a55e46d4ff9b3ff5dde1402d88a5565069dfdce320bbe8cea5dfb8334636dc348ae7966", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214051, "uuid": "ffde17e1-a197-4ac8-840f-5ab02ea7e312", "value": "T1EB14D031B5A1C073C56B81795871DAA4AA7FBC619764824F23B423EF1EF02914B2A3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214051, "uuid": "6004917f-4c9c-4274-8a2d-a540ef1e5e28", "value": "94b862c07f0e4212c3fe2a5391e2e04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214051, "uuid": "0f2807e4-f73c-4f3f-bb30-ad4ca49ba447", "value": "3072:yYrRBDpEiNtU8Cbl9W1cvOB97/tl++bLQjG1x537LJ9j01:Lh/NtU8Cb7Vve9qSLqG1z7Lrj01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214051, "uuid": "25909fc9-8249-4164-8b4e-d088e392f9c0", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214051, "uuid": "e877ab7d-214e-46ba-a912-4ea6ab7a52b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214051, "uuid": "0441c3bc-de87-429b-9cfb-eb0080c20b3a", "value": "575220368901de2c6875639030dcb376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4368b24-d82e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681193062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193062, "uuid": "ce402e1f-adfd-4ceb-b00f-f42ca0527095", "comment": "Malware payload (AgentTesla)", "value": "9b5b537794311e2f861455c0cb67f18a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193062, "uuid": "42112a50-6a27-435c-a12c-c8e406fe0b04", "comment": "Malware payload (AgentTesla)", "value": "6128a507a5867faee4b566f99fd3a386720357f7b61fd16f5968243d3e33ea8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193062, "uuid": "594dcd5d-6466-4d3d-ac76-ac6928c96c46", "comment": "Malware payload (AgentTesla)", "value": "409aa22540834f4c747b5347f8d92b07e9c5c770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193062, "uuid": "20156444-761a-41f5-8939-7da07e96fc4c", "comment": "Malware payload (AgentTesla)", "value": "4bc1464ac0ca1eb9840dce101392ece45e8b41ccf56e617213d0ef9c37e0a72df3312e056ad02a71cd3798e2e636157e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193062, "uuid": "7a662c3c-4f5e-4a69-932d-c0e5d774d7fe", "value": "T194D4237B78A5834BB90F10A0A04568C57D6DE9526EB43CAEFD33078D6E6863F16F60D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193062, "uuid": "07d08b89-1ef5-44ee-87ff-37a2da34ce47", "value": "12288:ia3/nMrW4raHCNA6+9LaEz8HHguyiwAvazWkWDaihROUHxRAeLUrJRG7tgYR:iM/nMDJhKLaQ8ggviWkWDai/OGLUrrGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193062, "uuid": "bbbbfc2a-e2b7-4aad-8e7a-7749f4fa9030", "value": 621665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193062, "uuid": "2837b0e4-f873-4fbe-a734-d5591be7f018", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193062, "uuid": "a4c1a203-5a8f-4832-bfa3-9c55e44e8af0", "value": "SHIPPING DOCS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4dd861-d8a3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681243055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681243055, "uuid": "8df70ac5-bd6a-4802-a2f8-91665d0da11f", "comment": "Malware payload", "value": "119fe2d64088f9c581433f75c35fac93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681243055, "uuid": "99dd9b7a-c6cd-4779-af74-7b9dde9d7d25", "comment": "Malware payload", "value": "623cb799efc758a9e1de46b7c5f209781e3627a11b06b9aac676e21a6363d71e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681243055, "uuid": "51f769d7-1caf-414f-8dad-0e146ae31ea3", "comment": "Malware payload", "value": "72c17a80c9e431935cd2d940212152896e07aba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681243055, "uuid": "726db430-5621-437e-a7d5-b8b1e0138696", "comment": "Malware payload", "value": "17bc39dacc36d1b7cd03b8279d312652426df7f9ebc0efab6af7e2980825b8497274c7bf3a3292202e1172bf9afecae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681243055, "uuid": "11244980-f9ad-4de4-9c74-4710fa28f371", "value": "T1E3646D316053C73DF59289BADCEE53A04FAE25521BB060EBDB8C03558F228E1E53D19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681243055, "uuid": "ac18c48a-aaf7-4c56-ae26-6dd80c2f0c67", "value": "2284a2d8a1a144e12997e0416861622a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681243055, "uuid": "260f0888-7ac2-42fc-8796-03ff9b37b4c8", "value": "6144:w1/O2BihAFX7loospHs9wbS8AqAPXlwBEBuxp:w1W2U+X7IxmqAvlwBVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681243055, "uuid": "d288ff70-db02-4cde-80aa-17113dbcadb9", "value": 307464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681243055, "uuid": "91b7f6c8-9e49-48ab-b76e-83392a4bbe64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681243055, "uuid": "77c360aa-f7ae-435f-ac16-0cf829bc5bbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ffe49-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681208879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208879, "uuid": "4db3d6e3-acae-4fea-ab2d-9086206cb546", "comment": "Malware payload (AgentTesla)", "value": "5c8c0b605e0fdec7bc19fff4d6d1cd23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208879, "uuid": "4b16ffa7-5829-49c7-8aa0-1fa9c4046000", "comment": "Malware payload (AgentTesla)", "value": "63ab4748c1ab681a7376fa180f0cd9aa86c3739ade5e86babee3896fe13094a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208879, "uuid": "927d89c3-9df6-4788-8db9-4e74d73aa12e", "comment": "Malware payload (AgentTesla)", "value": "500d8e5f56454dfd6891cd67e62e88f5044ae087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208879, "uuid": "84b813d8-4677-4910-b18d-afac4cbc0add", "comment": "Malware payload (AgentTesla)", "value": "d1e5da04a05543f25a55ce277e39b7d5cdb7d48c6ae66b04156e12521158404e1d7cce7cf989d9c0b8b4316d15b6e840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208879, "uuid": "86de08e3-ed34-44f9-8135-f22eb8e9ebe6", "value": "T155642202B3E0C877F8C35AB12F7D41A96FB5620806F2965F1750A62E78B75C2CB5CB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208879, "uuid": "8b5270ca-264a-4c3f-9898-fff8afa663a1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208879, "uuid": "16ebf4a3-10fb-4ab3-9acf-40f32e9aa061", "value": "6144:PYa61jZiaSZWhbUdtyVtZNa2aPrjlb6Mi8I/wimMmJAY5y0:PY3jD6J7yVkXPAMvIePAYA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208879, "uuid": "1475a9f1-65f2-481e-875b-58b0cda02621", "value": 336035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208879, "uuid": "65874cab-93c3-4cc3-9d4e-cb451fc1311c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208879, "uuid": "10e26c47-78e8-4d4d-952b-6f2aa94cdde1", "value": "REQUIREMENT100420230001001010.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69578099-d803-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681174468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174468, "uuid": "5a1adc5e-45fc-47a1-a018-3877246ccd54", "comment": "Malware payload (Amadey)", "value": "ec17f820f75e89418bae6092276ea864", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174468, "uuid": "5976b828-2621-4694-a952-d7d0212695bf", "comment": "Malware payload (Amadey)", "value": "6401beac5c47adcd4fb927141e3dc9834799dc4d2a29c7f74284ea6d3c9c05fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174468, "uuid": "eaeacbb1-caa8-49f3-b9b5-27ffe3beb61c", "comment": "Malware payload (Amadey)", "value": "4aad82d971eb6c5e7219be248192ecbf69f4ab85", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174468, "uuid": "5742b608-1f1b-4696-8da1-e498e697d52d", "comment": "Malware payload (Amadey)", "value": "ac1d18978fde7d34929af85c891f897211be1931cf7b9f846ae35a9006225b7e2f6825d6d5b2b3080e4409a6b19ba60f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174468, "uuid": "720c6cfa-f091-41d8-b3c0-87dee6c86e61", "value": "T1A214D0227AE1C0F3C46F85B15961DBACAA7EF8614354824B233457BF1E20BD05A6F71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174468, "uuid": "0749edc8-e2a5-4236-b29d-1395cf5fd295", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174468, "uuid": "5a38f240-1464-41d6-ae94-36e007ace6a9", "value": "3072:L0M28aFnh8oTNENhHfSzRj87mWXAfbiTm88RdPLcuWKr9R+63754YAO8+ez4+e:P28W+yENdqdImbim887jJ9nL54Y6+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174468, "uuid": "3ba22dff-1818-4a0c-a436-e9608cb00338", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174468, "uuid": "479735bc-b7cf-40ff-a47d-001c5b9308ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174468, "uuid": "39842569-4322-4025-b0cf-07724073aac8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b2e471-d82a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681191267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191267, "uuid": "b3c2d17e-1dfe-4c72-832d-c85fabd4076a", "comment": "Malware payload (AgentTesla)", "value": "7710584933533c967c26408628a1abd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191267, "uuid": "54cdc085-fc8d-4a64-a0d2-ea3821e45fc2", "comment": "Malware payload (AgentTesla)", "value": "642b084c68d2ab6c7e1b4571dc0a6d7994d5062b5152a475ec73675cc5ef9dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191267, "uuid": "16b3937e-1c3b-4e68-a9c4-fcf5d4cb1941", "comment": "Malware payload (AgentTesla)", "value": "792081ff66e8edc2f765a55c84285fc7f308ed42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191267, "uuid": "1651b66b-4abb-442e-97c8-1a30317abd03", "comment": "Malware payload (AgentTesla)", "value": "c1a35ae715b0d9a568ccb22fa81e734af4f179434a208c032c87355510370cdcb711ba7b1790b622078cc6233bbd8b94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191267, "uuid": "3f8023fd-ad75-4039-8912-ce6e5a85e024", "value": "T1B8241291A2D41C5EC9CAFEB574D438A45FB4E3887BC4CBE63861C5C51B833D2369A1E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191267, "uuid": "ff207ef1-e83a-4e04-a187-edb2fe05f646", "value": "6144:j0q6b8hReA4lUqZm1PhtIaXHBz35BRDVHBiI:jr6b8zeA4lU3HtIaX5FDaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681191267, "uuid": "a37902be-e5b6-48fd-a3cf-5e7c7c1ac98b", "value": 217832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681191267, "uuid": "0b8a7761-094a-4ed7-a591-aee55c1f1abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191267, "uuid": "db502ca9-df49-4908-8e40-0af5d76233a4", "value": "SWIFTMT103-00391MBAP2308101,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e795c109-d841-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681201308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201308, "uuid": "8b5b7d2f-79c4-4293-8841-667b4ff3a856", "comment": "Malware payload (SnakeKeylogger)", "value": "01cbfd73e82f7b031cf5cfc9b5596ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201308, "uuid": "06a0499e-8fd9-4854-8609-26977ac16f6a", "comment": "Malware payload (SnakeKeylogger)", "value": "6460dd52823e39140df9b3bf8dad990f85f0e540b2acbda6a1e6c683bfd14f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201308, "uuid": "0fc693c9-5a78-44e8-8fe7-7996f7f54dde", "comment": "Malware payload (SnakeKeylogger)", "value": "867f4364ae63bb7ed0297e3ff1ef9644c736c5d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201308, "uuid": "b9f45b48-a6e4-457e-8340-91a68940549a", "comment": "Malware payload (SnakeKeylogger)", "value": "429a0f93a06d331af0d5ef2785c9a40210ec4fa0fc95ced8ac3f164b505b11b257e828cabbee79f74164ab343a2a70e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201308, "uuid": "a78de4b6-4338-4763-92e6-972c74820100", "value": "T17FE4D0BCA7649A6FC9F844FC60095A68F7F1BD244181E3533E6476F7A7B33A98740242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201308, "uuid": "ecdf9654-db99-44c4-a0cc-ac29a79faa14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201308, "uuid": "5bee2de2-5618-464a-8833-72b6b6ff3ddd", "value": "12288:v/vzDnnFy2MB8tCsTaSylpxnAUf13xvZdOfeia79:fnF/MB83uRAUfldOGr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681201308, "uuid": "0904ac0d-a94f-4fb9-9475-55bff084da80", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681201308, "uuid": "034f7e20-10aa-4fb1-8590-047cf8b0620d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201308, "uuid": "fe401877-678c-49be-afd1-dc39cf739a89", "value": "20230406141109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a12622-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231752, "uuid": "6d68a072-a3c1-4853-9d18-44f6a0f97bee", "comment": "Malware payload (Mirai)", "value": "5e068a62606e8d57bcdc58ec2bf84629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231752, "uuid": "7e6e88c6-bae0-46d2-bc4f-2cb3eba18d6b", "comment": "Malware payload (Mirai)", "value": "66db22fa29ef948f03c59ca115ac39ab907926129bd556eb05046fcd00139dff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231752, "uuid": "0d7f6db2-6664-4951-b370-d40346455a2a", "comment": "Malware payload (Mirai)", "value": "850c214407e56ee984e155c59437827fed7efd35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231752, "uuid": "9b3d12a6-09e9-4dc4-8105-0c1ddefe9a23", "comment": "Malware payload (Mirai)", "value": "076ed892e8175aab9561d89a703cd445eb1af20f83a5353e7c8124c01ee1ef5793ee8fcde4dc76380feddb2c448065b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231752, "uuid": "5c5b1022-8c16-47c6-b0f7-726a44266215", "value": "T107C2D161E1F62D8AF7797E502A65C2C177704E9EB7B7CCD32558AF0804A72174B05AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231752, "uuid": "7c4ac3a5-d40d-4065-9b1a-e10d68a30335", "value": "768:SG959yM0HWubJsWDYcGuk4uVcqgw09S0D:YM0HRJswYcGh4u+qgw09S0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231752, "uuid": "5027b9f6-f435-4732-9393-5d7aa79a8ac5", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231752, "uuid": "6dd4f382-b83d-4201-a284-6bab3bc796b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231752, "uuid": "a4f48772-270f-48d7-93fd-0241c81fc370", "value": "5e068a62606e8d57bcdc58ec2bf84629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ac3b60-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681215512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215512, "uuid": "fd6bd947-9339-4e37-bfff-dccd07a1d52b", "comment": "Malware payload (RedLineStealer)", "value": "7f0457d39c007d86f5979862bcbb83c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215512, "uuid": "9040b25e-c19f-438d-bce5-6e5f0b04511b", "comment": "Malware payload (RedLineStealer)", "value": "67766df2023a42fdeac1696a21d46c1acaf684dda84262b3ac2b832a00999908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215512, "uuid": "b8b345ec-e928-4a72-93e9-82655b0e159a", "comment": "Malware payload (RedLineStealer)", "value": "0150f91cc8c3d0468b91257d01c976cb68582bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215512, "uuid": "b84ccfea-ef18-4c5a-8f67-fd938e9d4e85", "comment": "Malware payload (RedLineStealer)", "value": "76902ebdb2a9900a02e06673d487f2d27a88d25886ccd25e93bd2ee40d69a819f849309d49261f6b46ad8e23984895dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215512, "uuid": "4f73adac-15b8-42e2-81c5-2de335677c74", "value": "T1BF152202A6E99012E8F647B198F602C31A35BDE1CE78837B3795510B5DB3788A67173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215512, "uuid": "f2ee5caa-5679-45a0-bf95-41a1003217c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215512, "uuid": "dff80393-6db5-46d1-b4ac-48a367cb7bf5", "value": "24576:dyM5iu3u5FTgovJQnNHS265GR3ZmslsK0:4SB3+BgOJIHS2Ec3jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215512, "uuid": "a635171a-7123-441d-a80a-fac22da5f621", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215512, "uuid": "9e80f435-e0c0-4b68-a101-fbbde7f7b687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215512, "uuid": "565240a4-d73e-430d-997f-c46e576e1188", "value": "7f0457d39c007d86f5979862bcbb83c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc314861-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681195249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195249, "uuid": "0396b9e0-4c03-4ef5-8825-a942f1065a76", "comment": "Malware payload (RemcosRAT)", "value": "0e9edeaaacc3b5904935e8f5d3a650ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195249, "uuid": "f9f860f7-cd78-4047-aed7-601201382c78", "comment": "Malware payload (RemcosRAT)", "value": "6803fa63c9748b167d2d49005fe625eb30333c9dae3ecd0f040cbb5f8bd71068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195249, "uuid": "db971cd8-27f7-4ae2-b6c6-e7a8db603eaa", "comment": "Malware payload (RemcosRAT)", "value": "ce828b6b6d4ef64d350163cfc4442f69fba7be27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195249, "uuid": "c56d9dac-aa05-4107-8ddf-032a8188bee8", "comment": "Malware payload (RemcosRAT)", "value": "6f58de17086097b2519a89bd73053deeae0eeb06f1967aedc51672ff64a7537bf932da13c5e4dfaeee2100c7ebf1a059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195249, "uuid": "4db4a25d-f1f9-463a-a124-35c1d564c7de", "value": "T19064C0D7AEA02497CC7A0BB0C7638BA407B1BEFADEB26B2357C431265DE63515134217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195249, "uuid": "c1e51729-0611-459b-9466-cf31a5251b4a", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195249, "uuid": "62950fb9-f1bc-48bc-b468-afee6ef71887", "value": "6144:JaCoWjClRmnTkF6/HeaUX55uHwT578h4N/0yuzaw0QAHdiGJuZvH:JaCTnAhJ5kwloKNSy1S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195249, "uuid": "8d5c2eac-803f-4f12-85fb-cf470641bcfe", "value": 325096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195249, "uuid": "1ef0270d-7d97-4ec0-a5eb-18a2ce6227a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195249, "uuid": "0f2a907a-70d7-413c-8ba9-5a8abf0f7879", "value": "Inv.BKKR008011723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd4e14a-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215113, "uuid": "6da0728a-06d2-48f2-88f7-27b43584429b", "comment": "Malware payload", "value": "bee0a67b8be03061aa3934ec36a92882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215113, "uuid": "af69a2ff-c79e-48ae-9f4c-fec3ee723754", "comment": "Malware payload", "value": "6966816cedea18860057c86faf87810ec906d620dc7efd38d31638dacf24f35d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215113, "uuid": "965da59f-174b-4c17-9d70-26687e6ca044", "comment": "Malware payload", "value": "dd6559ba368b0257d903e932b5207ffdfe943a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215113, "uuid": "d9f7b4a5-090f-417a-90ae-5cd0025ea6b6", "comment": "Malware payload", "value": "193d702c16b3e9f68d24efa938293e35f27acc2845e93ad19e0160193a31c3c6495b498126bcb8de69cc1268cdf1af1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215113, "uuid": "7354efdb-cfbe-41b1-bbdc-999373673a62", "value": "T18F23F1B939947F8BD715DBFE0593DAE470B2E79C5587D0181A3C8BA302E858CBD9006A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215113, "uuid": "20e99721-df0c-48f6-8d9c-1366cfea979f", "value": "768:1h91f3UsUjCbrptfGzJMlOKcnqW1XmgmaHFP2FEDwmcVUz88QUZur3Usa+XKB:1f1+jYNENMA3nqiXmgTHgFCwCz8yYrNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215113, "uuid": "3030d850-2e95-47bd-91c8-f963e079cdf5", "value": 48749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215113, "uuid": "929e2e88-7143-4eff-802c-d702bb700218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215113, "uuid": "a1e50a60-9f66-4120-89ef-f49a05c702dd", "value": "bee0a67b8be03061aa3934ec36a92882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9964e2-d857-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681210420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210420, "uuid": "20ef2429-d553-423d-82a2-8659fe8ff42e", "comment": "Malware payload (RemcosRAT)", "value": "3595ce9be3ec31b7ba6c98f6660d31bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210420, "uuid": "087ef7be-2fe7-4535-aa79-91b29574ec2e", "comment": "Malware payload (RemcosRAT)", "value": "698f8bd0407e6db9e0828829fbe1329a6e11095292fdcee4b3c52f4378878f6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210420, "uuid": "7c413e59-be1b-4321-8229-1e215a7b5a47", "comment": "Malware payload (RemcosRAT)", "value": "13d126fac336f85ea013fcfe7f434ee5f484ecfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210420, "uuid": "d396300f-ccaa-44c0-b56b-43bb738a7480", "comment": "Malware payload (RemcosRAT)", "value": "8f7311b6b1dd9ba4e72b9b1e30fd25807a5c8b8472ab25000a6d44e2f13d0f321d421ce497222bdcc345845588c205d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210420, "uuid": "60e9cf8d-e671-4811-a0a1-ac893a2fc688", "value": "T11EF4AE6B3094A0B9EB6716370E48D21DA1607E7924029E4A32733F7F7EBC7465D406FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210420, "uuid": "0209c25d-9a67-436c-aaa3-d27a69c26949", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210420, "uuid": "0b7fbe2b-c77a-4f5d-86b6-f37372bdc55e", "value": "12288:JMwq9DFYE0qkTPCe/IB7X2sTnzaaBtWugX:JMwwYE0qsC+ItXZ+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681210420, "uuid": "3cc5f5ee-0e7d-4947-8417-5072d885853c", "value": 737840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681210420, "uuid": "3dccb8b4-e219-4c19-a72d-6094b4a4ab84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210420, "uuid": "7329a1f3-922f-49e6-95ba-c6888dcb52cc", "value": "DOc 000399288299991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33b317a-d88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681234775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234775, "uuid": "cc6031b8-31a2-4c69-9186-ee2f7b03c19f", "comment": "Malware payload (AgentTesla)", "value": "af56ac5662931fba5b4a155c0bdb7176", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234775, "uuid": "a613fbd6-906e-4202-9e8e-65277b3281ec", "comment": "Malware payload (AgentTesla)", "value": "69fa15d77275d1d0383f6a1ec7137989a392fe17050cb90f3670e8e834f931be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234775, "uuid": "4bd45b3e-69be-43d3-83db-df6539819751", "comment": "Malware payload (AgentTesla)", "value": "ee9e1897542ff3fb521ba9d473648c63ab94bdf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234775, "uuid": "26f93eba-7f71-4da1-a789-93f57ec2afe1", "comment": "Malware payload (AgentTesla)", "value": "651f307821baad05d6dc53e1871302616307d80d64b4e6dd69fabb2a1cd21c528299be3de9e9f3b3d3fc7971f86950b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234775, "uuid": "e2cb5d64-c95a-4e9c-88b4-9e3b263b866a", "value": "T139D4011D6274DB61E81C0FF4545560826378BAA9F031EA98ACE333E746B2FE254493E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234775, "uuid": "5f9a971f-a7b2-45ad-b206-f7971b53da82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234775, "uuid": "9ca4b720-56a7-4a9a-8976-1c5b653d3cb1", "value": "12288:BnBYW5Viz/dUGSuTZKUcuV6PBPRqUusjsW7OC7ZjQyF9qU0r:BnBRaC+ofuYQWDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681234775, "uuid": "15f59f11-060f-423f-bc16-9dc71feeddca", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681234775, "uuid": "f5f10f47-d2b0-43a7-a820-40efd455325a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234775, "uuid": "a08772b2-9be7-4c2f-8ac7-0a08bd425837", "value": "Request for pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1dbf45-d872-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681222360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681222360, "uuid": "d53597a4-4772-4cd8-957a-843989114459", "comment": "Malware payload", "value": "470a4551c296fd4fff478d38f5b5a605", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681222360, "uuid": "508fb95c-a360-4e2b-8d09-6b5268a5abeb", "comment": "Malware payload", "value": "6a3a3c4d09969330b93e28c76125956492035fb60c25f739bb68d7e45aeaf780", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681222360, "uuid": "35815bb1-81b9-462e-bf3c-ea95736cdf0f", "comment": "Malware payload", "value": "eee5567985dd354d13bb0839cb595922a1994638", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681222360, "uuid": "be493a10-4c12-48ff-b0f4-1fcd3535b63e", "comment": "Malware payload", "value": "cac5e40778017d320fc7462c55ccfaaeeed60c1ee1dbf2595bffeb1585b998ff106536ead29b51a20cfc6d07a6ce2c2e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681222360, "uuid": "01e0a0e0-8c12-4dbe-93f4-591249441644", "value": "T12B073325A3CBC632C15D027BE95EFE2E05397E63533011E7B6B5395B48F18C2A5BCA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681222360, "uuid": "40db4b6a-8d85-4a48-b6d5-909eec9d5e59", "value": "393216:BdwqnLCPeReqEEQJUdcDylAM/IXAaVSsdsSBoZD2:BCueeAqRJdc+AmIQ3Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681222360, "uuid": "454e0ef2-a103-4df3-8cc9-5c7a21eeb7bf", "value": 17141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681222360, "uuid": "9ba56718-901c-4502-8d49-84c57820ee52", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681222360, "uuid": "04da1872-8953-4c42-a957-296e0692b674", "value": "Aplica\u00e7\u00e3o.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cddec3-d831-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681194432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194432, "uuid": "01f8bf2f-8a6a-4941-9c36-9a871f060681", "comment": "Malware payload", "value": "04578f0c939858018accef45969e7f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194432, "uuid": "3cba5d78-3987-4112-a879-99d00a762ebd", "comment": "Malware payload", "value": "6a723c61e1ce4cbae5e79f18e3e82797bb33fa805f4be54e01d8e455e3ea020c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194432, "uuid": "faddc12a-ad18-48c9-9e41-bce67472be39", "comment": "Malware payload", "value": "91cdbb3012719823ceb083c37fa5da44cb04c441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194432, "uuid": "6cbf7487-a987-47fa-95e8-d013a49fe84b", "comment": "Malware payload", "value": "005a3f4814d3dff99be940e6b02a88fdbcf2fab3b4a053fe52b1555c2f16b57da4176afc0b641ea3ee41b54724ac34e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194432, "uuid": "af4da9ec-f20e-403c-a5e4-4359a86208b7", "value": "T1F6068D56B7A800E8D5B7C138C84A4223D7F1BC1A277097DB16A096BA1F73AE55F3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194432, "uuid": "0e097c78-a076-430a-a503-92eadb0261e9", "value": "865edc1a77e22cee4aea42e7e94987d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194432, "uuid": "2e32fefc-5de5-41f5-89ff-4742a8160b59", "value": "49152:RdVwASO6Gtlqc+IU6iqvg6rR7IBNvSiPIH6Qr2EXpw4DFLVHusbD9QndLbHxFJf2:lJ+qXwAHtZzDpkslKLNcYV9IQeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681194432, "uuid": "50126a2a-2565-4d78-a401-ca959432c917", "value": 3899392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681194432, "uuid": "802ecf18-f1ac-4e6c-b86f-7a1de31bab08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194432, "uuid": "e8b1fa4b-6421-45c9-9a02-773c491973c6", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9352b0c0-d8a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242399, "uuid": "d99c2ec9-00e8-403e-b575-7704e7c9696c", "comment": "Malware payload", "value": "0d09bab273d2e6e9ddfe98be63a6500c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242399, "uuid": "c49e6e95-f4a5-4253-810c-4ff05d0d5bb6", "comment": "Malware payload", "value": "6b4bdd66b03091c41c55b66b2dcb706bcfbea63d9edb7b711dd99e377ae9f863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242399, "uuid": "80fd4b41-67f4-4247-ba33-97245f8f1a95", "comment": "Malware payload", "value": "4af9a996d3a6359cb5870c5eba93b53d91e48c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242399, "uuid": "237fc1f4-858c-4021-9099-18c7a06cad0a", "comment": "Malware payload", "value": "1ceefb495515c3701e9f951849ba7bca0b1170403a90b963bdb7d55658a4916e851b09d6b3a2981c8347b738f1451ac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242399, "uuid": "51f3cb9d-10a8-49e4-b665-786c56120b87", "value": "T1990523926670EE20D2E251B07B819DA9976D6E257BFC807231F4B9248FF03C8587C56F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242399, "uuid": "93d8d740-6fa0-4c5e-9c51-922caf954e80", "value": "f4a2dc409ce44da3465d00b2745676e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242399, "uuid": "a7fac5e5-f918-405f-b0cb-0debd427e73a", "value": "12288:+ihzIYnerNITYUF0BPbrmQNpglLtODCGbBPN1g15YpCok9t9hGSDdz0kz:+Mneh+abrVpglJ8/a5YpCBH5DdJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242399, "uuid": "7f70397e-51e6-43ca-88c6-fbc2e68ae47b", "value": 798008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242399, "uuid": "2427341e-c910-45a9-bee9-e6daa6672d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242399, "uuid": "374d5e04-0bdc-44c0-a88e-5a0f7e2d28aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8aa7d2e-d800-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681173339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173339, "uuid": "469f13f6-1f67-4ab9-8b1a-c17cf2f34ef4", "comment": "Malware payload (RedLineStealer)", "value": "f9e7cf7d922514a6b80b98681b6726a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173339, "uuid": "3688f1e1-2641-41b3-bc57-7ca2b0ab2f44", "comment": "Malware payload (RedLineStealer)", "value": "6b7d86171ed72cb7b39075f781ddf025f02f6edeb77dd99a34dded045394a46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173339, "uuid": "d34d6144-e47b-4089-81e9-bfda45cca66b", "comment": "Malware payload (RedLineStealer)", "value": "ca1e638c448dc466b50c6a891eb3f013153d907e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173339, "uuid": "ecc5dd55-8887-42d7-ba39-9001b2427a09", "comment": "Malware payload (RedLineStealer)", "value": "c2ea035ed8f360e310d1241fdb28066de92ac1a0223462d445133786436d1cf014cf67db02b18907405660316d4774f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173339, "uuid": "e8dc7257-29a6-43eb-8631-d3096369bdcc", "value": "T16D051212BAD99036D8B927B05CF607C30A377DA18DB5C32F73806A6A0C7395496B47B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173339, "uuid": "09101b43-4c2e-450f-a5c0-53d49364016b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173339, "uuid": "6f92752f-10d0-4f11-9143-b3f0b40a6302", "value": "24576:EyeLMnMcDEEku08KH4f9NOBb8j7GQKc4oDsYnA:TbMyEEJ0fYFwxHQ7sYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173339, "uuid": "f112b14b-0072-44fb-a672-afc3171865bf", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173339, "uuid": "d0da6663-4279-40cb-ad06-a682e1d16f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173339, "uuid": "68d63b2f-1e1a-460d-b575-552d3bfa6518", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d175fb25-d81b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1681184950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184950, "uuid": "8cecd60c-8db8-4773-aee1-6f9dcac3abda", "comment": "Malware payload (GandCrab)", "value": "49eb4afe5b817ed56eacf504c80106d1", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184950, "uuid": "9423c952-115d-4f87-90fa-15f705ff0cce", "comment": "Malware payload (GandCrab)", "value": "6c1ed5eb1267d95d8a0dc8e1975923ebefd809c2027427b4ead867fb72703f82", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184950, "uuid": "a39a0770-b70b-43ac-ad8d-5bceba9cd721", "comment": "Malware payload (GandCrab)", "value": "f6dcb0dc3bffac56832723ff15c4580bda1f050e", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184950, "uuid": "2d7615d2-9180-4375-8535-43fcddacb724", "comment": "Malware payload (GandCrab)", "value": "d5c1437a42f541ce6555268ad3de4e67d761e2472665ea061b5c28ddbde126e85d325e47455e974cbc1486afb2cf2c3a", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184950, "uuid": "c5e69db6-1ff4-4dd3-b820-2e3292b07fa6", "value": "T1FA248D0270D3D0B3D817673497F053B73D7DB5358A38225B6BD9A9AA7E583618A00FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184950, "uuid": "77a951b5-2b57-4981-8a73-20c77f11c4b8", "value": "d8ed4666ffd9b2589a77cd1e7eb2fcf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184950, "uuid": "82e99e60-6e1e-41a7-9d59-14655161f961", "value": "3072:AoVWBSpJ7sCi98qJfvS0Q4yBNWVn0y2ocpENVQz5V9FIHeJ+z:AoGWJCuqJ3SGmW0VLVzIHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681184950, "uuid": "36423e31-f51f-49a0-a946-d16693c59f6e", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681184950, "uuid": "7802cea2-803c-4ee2-8ec9-032ffa4724f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184950, "uuid": "d588ec4f-c6cd-4e26-9d74-6e828dbd79b9", "value": "new.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca95f4d-d852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681208565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208565, "uuid": "a02c61de-f6d4-48b2-9b39-f69131ea57f2", "comment": "Malware payload (Vidar)", "value": "f85f5d81701dfd84269fbb2890903d0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208565, "uuid": "20519864-ea05-4f42-8937-64a1111c6b21", "comment": "Malware payload (Vidar)", "value": "6c26e5a25958830af43246a52754d4f6686b44cf7c96facce8be29c496561c29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208565, "uuid": "97d2594d-3740-44b6-8e96-aadc03e5da08", "comment": "Malware payload (Vidar)", "value": "db21b987f5e260ea0747091fbc183497c5ecceb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208565, "uuid": "f3042bc6-410b-46ea-b403-089d7f659b44", "comment": "Malware payload (Vidar)", "value": "9c7047139635003109d027f9c9f59260875eca17e2541e625d3953aa00496b66f4624f6b2ba46278e10848d4202de1fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208565, "uuid": "a7470413-bac9-4ef1-b100-a6debe50ca4c", "value": "T18B64F212BA91C077D5B706715821DB706A3FBC71A696868B335CB76E1F20BD0832B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208565, "uuid": "58e9dfe7-c3bd-4719-a596-d3f84a0f57c1", "value": "94b862c07f0e4212c3fe2a5391e2e04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208565, "uuid": "3bd6858e-e149-4dac-ae65-f32fda7e7359", "value": "6144:t9jiKUWVVWz6UmSPFwF25Cz0TYf4RfdyCbSf36ysjH2i7PjE:t9jiAVemKFP57kO7S/6ystE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208565, "uuid": "f8c3ecd0-5305-419b-8816-b40aa6b82ea7", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208565, "uuid": "c7d3b113-ce4b-4e8a-9449-31a208d98f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208565, "uuid": "b3fb4ecb-ee04-46d4-abcd-81f135275754", "value": "f85f5d81701dfd84269fbb2890903d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8759c86-d85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681212826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212826, "uuid": "291c8b32-21f0-4019-ad9e-d6b4dcf3a855", "comment": "Malware payload (Vidar)", "value": "4851971e37ce8cd2b61a795780b7d4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212826, "uuid": "b4a5a913-adf3-4ef4-84ba-4db1a57fe75e", "comment": "Malware payload (Vidar)", "value": "6ca0732c155a15f67928a38c9c9ba8b2f08fb5e90fa38332b94b0457607c208b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212826, "uuid": "d3d66490-c8f1-44f8-9d68-2d5e1f19d63b", "comment": "Malware payload (Vidar)", "value": "eab1b044ddb4df43660b96cf8000e6b0bacf9f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212826, "uuid": "108634a9-fba0-41ad-90fd-517dadcf62b7", "comment": "Malware payload (Vidar)", "value": "8e600159b5f7700d93857ddde729a0e4239b600a7e107ebe5d69d34811922b1374b74353414435ea19eadbd6e6b6d657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212826, "uuid": "9c4bf6b7-4083-43fe-9e57-fc689b39dc57", "value": "T11A34BF053A1C8973CE1E86BF616746AB57B07CA37661C21734CDF6A90B727D2290F227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212826, "uuid": "43b8a95f-6f81-4002-9232-43db20445885", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212826, "uuid": "2fe539dd-c799-4643-9069-8d9b09a3c350", "value": "3072:Yiwwb6hYh8zBR4FGTy8YkMwjmalLUZ7d+a+4alnzr1AXwBdR+6dO6drF4OogCY14:dY+hxl6pi4lnzr8wBWr692c1IOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681212826, "uuid": "ba3df8c7-1803-4254-ad33-27ed48e1eff8", "value": 239656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681212826, "uuid": "1141771b-9097-4b8f-90b3-6c743bd107be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212826, "uuid": "6562d5b8-0013-4e5e-adda-01c612bbc54c", "value": "SecuriteInfo.com.Trojan.MSIL.DCRat.11088.10887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050ab697-d825-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681188902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188902, "uuid": "807c7886-2681-4261-b0aa-80758f182cb1", "comment": "Malware payload (Amadey)", "value": "e24b308311893d0c0cf4f81443b0f071", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188902, "uuid": "330de3e2-c880-4979-ab2a-ba8ea13ae1bb", "comment": "Malware payload (Amadey)", "value": "6d38b6161680aa4e76f1197bba369906b8dd63c768810c141869f0314cd9adc8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188902, "uuid": "25603446-66ae-44ff-85c9-b398f1fd4819", "comment": "Malware payload (Amadey)", "value": "27e6b14c36854ac559d871eb2866465f0d3986d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188902, "uuid": "f1ad2f5a-d171-4c25-8c09-b6666c43a61e", "comment": "Malware payload (Amadey)", "value": "14b496e5a5cf7b3a41bdd1f8a31a6d9e5bc5ccf76d663eaa49d3c07d6dc7431eec63babd5bd2f1bad6c89c1ce56e8e1c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188902, "uuid": "29cb7ca8-6cc1-4ae5-ae3b-f4e828d55e45", "value": "T1DD352256A2E98163F8B917746CF203C30E31BD815B796B6B2601BC2E8DB21C4997573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188902, "uuid": "e473127b-ddd8-4193-8694-db38ce4613f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188902, "uuid": "c01336f9-bba3-4382-ad46-b3edf9b21894", "value": "24576:RyGac+qa1mHijFB8OBpkMoy0Pl5E1S1j:ESYIqFPB6RHj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681188902, "uuid": "20de0a7f-91b1-40f1-a8d8-a7c0d61aab07", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681188902, "uuid": "42693a66-cf09-4a70-86d0-61766a333401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188902, "uuid": "f813183a-3f0b-40a5-b896-2b37be0a2c1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cf8f9e-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681209028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209028, "uuid": "59dc5ea8-ee71-4f64-8cec-94bd865a8ac2", "comment": "Malware payload (AgentTesla)", "value": "373d80490a0782f5658a96e763ea7948", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209028, "uuid": "bcf69a7f-77b3-4fc7-91e3-2dbf2bdd09c3", "comment": "Malware payload (AgentTesla)", "value": "6e41dbab10769aa97a00d63a1b277859794ac4d4ee6d7b5114ffdc7941be3838", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209028, "uuid": "872892dd-5610-4e0e-ae83-2fc174e8d443", "comment": "Malware payload (AgentTesla)", "value": "99211f63a46124386db9b4b66e2becc5537135af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209028, "uuid": "8dc8ed00-a50f-4ec0-bbc3-3d43c979bfb5", "comment": "Malware payload (AgentTesla)", "value": "b319bf22125b5ed448bc4095cf47f14ff510c93209b511aff34ed260209e346cb42de4c339c4a929fd06f5ec3a366837", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209028, "uuid": "9b1b1ff8-7847-4759-8058-6337feb2aab6", "value": "T1E564128276ECC1E7E4A30B7209394B71A9B8BA1055F4F60F13544E4E7E3E6A5E50F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209028, "uuid": "c0808b4b-10b5-488e-ad46-dd0246c96d9d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209028, "uuid": "e1d75861-0cc0-42a4-ac58-87e8785b98ad", "value": "6144:vYa6bLyefd/P4ylyAVgFD4AhgG9sKMynawdDl0BWdpx1tmUnG9AK0J8TCZ6W2EDt:vYRL9dn4yl7gdeDKlna0v6KeAKqWm2TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209028, "uuid": "8366d079-915e-45be-81f3-708c9facbcf9", "value": 331370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209028, "uuid": "1c223d53-c277-4bf3-8504-711bea47a9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209028, "uuid": "baf88bf9-fd0a-4da8-b273-c62f073bb8bf", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dbbdb6-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1681205599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205599, "uuid": "f0c1d601-1228-4f1f-a556-7cfe693cc01f", "comment": "Malware payload (Socelars)", "value": "34e399b27b7692adc98320c285ca6c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205599, "uuid": "70fae742-6749-45c3-808d-82a7e6b74462", "comment": "Malware payload (Socelars)", "value": "6f21df339b77595c9a46f1d5f1a5b2e75fb0a94074436595f8d152f4fa54becf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205599, "uuid": "e29bf824-e255-4408-a210-be07d1fe93bf", "comment": "Malware payload (Socelars)", "value": "7f5b3ac1c873d333177bef853bfdd1ff3094d291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205599, "uuid": "28596169-9828-4f75-8450-b96a4ef4be37", "comment": "Malware payload (Socelars)", "value": "164811c71596f8c4d84a2b4ede410144d3a471e320399b5c933c16ec5c6fa8128e97f69154fd699b7b8b16505ef6df55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205599, "uuid": "bb4bb194-bfab-48b6-801f-da69fae6bd55", "value": "T1B3658D21F7C26032E8E310B745FF66BE9D3C6A21470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205599, "uuid": "30352b32-4784-4bbf-a031-d61bacd3c28d", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205599, "uuid": "7d7573fc-4a94-4a56-b7bb-8f585b22bbbd", "value": "24576:4GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRPV5hcSq:jpEUIvU0N9jkpjweXt77952H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205599, "uuid": "bc935ffc-904f-4ff1-830c-fe10923a76c1", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205599, "uuid": "126a9ca3-1fd7-4d32-9983-2a4056d082dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205599, "uuid": "dba6f8ec-e410-43b5-a6c0-0e66cd5f03a8", "value": "34e399b27b7692adc98320c285ca6c15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3eaf767-d84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1681205087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205087, "uuid": "c8e1900e-65e7-4209-ba08-1941ae62c3cd", "comment": "Malware payload (zgRAT)", "value": "4c9ffbb93cb18b71d26eb03c7df73dfa", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205087, "uuid": "b2c70267-a44c-4a1e-b255-488cae08a92a", "comment": "Malware payload (zgRAT)", "value": "702f4f7d97b663625bb3f652731e79926c2649973c1153ab3a2558363ae9dcf9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205087, "uuid": "273cfeea-8c70-4f8c-9c3f-2c8b40b906b4", "comment": "Malware payload (zgRAT)", "value": "dba1244f99ea1940915138190d99f5a72d0d4bd2", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205087, "uuid": "8eddb1e0-3e55-4f26-8ac3-da158135c150", "comment": "Malware payload (zgRAT)", "value": "fa85bd191f2dfb399aab71c833cc2331605913e70fa02280b3dc1af0159cf2a5f3ff0828586206fc9f5405b857a472be", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205087, "uuid": "c0ff3761-bd4d-4a37-a3bd-465e5d289167", "value": "T1B8617B1457EA0608F3F2AB3A69BE52594E3B3956A932C74E0059414E52F1A40DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205087, "uuid": "7ba7207d-740f-4e4d-88e8-45c943299713", "value": "48:8wHazU9Dmel0iglZ+j+lpQfYj1sAT1rTRRSJxodgImcC:8wH7B0+W6YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205087, "uuid": "1afae378-7af7-412a-ae52-46f68c55ad96", "value": 3446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205087, "uuid": "e6290448-c44d-49f3-8e8e-ea589dffdbe2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205087, "uuid": "881e9618-ddf9-417d-a8b3-f7cdebd9b7e6", "value": "ZT123.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d876db-d83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681200341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200341, "uuid": "b4cf0266-0354-4d5c-854c-d6dc5281a7f2", "comment": "Malware payload (Loki)", "value": "921c468c4da97d0bf69c115008d3ed5b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200341, "uuid": "31751988-2a96-434b-bce0-cc25ba394704", "comment": "Malware payload (Loki)", "value": "7045c991ec53f765057ab46cc884aafabc08fd0fbaf51ea67b6636d361f0df65", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200341, "uuid": "3d9beec5-9bb9-4a60-ab04-f1246a9f9350", "comment": "Malware payload (Loki)", "value": "a118576272b84934049214c778a3e92a1df9e883", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200341, "uuid": "33e48e45-43e3-422a-a69d-fca134bf4c4f", "comment": "Malware payload (Loki)", "value": "1cd47158f9e04bc48055ed706af22b031232d466ee636b09cbbeee909433c7ecd0d347b9c097e263b109af00a134a9ea", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200341, "uuid": "eded7a1b-91c0-474d-bdab-85f46fc120ef", "value": "T17B94235E450CFEBAE31BD8447165D2AFE3258804E1432C5E16EC2D2941DF68B6E3CEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200341, "uuid": "02c1ad6a-6e41-4c1a-881c-2d0861bc0c0f", "value": "12288:Q+eenS07CNjTnLIZFbbLQUAULAfg0+4/3OI/:meOrwx1Efg0+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681200341, "uuid": "1d6f3ae3-7bcd-438d-8d72-2a128e4ff11d", "value": 428420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681200341, "uuid": "53d36897-d1c0-4626-b9fe-f92d46f7c978", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200341, "uuid": "a12db272-02e7-47cb-bb33-5e64c93e14fd", "value": "Swift103.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a202166-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681195971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195971, "uuid": "8d5da7ac-a409-44fa-b93f-9d168a4d880b", "comment": "Malware payload", "value": "a21d7f158c19431c01082d8ee35b8687", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195971, "uuid": "3b0a8e64-7e69-45ee-8d63-684a0227bdbb", "comment": "Malware payload", "value": "70fb8481f48b2226e42fd08936fb5f3d473baca4c9de8188c1649c0e7ae106d9", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195971, "uuid": "0bd63f78-fdd3-448f-b70a-f3513281ff25", "comment": "Malware payload", "value": "29082e912c8c6e4aba19af5b35fd551e759258d3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195971, "uuid": "8b6038a8-0337-47a6-89fe-88e821b5331d", "comment": "Malware payload", "value": "0d2bf7ae5806d84027e5fb25126a8fc66ebb1a9d708f45699e55ebf1384767a2f753c970ce22cb00d4266e53001c5baa", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195971, "uuid": "735a54d4-c29a-49f0-ae66-355782f243b3", "value": "T121B4239AAB5430490F4DE2FAF97F9A2D1B94B5923A76C39CD81068336540CBFED1C948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195971, "uuid": "a9648777-b790-42bc-9f36-ce6b3363f53a", "value": "12288:haSXeS+UNHoQ8VGHn8AhQB1lFfWIilUgn4OnyiC0Ok9hMDLGC:hjaWHoNoHB2BF1hAGWCGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195971, "uuid": "3599c0fb-2c5e-4d85-b3d0-e6abd5a0d0f6", "value": 506660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195971, "uuid": "9f63cee7-ea69-4e7b-9c61-631fdbc17470", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195971, "uuid": "b11bf7ec-ea7d-4497-820c-c1b4855f40c6", "value": "DHL April Shipment documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c48f9a9-d868-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681217718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217718, "uuid": "fcec2ae7-6f66-47a9-bb7e-ea2d73c49e65", "comment": "Malware payload (RedLineStealer)", "value": "3e90e2a5ade62d7848c75f95634cc978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217718, "uuid": "ec35ecc9-deb0-434a-8c67-8d96ec6b0cef", "comment": "Malware payload (RedLineStealer)", "value": "7164b040a832f50e88ffac4512f453af245470a426fbf942731993b4facf4ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217718, "uuid": "b54a2770-4513-41a2-b28e-43f803a5fa56", "comment": "Malware payload (RedLineStealer)", "value": "20c51ee2b32fe588bf14393ff542d0943eeeb082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217718, "uuid": "c99b9219-7cd3-4a83-bcc5-085a817f4296", "comment": "Malware payload (RedLineStealer)", "value": "e8fdd56f5ee6e89278147a40db0bff6ce07297305d49912a4c2985e13ea728ddc891cc6ed400be5d4d96b5990f0bf44a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217718, "uuid": "75205295-eeae-4f94-a96d-cff61c09227d", "value": "T164052203BBE44976DD396B3095FA42970A367CA29C39D3273B06945E0DB35C4E97232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217718, "uuid": "9ee12e3d-3521-4d12-bc69-045bd61c10c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217718, "uuid": "a4f07a9b-d8a8-4af5-959e-7652b618035b", "value": "12288:yMrey90fy5RHj8kZ+GEGQOWnDHEC4Yj2HRNineRbJLTFmbup0OJlfoae6H12ue14:AyRHQ2uGQHLyYUzE+bJLTFGODFFwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681217718, "uuid": "1006059d-a7a3-4172-8a22-cdb6d106b496", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681217718, "uuid": "04eb1943-61e6-483a-90bb-2205fee0fbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217718, "uuid": "39aa153d-46f9-4ed0-bf2e-762a1b045867", "value": "3e90e2a5ade62d7848c75f95634cc978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060bec31-d89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (jRAT)", "timestamp": 1681239155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239155, "uuid": "09786224-2c3c-453e-8a3b-369a8dc90ae5", "comment": "Malware payload (jRAT)", "value": "3bbcc71016cbd15788c307f14d6cab17", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239155, "uuid": "3254402f-7c50-4ef8-8123-97d404dd3860", "comment": "Malware payload (jRAT)", "value": "71f62fd7d5a4c96f931370e7147225109a5357db5a7f71997db0da9acc3f8de4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239155, "uuid": "28e6a1f2-4e0b-44f1-8db8-44f4c25f2a35", "comment": "Malware payload (jRAT)", "value": "3304e6c30bf1eca0ba502a37d8b4f7970c32aee4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239155, "uuid": "49f12a7b-712d-4cca-90d9-7db46b6ab76b", "comment": "Malware payload (jRAT)", "value": "c812991366a253f0e997d9a49a109b00467c96903c4515e84c5965890ba78e4d4fd49a0994b4abb8bc6f838e3e3276b8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239155, "uuid": "df8324c4-7ac5-4a15-be82-0dfa0c492f13", "value": "T175F4021BBD8CD6BFE71B4130116A86221DA4014D9491B66B2B906BB85CB4C740BEFFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239155, "uuid": "7a94cddb-ff70-40d5-85a5-04bd35acaf62", "value": "12288:8RvrLJvZLl+YBVeUYz4rVSmp/88XINgFVfApYdoxT6dKYUyho5PVqwj3suQ:cLJvZHBVelc9d881FV2VnYlo5PVqwj3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239155, "uuid": "d419c55f-56f5-4404-82bb-b6a7d2201f3c", "value": 760956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239155, "uuid": "4eeb26b5-4ee9-4894-a243-a3fe99c76ec3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239155, "uuid": "3c5562cc-1732-4a30-886d-65c4e9b1864e", "value": "SKMBT_C454_23021608270.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077aa8b0-d81c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Lember)", "timestamp": 1681185041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681185041, "uuid": "68ada8b4-84a9-4744-b004-3e78d2432a69", "comment": "Malware payload (Lember)", "value": "77bc069daa6fb0685bf4ed2676651362", "object_relation": "md5", "Tag": [ { "name": "Lember", "colour": "#8C678C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681185041, "uuid": "161480ce-c399-40fc-b437-f852e1830717", "comment": "Malware payload (Lember)", "value": "731b5cf04a4c9bf4b132ea16ed6480641f33abcf5d5afa48a01ef78ac00123a5", "object_relation": "sha256", "Tag": [ { "name": "Lember", "colour": "#8C678C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681185041, "uuid": "890f5113-9a45-4311-9576-564faf3799b4", "comment": "Malware payload (Lember)", "value": "f798e1e10c7d618034961a8b45314b95a634f559", "object_relation": "sha1", "Tag": [ { "name": "Lember", "colour": "#8C678C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681185041, "uuid": "453e3115-d8c1-42d5-a4c6-4435c89e89ad", "comment": "Malware payload (Lember)", "value": "6f962db6c9775c0e44a863904ec9d91d428c5cd1f68dabf56965203c5a7c44fd09fcdcebed9ba40562824b0283b22ce6", "object_relation": "sha3-384", "Tag": [ { "name": "Lember", "colour": "#8C678C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681185041, "uuid": "507a7f5c-021d-4fac-b721-67fffc66f135", "value": "T1BF8412C166A5D316D2B5213E18BA7D010120EE814D39C6F3728A792F6DF3AAC3ED542F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681185041, "uuid": "4c1c9aa4-660a-46f3-8191-94de6a15fb0d", "value": "1343ca50d234527bf272645d6db0664b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681185041, "uuid": "e38bdef8-d96f-4ecf-a06c-b2ca330a5bb7", "value": "6144:VjSQqWg/8GzhvLKjog6ZLTnBQaE3lERDO3936zg4nuSC:VjSQ9g8GzhvuMg6JTnm13lEI4zn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681185041, "uuid": "258a23a4-2ed9-40aa-b2c1-c124313c4bc7", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681185041, "uuid": "dcc0921d-da3c-4353-b3bf-4075c0a855fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681185041, "uuid": "f8d7b118-7f45-46cf-9182-60b9fe354375", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477d6c83-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681204476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204476, "uuid": "6d8d4957-69d2-4308-be9e-2cac22af8371", "comment": "Malware payload (SnakeKeylogger)", "value": "51f7659a2897f3594152f0dbcd44a447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204476, "uuid": "9fb79995-ea89-4b2b-a705-b5829d9194cf", "comment": "Malware payload (SnakeKeylogger)", "value": "73d18d7b6bd92fa3e85db713d39f932c483c0317607b93a2b31845d4e703a6a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204476, "uuid": "8cd61cac-2b4f-4651-a736-450bc7eea6ee", "comment": "Malware payload (SnakeKeylogger)", "value": "a246587f56c4e040a2542f9a231bfbbffaf1c8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204476, "uuid": "125990fa-b356-47a1-80fb-f3689547befd", "comment": "Malware payload (SnakeKeylogger)", "value": "634293d417742c738a487dc36892011c43c08e44dde067d71e856e8ecd13f80218c8906fba4724f2dc47a4d42c949908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204476, "uuid": "6af9571f-9e5c-40b2-a852-8a912b2197db", "value": "T141D4012C2BB1CF21C51C9BBD7044064153B0C2467992DB2BDF87B7D66DB3B8399192AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204476, "uuid": "104fbce5-a51d-4dc2-98aa-ddb500723233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204476, "uuid": "d0a74dd3-9f3c-41f3-a270-88a7e7f8cb7a", "value": "12288:PZqX62hy3JdEKqfzO6mUi6PpvTy67RUZ4nCWl6E3joMnJJLuFRPTQqUW:PH2cn/qfzxBN7GY6wdJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204476, "uuid": "08ca0c1a-c105-45a6-b827-09d3353a6ba4", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204476, "uuid": "74bb1bb6-8372-4d52-a326-9a1c12429764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204476, "uuid": "c6d5bfc5-e739-4eb0-aa36-bfbed304a0bb", "value": "inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cbce8c-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1681214083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214083, "uuid": "c8c9fd5d-5f72-4914-925e-6c0b63512858", "comment": "Malware payload (ModiLoader)", "value": "d7cad34d5c510659bf96b49fffa36621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214083, "uuid": "865c2fda-c08d-43de-a725-c252ca77ddf9", "comment": "Malware payload (ModiLoader)", "value": "73e786d5242a65d25c8ec6f8b76bc4745b200df7cc5a393529219220df8eb126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214083, "uuid": "160d59c9-4935-4979-bb24-44c5cbf2cef7", "comment": "Malware payload (ModiLoader)", "value": "3afc12b8afd57471039c9034b4bd338d7c38b1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214083, "uuid": "74b2807e-b648-4e59-8e8a-79e1c0cc63d1", "comment": "Malware payload (ModiLoader)", "value": "fa23de4cf3669112a03bf060c025ebc320287291aa7acf6b8356102220511b39da3f78165391a0e1d07bedcfac7edb44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214083, "uuid": "5fc9dadf-e3ab-41d8-85dd-a66ebd6c94ab", "value": "T191057B11E5918476E5A2167CDC4BD2B9A82C7F102E28F84B76E52F4F3EF4250292E3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214083, "uuid": "b1f59e1c-b018-41f3-80c6-b5aff0e24ac3", "value": "3d3dfee0b73b800a9bca6b50b5fb8258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214083, "uuid": "c97c994e-dcbc-45fa-a198-b9d0e1e0b0df", "value": "12288:T8rLgxLKQfJJuXFI3MU+oVv6G57D1llttQCMO+U1xldIuau/T2SAzCk1:wrLgO0023ZQK9CO+U1xldqu/T2SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214083, "uuid": "9ca9e630-8d03-4c05-9fe9-5efa8a199e0e", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214083, "uuid": "a3b16061-0441-4bb5-834e-5456a23f9dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214083, "uuid": "07a9b718-fed6-4710-8ccf-728d91ded096", "value": "d7cad34d5c510659bf96b49fffa36621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3a8ec6-d886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681230794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230794, "uuid": "791aa571-582f-44fe-befc-505dadd16b4b", "comment": "Malware payload (Quakbot)", "value": "5390aaf6fac0b4c448b30285979fe9c2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230794, "uuid": "822e5213-fe49-40a7-b47e-50b5067c089c", "comment": "Malware payload (Quakbot)", "value": "742fc41f10c15a25a4a4f597ad5929c8b342039b20aef6ea9e27e324932e995a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230794, "uuid": "f19a25de-bf12-4adb-a995-c79ee674d627", "comment": "Malware payload (Quakbot)", "value": "05fc56ff3d86ed4944e378ac79ffadc75208a16c", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230794, "uuid": "aab18421-0325-4676-8e71-8785118108c6", "comment": "Malware payload (Quakbot)", "value": "3e608b9df4a66db031eb11ec63e10530ffa994c8a8ded122b6462ef575bdb08d5ab127cf78a8b40b33cc8534c266b2bd", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230794, "uuid": "e75f74fd-e45f-4002-a733-75fd1002d71d", "value": "T16A14E7B44902503916776B2E96254C40DA394753CA851107F9FE724CEFFF48CEAACEBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230794, "uuid": "8d70d573-1f7b-480e-b582-b45ea9119a09", "value": "3072:XSKbnv6Ypi/5IBwdlSi0xtfsq0AwZEdO8Rl+ew+H9w/+MGZSswSF:Jbv6asIBwdlSiUtfsqRdvvpw+H9w/ZGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681230794, "uuid": "f7da5fc8-f1ae-4bed-9cda-b1d8717ed824", "value": 191383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681230794, "uuid": "cb2b7d0c-3b7f-43e7-a5b0-0ac9a1948067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230794, "uuid": "c5e01be9-7ad9-4cb1-ac97-ae3dadb4a491", "value": "dp_December.26(58288).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5784e14-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231719, "uuid": "63189195-5b1b-442f-8ea9-f0ccf5f67199", "comment": "Malware payload (Mirai)", "value": "c1bf1c59355dc8b825806912d7ccf69e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231719, "uuid": "bcdf78a1-628a-4db4-8345-016e1bfe6ae2", "comment": "Malware payload (Mirai)", "value": "74a05627dc2f251032732fa45ed086ce22964688c38e9cd9b21debb5f57a1883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231719, "uuid": "d62d05ed-d848-4089-aba5-712f1346a503", "comment": "Malware payload (Mirai)", "value": "e04e59f1165913390b3660521a6679de7d67c5a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231719, "uuid": "d66dc7e5-0061-4d22-aeda-2b323134f3cb", "comment": "Malware payload (Mirai)", "value": "feae285a2d0b09c096e0b73e48b59243eefe17967d7354fbbc9192b512c06543ebf3654cb3226ba0524a042a76221396", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231719, "uuid": "5dd6bfe3-c7ee-40e6-a7d8-a30aae0d05e4", "value": "T15DE2F111691A847EEB308471E0F6818767691FBD79FFB0B24476024DDCC294293E1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231719, "uuid": "6233f811-3cd0-4493-9056-0dfdd8411a6d", "value": "768:rEKkUgXAnURCr6HmDFStmYtJkQ69q3UELd+:nkEn7uHEemQkQvL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231719, "uuid": "992bfd0a-11e4-4897-ab52-a1e99039601c", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231719, "uuid": "0e4c1865-5163-41df-a10c-2f73275beff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231719, "uuid": "9181c3fe-66ac-4f61-8065-bc6e000fcd95", "value": "c1bf1c59355dc8b825806912d7ccf69e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f04def-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242666, "uuid": "155baa7d-8842-478c-bb7b-263f17c86599", "comment": "Malware payload", "value": "45c649d88486a90abd372ba4ad0e4abc", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242666, "uuid": "acecb213-46d9-47b5-b892-44a4435fc177", "comment": "Malware payload", "value": "76b23b03e632208f9c5c64fe935e6b3d4e3765ee9313fad4102686963f249430", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242666, "uuid": "8c7f5633-a7ec-4b04-ae88-dc6aabcca9c4", "comment": "Malware payload", "value": "e52cfc83b823d640c9322cdcf30e45ee461d463f", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242666, "uuid": "47d305e1-4e10-472e-823c-5deb8e6b84de", "comment": "Malware payload", "value": "26fe8f0c7780282a45e503e94684601d9fc5cf55259ed32e9bd9aa0c4a4742f80b2708f958ea83ebeb16d7c51406627e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242666, "uuid": "3177e75e-f748-4673-be80-79c1c08ef824", "value": "T1B46301B6CB61483EF4D05B1BCD2836AA446AB275CBC02B5339B60F047494C48BB5BDDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242666, "uuid": "2352e4f7-052f-4d74-8b43-31b4ba6fa36c", "value": "1536:7a9Fp2poFKI3P95c6nfpUpM4/3/sI9uFCRCsyWABF/l:7a9FQG9+6nQNvsNCRpyWAT/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242666, "uuid": "51c83899-faec-48fc-80bb-0b829182124a", "value": 69815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242666, "uuid": "7a602980-0c8e-4bb1-a5fb-d4d278bbf529", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242666, "uuid": "b946af87-9d7d-44f0-8f21-38dc358825db", "value": "fi-October.28(12).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81963180-d80a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1681177515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177515, "uuid": "a14043e3-c7e4-491c-9d58-a1436fd323ab", "comment": "Malware payload (njrat)", "value": "b51c6c568204056ef6841592c7d95a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177515, "uuid": "559a9527-4bef-4753-9516-3c59e103da80", "comment": "Malware payload (njrat)", "value": "7822e678a094f22573467baf44ddbc212baf5b0e31910babcda2a54b56577511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177515, "uuid": "eafdc939-cd46-4b1a-a314-4251703c2b6a", "comment": "Malware payload (njrat)", "value": "ed17cef4ec9ba47ff0c0cb7b7094971c5453a772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681177515, "uuid": "11ae012a-7014-4b9c-a61a-8405c5b162c9", "comment": "Malware payload (njrat)", "value": "61f90562b8ac3c6bffed8993088a579ecb54c72244cd585db76c92a0e1a9852e1e391739dfcc67b84c9d0e2e790e396e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177515, "uuid": "afca02d1-0d90-4e60-bd48-984806f3737c", "value": "T181032B4D7FE18168C5FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177515, "uuid": "93aef3e5-4015-4240-8833-74a47b7571f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177515, "uuid": "45816b8e-9061-4028-8456-be8f529193d7", "value": "384:AmO30IiejvCVLO309QmykrtG+dA+VfwvOSifrAF+rMRTyN/0L+EcoinblneHQM3M:WOdGdkrgYRwWS0rM+rMRa8Nu0Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681177515, "uuid": "1c733665-070f-42ae-99cc-d754b4950f0a", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681177515, "uuid": "34b53b1c-eab5-4e02-be79-e839ecd316fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681177515, "uuid": "db61fd0c-f9a6-46ed-81be-00ce5d2e54ac", "value": "b51c6c568204056ef6841592c7d95a2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc61b5f2-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681218845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218845, "uuid": "5cb41338-4cbf-40ec-b88e-fc6a31241498", "comment": "Malware payload (AsyncRAT)", "value": "daee3043c0f75c0f4c59998167fce612", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218845, "uuid": "eb07da59-7b82-46ec-bdd4-d22425a00f0f", "comment": "Malware payload (AsyncRAT)", "value": "78538080ae6128c4f51709f34d35aad392dcfcf294f8f464ca396cec0898ccef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218845, "uuid": "14729060-6457-4291-89b2-ee711715c28d", "comment": "Malware payload (AsyncRAT)", "value": "e5da20f955d46925557de0d295d08ddf6b02bb2e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218845, "uuid": "dae09973-d73d-427d-8489-10bec3cb088b", "comment": "Malware payload (AsyncRAT)", "value": "447679bbd5d1a88c386920fea91c8d722f3acb53b5c119763ebfc992d98d3a54c61df9240bf58ff332879d37e488713f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218845, "uuid": "c90cca76-65eb-4d03-979d-bf1e38d66730", "value": "T103E3BF6132D1C865C94A07714CD3C2E62623FC55AFB78B8B3349F76E6E73A90CE42652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218845, "uuid": "9000b760-e754-4717-8eaf-f4a98fbff73d", "value": "3072:VnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAUesrbcZ+Wgg6iQsG44FPUWDAetRydaR:FxEtjPOtioVjDGUU1qfDlavx+W2QnAjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218845, "uuid": "0dade54a-a73a-456f-b9ec-46eb722383e0", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218845, "uuid": "6c1aa5c1-7290-4f59-a357-595ced5f78b0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218845, "uuid": "99113907-35e2-4cbf-9327-3df15cae8c51", "value": "Odeme.makbuzu.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afb9b3a-d803-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1681174524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174524, "uuid": "522d0749-ae8b-40c1-80d4-9b915491af4c", "comment": "Malware payload (Stop)", "value": "93acd64d4daca963de08e0a1a30830af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174524, "uuid": "2119dab4-29ec-4296-a3fa-83d7175293e9", "comment": "Malware payload (Stop)", "value": "78c3e9fa84cb2250614f87a8f83282d29e481830a0ad49d43477f9e505da880f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174524, "uuid": "78464814-dcb3-42f8-bf89-c2e1797b7010", "comment": "Malware payload (Stop)", "value": "7c9d2693e4f2ef719be6d456f2d24b802e35337a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174524, "uuid": "1a3cd268-288d-4489-987a-4ec4519e6a47", "comment": "Malware payload (Stop)", "value": "1a21c5bb313efb573ac3830a0d390a2240213b543d3f4ea7ea97763778be8ae359631dd3ceba93c00224f5002f42bf53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174524, "uuid": "838978d2-645b-4b23-843c-40443f0f3f3d", "value": "T16BE422313A9284B2C257C5305861D66AAB7E7621ABB285AF537C43BF2E373C15376313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174524, "uuid": "7e563adf-b0a8-4c01-ba07-2adab1295ff5", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174524, "uuid": "d57ca714-0181-4a74-9c9d-1546b0c9cd0e", "value": "12288:6QaxYur/o6jm/NZQ7iDUTTj3F098keLNmjFnZKy+DRYLxVHKCfEo:5a7xm/eTTj3S9XexMZKO7fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174524, "uuid": "be24238f-bc18-4b04-942b-729c111b18b7", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174524, "uuid": "2ec53c5b-6486-4774-9849-b30eb45f1a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174524, "uuid": "658d3106-23ed-4156-bee5-bb34e739dfbb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9585dc86-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218780, "uuid": "1d229637-ec6e-45cf-b63a-501d055365d3", "comment": "Malware payload (SnakeKeylogger)", "value": "81f5e6e64161f7a9e41f1586a00c1d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218780, "uuid": "8145402c-0c31-4b90-bd68-69a206956b49", "comment": "Malware payload (SnakeKeylogger)", "value": "79a10af0de5ed3a53f84e7a5f8aa3a53e09dfc43f9113bb893758338147fc3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218780, "uuid": "2b4d5583-e06e-417a-be19-85d895507a32", "comment": "Malware payload (SnakeKeylogger)", "value": "f7175845f5eadebe9a3183fe9dfb58dca659e9f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218780, "uuid": "5a12468d-50be-4692-bd8f-6d3c42b23ab8", "comment": "Malware payload (SnakeKeylogger)", "value": "98047f34f659c1407443bddef5c6d8b7431be034aeeab9010e8c37c47f98b3756c37e5ed74eadfea7c02cb0282790ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218780, "uuid": "4192d747-5483-4ee8-b249-6c0534d76590", "value": "T1DDD4D09C3221F69FC40B8E7688541C546A34B167A71BE657945313EE8A3DBE78E083F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218780, "uuid": "f0678b4a-a9d7-432b-abd1-931dbaa52889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218780, "uuid": "0b5270fd-587e-4406-8580-1176f2e353df", "value": "12288:Cx2AGUpaMf+ycSyzfj2wF2SnH1+UxxilATQvHiTHennji3x1fAF+HLlLd:CkAGUn+2ybjN7H1+ciKUfvnmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218780, "uuid": "ae8e2720-cd74-439c-a1e1-aefb42011ef1", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218780, "uuid": "f1bfd7f1-5419-4a5f-a40d-c297929ff4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218780, "uuid": "cfbeedf5-b7e2-4b78-9976-4fa973fadde6", "value": "SDG09876544-0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c971871-d8b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681252561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252561, "uuid": "0a3e3c3f-3f0a-4b41-bd1f-6276296ce5f0", "comment": "Malware payload", "value": "a38e1732204b077e9a9049db1eaa65ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252561, "uuid": "c195a98d-f890-45de-9f3f-ff05665b7008", "comment": "Malware payload", "value": "79abe0bd4b64ad4bf4d05577398899bc8ca4b4e08a2b3d8fd4dceb518671c0ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252561, "uuid": "16981582-a4c4-4bec-8dd9-3c45a8892139", "comment": "Malware payload", "value": "5373c0a7c1200356c81c756eecd05fae3912225d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681252561, "uuid": "fb271ca9-4ffb-409d-8086-9ff7c3d01947", "comment": "Malware payload", "value": "bb46cc8f07d6c9b9d919d94323774b7a6f1aa1f2457b162b5967d4a204abf39117b6a4380b2b1b0234e734b7acf53114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252561, "uuid": "7320aff2-8231-4d33-a49f-e9a5d8ebbb5d", "value": "T1E874F1317A92D071C84F85341911DBA46ABF7471EEB1C9B727281BBE1E303909E6B71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252561, "uuid": "7decf9e4-0496-4721-aa6f-fdc684614551", "value": "b1fdc126cbffd1158f4f7e2df2177ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252561, "uuid": "67d35c14-8298-4ecc-8191-b5f0327e6593", "value": "6144:QumeGO+d1LpPjT/ZN8F7oe4FhSG48z0b9H7NTHKBjGaIJ:QQGO+d1pjFN8Zoe4LST1RHxH2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681252561, "uuid": "480ee2a9-89b0-4442-94da-a216f485090c", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681252561, "uuid": "47198b4d-7a9a-40e3-90dd-88dbe95855e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681252561, "uuid": "24deb724-8bd8-4b88-8b7b-9828f7997b6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0870f14-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231710, "uuid": "a8800a1e-1a87-4890-b6f9-0c617d929eb5", "comment": "Malware payload (Mirai)", "value": "fd37cf1dfce0d867506971ffe6cc85d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231710, "uuid": "e936f110-1f98-474c-b82b-b8596d779712", "comment": "Malware payload (Mirai)", "value": "7aa6f51ec451a6443ce2e4070839e930fc58e28baf0d9baa830486f0639d55c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231710, "uuid": "9afec7cd-87df-496e-88d4-8434356b11b6", "comment": "Malware payload (Mirai)", "value": "8cf3b60f235fe7e90a0b72483e7fb92c579290d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231710, "uuid": "ac81f464-8922-4cb5-86d6-480c8a22cc60", "comment": "Malware payload (Mirai)", "value": "73f490fb246c7d82c3b626f9ec996f5523ed6c0794ec6e0862e1f83df549b7d75406721bfee8e1d15189add61587c24b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231710, "uuid": "b6156591-d245-4fcd-98e7-3a74ec34c887", "value": "T1B3C2E19364B5C907C8B3837B6F3D59B622605835634EEE2D27695FC833460E0657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231710, "uuid": "eb1819f5-9545-4290-8cc6-128f461c0984", "value": "384:MIe9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5QwDNN5DyBTwfflrTHOBFR0j/y5ZCt:Y5+Kcrb9VDJeU8ETgdTHOBcK5ZCAy5qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231710, "uuid": "40be7551-8ead-4303-99a9-59b58e603588", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231710, "uuid": "a4bf39d1-d5ab-4a8c-92c8-c9f9bfd14b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231710, "uuid": "ed133072-437f-4287-9942-327e84406451", "value": "fd37cf1dfce0d867506971ffe6cc85d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a2a3a2-d83f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681200308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200308, "uuid": "faa65112-e8e7-4c59-b322-38b4a47b094c", "comment": "Malware payload", "value": "4b97ae3c3de49a8fbd26178e30e31692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200308, "uuid": "96796e99-36ed-4946-b3ea-4c17718e95d2", "comment": "Malware payload", "value": "7ae4260fe5baed24e92a413f5ec780cb300bd122ce0ab356a263f62e88eb7314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200308, "uuid": "2a72ca88-e599-4717-b0eb-8a81d8982308", "comment": "Malware payload", "value": "005d94d9d589c207c3673dc83b179f1d85c8c95b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681200308, "uuid": "3865640b-815f-418d-9ad6-5805d40b7436", "comment": "Malware payload", "value": "bebe8149f5d1ed0a239012678a188859bc7058aae2fffc64879046011b25e005e49c60a874299404aedef2a610180dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200308, "uuid": "a0a08146-66b5-4a88-84c6-f9fe51031f1c", "value": "T172040760FFB74CD9E5D2513903D2A321677DB5B08B9D6382E432EDA10E27A852DC931B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200308, "uuid": "f86edfc0-b002-4352-a451-d0cb5a631148", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200308, "uuid": "244e3046-005b-4de7-9ac3-f9b2468a0522", "value": "3072:BbYFFXPv4U5YiItuLhSm0t/FLkNzSqwDxJFWjk0TheqQTKNrE/Y:lMHLPIwgmjN+8jdjQTKRAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681200308, "uuid": "31d24a6e-4da0-4b55-94db-79e53ccbba1c", "value": 181543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681200308, "uuid": "93226897-dc22-4d2f-8562-fbe2b9dc9456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681200308, "uuid": "bb0edd97-5bfd-4e3b-8866-65bb013f97ee", "value": "bs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e93a4b-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218811, "uuid": "97ec9710-9323-4c25-88bc-da604e976555", "comment": "Malware payload (SnakeKeylogger)", "value": "f4a3046195dde4d8c1f137793980fcdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218811, "uuid": "43d36702-63d6-472c-9c30-aff319364638", "comment": "Malware payload (SnakeKeylogger)", "value": "7ae9d7262672f85f6a3f7424320391ddf9ffdf2f194e3a7e90b0f17eeff985f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218811, "uuid": "775835ff-29d6-47d2-85e1-6a59eefc044f", "comment": "Malware payload (SnakeKeylogger)", "value": "a0ea26cd9ca6c067fe6e2f2999060878431d6d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218811, "uuid": "7dfe7495-d765-4705-a98b-c3e16328805a", "comment": "Malware payload (SnakeKeylogger)", "value": "aa47c66e4d465bdb072dfd30c1a640c2c0dd00fe672d9320572f1cf01269d3b152a93e357ac0004e4bceded86c10362e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218811, "uuid": "debd43fe-c0df-422b-9c76-2f9d1cf848d2", "value": "T177C4F1AD63B2EB61E45C0FB520842885577CB345F1B1DA688D9713EB86B3FA120097F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218811, "uuid": "3d80b512-fb45-4d37-a4bf-bb9176aa6ca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218811, "uuid": "7ad946d8-d63a-4365-bd94-a8b2875d6b92", "value": "12288:KcZo8uAb3eKw7+N9eT3A66Jz6Ov+lgHiEI0Na9TBIaW:Ttb3C0sT3ATx6Y+lgHiEIyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218811, "uuid": "334c3e97-4dd5-4a8d-a801-e6452415e943", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218811, "uuid": "40178dd0-3d8b-476a-b01c-a212e53bcc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218811, "uuid": "43f69d79-883f-4597-8740-9620cd0de725", "value": "Product List2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27577db-d8b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681251551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251551, "uuid": "c3157284-f46e-4525-bc3b-c76623a0336e", "comment": "Malware payload", "value": "7364616b220448a19bb9d8a949779a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251551, "uuid": "84f360b7-6c86-497b-998b-8d3c8109b047", "comment": "Malware payload", "value": "7afe400ad217b3f0bcede686bbad31e73e788ad171d530292e23d89accb93ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251551, "uuid": "4dabd92e-308f-4403-ad57-b8b93fee09c4", "comment": "Malware payload", "value": "8c3a0c4eda1bb6a5e5b7f94622e38302bb2fd7a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251551, "uuid": "7f602b45-9b7b-41fe-bbf5-b914eeac55d5", "comment": "Malware payload", "value": "e973521ef96410d3d15b37a36446ab46ca755920a2123a3b9446e6baa801ccf24c058102389c5aec498893219955f817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251551, "uuid": "a4e5a166-7d22-45a4-9a03-47a7b92df230", "value": "T15E763365B8E10872FA120D328914978172BDFC281F3ADFAEB3AD5D5EC6721E15708673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251551, "uuid": "8b05610e-8a0d-4c89-b89f-bdbfa3703df5", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251551, "uuid": "45fd567a-44a5-47ce-a7aa-a405f9eb768c", "value": "98304:V5KGO37BNUvbhx0kABURO/3dFuVWrITk9RRGYBVphbpRiLJTvVJebvdRL8bpa72B:V4xtNuhWfdkJkbBVhRsvV6vvLWYELt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681251551, "uuid": "87099f8b-ec43-4765-94ad-ede287b9fcf3", "value": 7506641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681251551, "uuid": "d4297c2f-8cbf-46c3-ac18-9ce9bd2ce91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251551, "uuid": "8dfe24e1-2d6e-431e-b865-b1bbbfaacf0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf011f80-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681208971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208971, "uuid": "764237de-a581-48e8-b204-80efca5878b5", "comment": "Malware payload (AgentTesla)", "value": "981973a9a608ca8fd993e7569f64a0dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208971, "uuid": "e7b17b41-d3e2-4a90-bdc1-0c49ccb50370", "comment": "Malware payload (AgentTesla)", "value": "7b1d6f402befc7fe4c8cd2173900461bf7858abb4feecc3052469cb5815e15b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208971, "uuid": "69815d06-c488-4e3f-aa96-bb407b6c5f5b", "comment": "Malware payload (AgentTesla)", "value": "1fe038c3e673d011cfa0d90e527dd7e6961b4ac1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208971, "uuid": "0b203cc9-068a-40bd-917b-bed9c8fcb0af", "comment": "Malware payload (AgentTesla)", "value": "2b107bf10e6af18585419eff5b6786c43e749581f863432a35f7c7be342d6131f7e77321070a2c54042bd7b7e898189b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208971, "uuid": "12892be0-d27c-4a22-a4f4-f91e816fb88c", "value": "T1055538243DFA502AB173EFAA4BE4799ADA6FB7333B07645D1051038A4723A41DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208971, "uuid": "7de637d0-80d3-4bad-95ca-93e2bdc129c8", "value": "24576:DkdZHI6dWR5gRB1V+g/dRGecIpe2kbTE:+SwLXl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208971, "uuid": "8718f68f-6cf1-43fc-b941-a92247acdd15", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208971, "uuid": "95717756-a34f-4626-94f4-a042faf9474d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208971, "uuid": "5b575d0b-0441-4724-bc3b-d999ce34b784", "value": "DHL EXPRESS TESL\u0130MAT B\u0130LD\u0130R\u0130M\u0130 - AWB 9420174470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c350ec-d837-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681196765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196765, "uuid": "20fd71b7-a397-4694-a1c2-41ec81ab06ef", "comment": "Malware payload (Smoke Loader)", "value": "4452ba80018b5c4e61a67d0744aa63dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196765, "uuid": "388515ee-e880-49a3-86e1-a2ec67bf1400", "comment": "Malware payload (Smoke Loader)", "value": "7bd2979280dba6f125f1b8a8b2716206220169d9275da6dca4cd06ee239cfe3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196765, "uuid": "2b527dc7-81c1-45a3-90e0-57c76ec0803f", "comment": "Malware payload (Smoke Loader)", "value": "d6fc13dd6dd8f71b3b01a38a3e7bd909dd2c5dae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196765, "uuid": "5971dd0f-0466-4642-b3a0-a450782a50bd", "comment": "Malware payload (Smoke Loader)", "value": "1c73f8093458bf9db1db0ea6b9d94e939d417c95b179312149a76bea3d1ce9370332f745bc529674f2bb5a03b9cccb95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196765, "uuid": "1e8a6930-2fbb-48b6-b6d0-078382687e91", "value": "T1CC14D0317AE1C072E06743701960FAA0677AB871576586BF23A817BF1E607D1863B73E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196765, "uuid": "93818962-050e-4b51-be87-688888a51185", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196765, "uuid": "324aefa3-99c2-4d0e-988a-ec6f172b20cf", "value": "3072:43c3566OZuDiH51/TBPcPo3fxtr/R4Ph0SNIz0zRIfRXen:KBdZuu9cQvH72PtNIz0zRCXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196765, "uuid": "352a7ae2-524d-48a7-a71a-c526d07331df", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196765, "uuid": "1e30268e-96a3-46bf-9200-4370806223f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196765, "uuid": "a0693aca-d064-4f1f-9273-a19d50d3b103", "value": "4452ba80018b5c4e61a67d0744aa63dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee7050e-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215360, "uuid": "fec70fc7-8be2-478c-8a32-501f61549db6", "comment": "Malware payload", "value": "4870bb0677222575105c7ed3f27ada8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215360, "uuid": "7894bbe6-52d3-43f6-b0eb-1b995a6afb88", "comment": "Malware payload", "value": "7c6b90008b79575205a02e1d8e90f464e1705938d9031080145cd6a4299cd9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215360, "uuid": "46da4082-3d07-4c8c-a6c9-942516e35b4d", "comment": "Malware payload", "value": "9c378351f48d62491018adabe106ee917ff0c51d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215360, "uuid": "6675f6c0-4ae5-4b3a-be4e-42b5883fd079", "comment": "Malware payload", "value": "97999834bd15a0893af5d58b45b1deb71cc043f8d9d50995f175de2f4e11fccc5e47bc77a303dba0570c945c82ea5a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215360, "uuid": "385ea4fb-2ce1-4808-bf54-c05d3844c627", "value": "T1FE653378C143BA65E7C62D4E3EC30C51B9CD2AB79753DC2457F062CB628E7B83892994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215360, "uuid": "28d15341-d436-4014-9c11-aa5a2bbef57a", "value": "24576:KqEit2OFGWt8RVehne/+OWq8S52R+LdIqwjhyON2qlURcGIiQfVmAMkJNPO5fijY:fr2QtGVoneGOWePVsFpl2ZQFJte6jUUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215360, "uuid": "673e568d-b5d3-46f0-87c0-05ee896d4a5a", "value": 1524247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215360, "uuid": "9222c411-8bf6-476d-ba95-7be5e6d9bb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215360, "uuid": "df12b7b2-92f5-4d4c-af54-e1435d98f03a", "value": "4870bb0677222575105c7ed3f27ada8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e48abe-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681208961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208961, "uuid": "c4f6dbac-0fa1-4e8a-99ca-6c79a8f22816", "comment": "Malware payload (Loki)", "value": "6d585ee2ab8ac3ed320752bdc07b5c22", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208961, "uuid": "dcb8d9b5-ea78-43db-8df4-69e8a778b0af", "comment": "Malware payload (Loki)", "value": "7d5093b7453c3c887a2d987821f32bdf0c3751ec28df5807c796efc6a6399584", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208961, "uuid": "39a600a0-7025-42aa-a0ff-759c4457a8b6", "comment": "Malware payload (Loki)", "value": "51d765fcd8aff433b8ae9ada6aa60cb72905179a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208961, "uuid": "af680d93-bdee-434f-ae37-db825007f3c9", "comment": "Malware payload (Loki)", "value": "4f0300aa1eb44a83c7cdbd3da497f3141c2a827d3b00591d4d66c4a9c8ed8cb0ff05d1432375b9befb8aef3465397d14", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208961, "uuid": "1982be3d-f796-4413-bb7e-de631cecd5dd", "value": "T15285F025B2753DC7532612B2828FAC4A6318FC47B39B1E98D05EEEF82CD4575A301F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208961, "uuid": "77b1b9ac-5c28-49b4-881b-0f240d013dda", "value": "6144:3T+p+DNICed23h4M6ziI7Gi30So2Jouj7V2zdG4+t3M:30+2CeSh4M6TvbSuX5Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208961, "uuid": "f89c5dd2-64b7-4352-9322-00234c5f8a8e", "value": 1761631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208961, "uuid": "e90399d8-a542-4903-88f2-f6d892a08a8e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208961, "uuid": "655436e9-c333-4231-9a33-ba4fd4ad6f9b", "value": "arrival notice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eee27a8-d87c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681226419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226419, "uuid": "9d9d088c-55d3-4e90-91ca-25e57ab0b028", "comment": "Malware payload (Amadey)", "value": "a8edd42ca27e45b8831c0bbae9f4b7a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226419, "uuid": "609a9e4f-4e66-4979-8f57-1f5d4b3fa1bd", "comment": "Malware payload (Amadey)", "value": "7df83d09198b8535e4ea95c862283aac5b5e26c89173f86666b7b3b84024fd2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226419, "uuid": "a0771310-cfd1-41bd-849a-bb383ac21448", "comment": "Malware payload (Amadey)", "value": "5cf24fc2d3f935c0e8929322ee783c5b28956bf6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226419, "uuid": "a494f3a7-530c-40ba-b41b-ac672e375103", "comment": "Malware payload (Amadey)", "value": "d19dbc3b8318051d9b784fd77c537ea717cebecd425dc18e059f4b4a7050c145efdbb660d51d348a40837fa3080050c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226419, "uuid": "bece7ce4-253b-49bc-9dc0-a9574f40b529", "value": "T1A2352342B3E558B2E8B26BB10C79428316357CD5D8348B6F37A7A99B4D71684BC3132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226419, "uuid": "2c0fd327-a214-4ebb-979b-57803386a1a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226419, "uuid": "b2fefa49-4fb8-463a-9423-f2595ee0dc32", "value": "24576:3yYLhF+X2wbzRomS8VnvQ/CpBk/OobDLRLYxe9Yw0s2oJ:CY1F+VSmvA4BNobDhYxCJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681226419, "uuid": "6a43c64d-0510-44a5-808e-306af2dbe0fc", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681226419, "uuid": "2f100543-92f8-4779-9eb6-40c20d08e8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226419, "uuid": "e482b0ca-c2dc-4f30-b16e-93099c6d9c43", "value": "a8edd42ca27e45b8831c0bbae9f4b7a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919f1e65-d81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1681184414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "2a868f38-9926-4043-a93f-5ffcc446d554", "comment": "Malware payload (RecordBreaker)", "value": "3295a59e81bc7a0d9a0f991ca1fc814f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "fd8e77a7-702d-4424-a454-7f6ad2db5824", "comment": "Malware payload (RecordBreaker)", "value": "7e3930f4d7adc75e545d5d8ccb59774c1f045e1b96e64e237571527136d96734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "bb58c785-68e3-4ed9-a853-8dec5e672d0a", "comment": "Malware payload (RecordBreaker)", "value": "330640301e101fc4b3df923db9599c6eaf5c8df3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "709cf137-0b88-41b9-908f-6a960801dd5e", "comment": "Malware payload (RecordBreaker)", "value": "221c45fe8f191fe41ba2e918a426ac71fde82eb444b8d4e4072c03e763ea74e120462109f2498f8e6eb123acb04f53de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "12dad86b-364a-4374-b798-b5f319fb5d82", "value": "T19B061263236513DED09098754937FEF071B21E2A5E42A8766BFD7DCB37328E49602A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "3414bc3f-67a2-4c0b-b2b0-16a07e39073f", "value": "29ed970ed42ff5f8e29070be56e1f7d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "c07bf5ec-694c-4295-94b6-21c2edc8ab85", "value": "98304:smHAsMHvimjyE/sSFHqys1lbki0zYNOUV3/pQcMfKuLD7ANa:logE/FH3+6yhI1r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681184414, "uuid": "35820207-fec3-44bf-872f-9a399f275e2e", "value": 3940864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681184414, "uuid": "bb2231ad-eb55-4049-8a88-ffaba8e4f6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "c1ff1004-87c2-4eeb-aaf6-8dab4780f4be", "value": "Satups_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb0bebc-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218824, "uuid": "1572a34e-5adc-49d1-9387-181f5ce88c07", "comment": "Malware payload (SnakeKeylogger)", "value": "185a8c9aaf5006b2b5a6fab61e5a10ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218824, "uuid": "d5a9e9ba-7ef8-4f55-9296-5f3610d78fbd", "comment": "Malware payload (SnakeKeylogger)", "value": "7e8283583026a288a16c98682ce3cf18308f78cb08cebf3dd6b3376aa7089733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218824, "uuid": "7acb071c-e01f-4c8c-b50c-97e01c22ce98", "comment": "Malware payload (SnakeKeylogger)", "value": "f8d841def0b60dc6df8f9fdf0c5040e33ed10279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218824, "uuid": "7aab2d1e-3df1-4121-bd8c-e432e1246dc6", "comment": "Malware payload (SnakeKeylogger)", "value": "f313dacd9258eb5af294190f380621e238817fc44eb0892aa9e7503e9928f49aa38cc6bfe1224cf57b3c7e9724e7a85b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218824, "uuid": "b8918e30-a1f8-4e27-b4b1-dbd5471a828c", "value": "T1C6B4014EA7B1DB61E45D0FF41480588217BCB256F0A5EA9D8CD663F78A73F6221083E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218824, "uuid": "2954d149-bcc2-402a-8ee1-05f2261a100c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218824, "uuid": "a91a6520-4832-4ce1-8d4f-e7cd2b57918f", "value": "12288:DlccvGC/90tlB/WiDzf6VJaIzxz68QQGpZdAHa4/y:RlmlWiDb3ixz68QQwHA69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218824, "uuid": "b0cb9ec6-a589-4037-a431-86e0bbfeff84", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218824, "uuid": "62445865-1ad8-4758-ada7-e556bcd37312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218824, "uuid": "48c20e18-b095-4457-b621-c010cb5ef156", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819ed674-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681205432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205432, "uuid": "830da628-a133-4885-99dc-ebb39dfc0ef7", "comment": "Malware payload", "value": "b446cc03d61a54d5995743169a9d18eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205432, "uuid": "119018d7-fae9-41fb-86c9-7d8be7379c01", "comment": "Malware payload", "value": "80c6295061e4ec838c962fef5d405c9c6df784cdba3f484a868792695501f438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205432, "uuid": "29afa943-2371-4420-8ae8-fbacb9bbe5d4", "comment": "Malware payload", "value": "03fe914e2b050f9111c8448d2b301555187e0f0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205432, "uuid": "0a6d31aa-c92b-46ce-a50b-fa1c71551558", "comment": "Malware payload", "value": "71e9afa2d93ea6d12354c3f351bda244717baf4bb22c3f8f3e52dca491db15a64d36067fc16b75d2abbfbb0bace0bda4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205432, "uuid": "257f7bd7-0797-4a0b-894c-7ce97f76202c", "value": "T18AA5221D77A40DF4EC77A17DC981844AD6B2B8575A75CB2F0362435B4F232826E3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205432, "uuid": "f2690b70-808e-4a04-b5d7-1101595872a8", "value": "f72c14d6f41cbb61e10b6fa4e549fd4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205432, "uuid": "f27616c6-7894-4b64-8699-d61edb953316", "value": "49152:wv26s6R+qlNn+jvD6XKiI23zwwn4n0AP/lUY8gHUs6a5aV+i:W2wDZXK8D5nQNUY8gmVV+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205432, "uuid": "0215703c-bceb-42c4-a596-67354e16dc73", "value": 2085776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205432, "uuid": "cae58ccc-c015-4d92-844a-fa18ac7d5943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205432, "uuid": "994cace1-8d8e-4a37-a900-e32ab3465b51", "value": "b446cc03d61a54d5995743169a9d18eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdde1d22-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681203815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203815, "uuid": "e13f9e20-c1a1-48f3-bba7-613f0800bc43", "comment": "Malware payload (DCRat)", "value": "95c91ee5f41348b8a2edf90806ded846", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203815, "uuid": "74f73e94-29c4-4d46-9853-6e57e1c7ecec", "comment": "Malware payload (DCRat)", "value": "82099a62c69a94e3eb4909eadee7e3b15bf7470de3f003326427fc0e8424dea4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203815, "uuid": "c10f61cb-1989-46fd-8d65-0e4375a974e9", "comment": "Malware payload (DCRat)", "value": "0b56cc1d7e1c965b1c0abfb286323683f9e5f06a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203815, "uuid": "77329628-85f9-47b0-a5d2-5aff426e2ff7", "comment": "Malware payload (DCRat)", "value": "8153558257d74fd02e20f94a1c19f668f8e158cb6e7d85f95d4199d21a9f4e1a03d11154ded7dddd35f79bf1d82d8a52", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203815, "uuid": "48091254-0f92-48fb-8a5c-63e74f7639b1", "value": "T1D9235C4037D8C136E2BD4BB4A9F3924186B9D2275D03CA596CC815EA2F13FC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203815, "uuid": "1267f33a-82da-4146-a3e7-d7f54ca1937b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203815, "uuid": "f7e00ca8-23ad-4b4c-b047-adfa4c562c7a", "value": "768:QzGiTILsm4Y+PLiPBsKU89yI//ica8YbLgei4yWhKh94vEgK/JXZVc6KN:QzGERm5rTopzb0KyQO+nkJXZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203815, "uuid": "cef4e46f-feb3-49b6-8ae1-263d66e18296", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203815, "uuid": "8fb0ee6f-1987-4a83-b1c5-461261503c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203815, "uuid": "92f530ba-64a3-4247-ab6c-e1433deb3555", "value": "95c91ee5f41348b8a2edf90806ded846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51880d3e-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242718, "uuid": "04c2ab69-d84f-4056-a66a-6040a4fa70ce", "comment": "Malware payload", "value": "f279e05edd441fc059275643d268f0af", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242718, "uuid": "e447178b-2a39-4585-88c5-067f942cfb17", "comment": "Malware payload", "value": "833287e61ea3dd0cce3c37e3b047c41df867a067092edcf028a467fe4d8414eb", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242718, "uuid": "3b8ce857-0f04-458b-bd7d-9c8cd422e35e", "comment": "Malware payload", "value": "3de50f20d7106d0ca897455d307aa9fe9426cac5", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242718, "uuid": "5f1c559c-0bc5-4482-9252-61174aa9bbe6", "comment": "Malware payload", "value": "7bcd2c6b3583565ef12cb51232a8b270131c6eb630890dcfd0609f521a43b66f2a1d86b759b16bbc80ebb60f13f3cc31", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242718, "uuid": "4e6efb2f-7f29-4d44-8f7c-026676a3ce9c", "value": "T12163F16DCAF85D2DD8DB9B5A87683069087C752367D423A360B61B0BDC8E01F75630EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242718, "uuid": "d116704c-25cb-48cc-9b46-6a8f858c5ccb", "value": "1536:lpJkhPOZDi9QQh9jyK/RJfWKOynsK3Go8eHJ6bRtQCszyc7QhEn0BkOb:/JwOZGSQh9jyK5f6KGo8nbrQpdQhEn0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242718, "uuid": "c81d1dea-3311-4857-ae1b-7ab3152d7c2f", "value": 68470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242718, "uuid": "ddb42c8a-7e07-48fc-8bcb-3c825373d3f9", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242718, "uuid": "1a40a72a-a527-4681-876b-38430bb482b7", "value": "iV_April.4(96792).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14007dd-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681214156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214156, "uuid": "ec255e56-413d-4393-aae6-6968a6f7f4ad", "comment": "Malware payload (Amadey)", "value": "b92889aecdf21f815b53eff81e85bbe6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214156, "uuid": "722d4908-6bca-47cc-94d8-61ecf8608faf", "comment": "Malware payload (Amadey)", "value": "8362a776868bccdab9acbd824c9dec84a17c984b101b5992ac56dddedd59bd67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214156, "uuid": "27fa3362-2d89-417d-83de-485e8df566bd", "comment": "Malware payload (Amadey)", "value": "7fb57d1e62924b2c91d651425490e832d7a0501f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214156, "uuid": "11f3e671-b5e3-432f-9674-01267a052bd4", "comment": "Malware payload (Amadey)", "value": "318d094554a4fc1faad0ca331b1df93c3879c6fb575225094a5c2c415d57351ab8bb3002e9730d5a5e90c925e585eedd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214156, "uuid": "c0d872b0-32c5-4ca8-bfc8-c2ea82eb6d51", "value": "T1AE052373A7E84433DDB6233045F616D3097ABC62AA38972A2701999B1D73399783173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214156, "uuid": "e8216458-838e-44e0-ac47-4eb13cc83cc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214156, "uuid": "31f3144f-2af6-4d39-bd5f-2987601c3c84", "value": "24576:UyTNSqQGmMj658IWt9CrFIxC0B3LE7+jHC9E4wCUs:jTUqQi658J9txXobLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214156, "uuid": "f2f8bf44-4fe2-429f-9000-093046ca6c9a", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214156, "uuid": "45eae9dc-adc0-44d6-a74b-303400bb59ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214156, "uuid": "77db9575-e870-4065-bf79-0e8bdbf126fa", "value": "b92889aecdf21f815b53eff81e85bbe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86c7f6b-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681209068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209068, "uuid": "03b01266-9e54-405d-9b15-be66f5cb4936", "comment": "Malware payload", "value": "ae025d55a14f799eb1e6ded2f987ff45", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209068, "uuid": "6372caf2-f32a-432e-b97e-4e6de41dc8cc", "comment": "Malware payload", "value": "843eb2ca1e64034f3d181ae788b37c41fff31c04060a7d8f7beb81d6bde2f6d4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209068, "uuid": "b99e314c-3a88-4ee8-9f30-2bf347bb06b8", "comment": "Malware payload", "value": "b0d3064b828e724d08bc742e0ec3e15b727950b8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209068, "uuid": "5cb8b873-56b7-49ef-ae63-acffe9c60606", "comment": "Malware payload", "value": "5c159540db6bfe44d1eb813d5460f26e07836fc345f3ef1da5d31aed50bed233cc6b1ec7246863ae494c64fb99fee805", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209068, "uuid": "0ac7d8e0-f33d-4353-85f2-5bacc565baac", "value": "T15E618C1457EA0708F3F3AB3A69BF52994E3B3956E932C74E0059414E52F1A40DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209068, "uuid": "8f5b5ef9-1817-44a5-87d7-9606c42ec468", "value": "48:8wHazU9Dmel0iglZ+N+lpQfYj1sAT1rTRRSJxodgImcC:8wH7B0+06YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209068, "uuid": "dadb7180-a63f-441d-99de-4a6ca498ad91", "value": 3446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209068, "uuid": "529de1aa-2b8f-4107-a2ab-f71db3bcf811", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209068, "uuid": "ea652842-12eb-4851-b94e-b576619553ef", "value": "Item.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82d126d-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681239105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239105, "uuid": "6941711a-e860-4f1f-849a-90dee7fe1dba", "comment": "Malware payload (AgentTesla)", "value": "47c3babf753a299e0d5c94e222231bf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239105, "uuid": "bc534a24-80ab-4dc1-bbce-7cf54a7ea1c2", "comment": "Malware payload (AgentTesla)", "value": "856c5bebdbdde6c6e363573944f15d1ae9bde70cef370f2ae9c5af39cada835a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239105, "uuid": "b70ec341-8173-4002-82da-47f046039a04", "comment": "Malware payload (AgentTesla)", "value": "b38b2cd7931a0b20b2991deddfdac41cd30bb2f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239105, "uuid": "9e527130-7e3e-4412-b44c-12186b6aad9d", "comment": "Malware payload (AgentTesla)", "value": "b4d054175f19f4c93fac5e443088c57a0410b94dc62469023869e46cd3f879f0b6a2e1b2c53dd88ce569f39e7b1102eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239105, "uuid": "e83579ef-9bd0-4542-8e23-c4243d8d2b2e", "value": "T169D49C23F4DCA6D5E09C0479AC68F3BE79216C1188318E963EA1F849693974724F7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239105, "uuid": "e44715c5-fa50-40ea-ad5b-0644db301d4a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239105, "uuid": "8f5adb0d-4f9d-47e2-bf29-767084fd9ee0", "value": "6144:0Ya6GNhRnL2WlF0Hfrmv8t1Vz/HrBfOR37zANuQDi:0YkTL2WcDe8t1VZfezAN9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239105, "uuid": "7ebf2647-3607-4bdb-b873-c00e4dd7fe10", "value": 641343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239105, "uuid": "27225102-6b9e-4b3e-a14c-00b95c42c4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239105, "uuid": "663c134c-c695-4a87-9bda-c21816f2acf6", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c597a7-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681240143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240143, "uuid": "c38ece4e-b86c-46ff-8585-a9d7713b89d3", "comment": "Malware payload (Amadey)", "value": "dddb7f44df311203facdf9bb248f80ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240143, "uuid": "371aaca8-ef61-41ed-bf27-1b5a759dfe0b", "comment": "Malware payload (Amadey)", "value": "865d5dd81f34540c2a931aec5a5280571a7c910fb6dde4b174756d4ba3fbd38d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240143, "uuid": "ddbd13f0-f61b-48df-b7b1-7e5f3a3050a2", "comment": "Malware payload (Amadey)", "value": "a25e8a78fc5d298c8605180a1296300f4e2827d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240143, "uuid": "ac814f94-ace4-4857-82ba-bc81f1ce1416", "comment": "Malware payload (Amadey)", "value": "d8ba62c54713b463da53c860ddec66b25280ef2a8e3c4c6da3ede852c79c9a2b99b012dc4071801fdc686a8269aac585", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240143, "uuid": "ec02a63f-302f-44c8-91c9-eb04fb8b6aac", "value": "T1DA936B1030D2C471D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240143, "uuid": "6aa9762b-d837-426a-a8fe-471ef0cc81c7", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240143, "uuid": "81dee29e-515c-4048-965a-46da380eca72", "value": "1536:Oo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU6paB89p:OoUCWbBNpplToUs1uNhj25LJUaaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240143, "uuid": "1848a07c-1674-4558-bc38-6871afd36421", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240143, "uuid": "fea38af4-5e8c-4d1c-8056-8de5871e59b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240143, "uuid": "dd5ee346-1676-4683-bc37-7ff70bee1311", "value": "dddb7f44df311203facdf9bb248f80ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53355ff-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231745, "uuid": "3538709c-eb32-469b-b9cd-213603d2445f", "comment": "Malware payload (Mirai)", "value": "4c251f917774c4ba8a8eb4614b7e69b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231745, "uuid": "39d987fd-e415-4f1a-999e-3d67f2c92247", "comment": "Malware payload (Mirai)", "value": "86620a94e99455006af09df3e44239c127acedfb48331e48d5ad6b9cf6d1e3f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231745, "uuid": "81374295-9950-425e-960f-1e194e567616", "comment": "Malware payload (Mirai)", "value": "67cc490f2c26c1b057be265c072a6ad08d388de0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231745, "uuid": "b6f09f54-3532-4891-8d0c-910f728710c5", "comment": "Malware payload (Mirai)", "value": "e0b022333d32f6f4e676ba8abb9468f79624e224764074b0931bca466323d6894cc369ea6d83cebaa89597c482aaa0d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231745, "uuid": "7466644a-b168-44f0-94eb-417872b0772b", "value": "T1C8D2D0AEE57441C6FD8D5C3E808C3FB01E19E581231BDB9667228C8D5B36C5AF17A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231745, "uuid": "4910c38e-99ee-4b07-822c-b81c3729c602", "value": "384:d8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjSQ5jRWGVCz0NvL:aMYHb62x4ahQ3CfdwLj/aWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231745, "uuid": "8d07fe8e-087f-4536-a7a8-ae26670413c2", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231745, "uuid": "8eb58e28-bc96-40e4-a35b-a6eb593fe145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231745, "uuid": "0ad88fb7-76be-42fc-b6c0-7ae0ff1ba4b8", "value": "4c251f917774c4ba8a8eb4614b7e69b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f377a339-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681209059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209059, "uuid": "25a77e4f-01de-4b63-a39d-ff426f040700", "comment": "Malware payload (Formbook)", "value": "b3e6beb2e2c3d92b29d15e5fb3191abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209059, "uuid": "99930075-03b4-47fc-981c-012249dde2d8", "comment": "Malware payload (Formbook)", "value": "86c694d22f3e8ac0809e7049b524dafa5a5abe4875ae8361f5e40a176d2c5736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209059, "uuid": "d2053322-0528-4bae-be75-28b91c8fd8c3", "comment": "Malware payload (Formbook)", "value": "e04db7b167d9e7b1b7acdb18d44ff5f1ce352f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209059, "uuid": "aa80f79e-8fa7-45f8-84f2-deb9ec8ac7ae", "comment": "Malware payload (Formbook)", "value": "342e9d5524c15d119b51fe42a4cb44c711360576e0c5d5bb440f24f817558a48b0e26d5c303bf7e83f8feab2c3dad988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209059, "uuid": "d5436cad-44d3-4935-a76d-df71fe75caf5", "value": "T1DCC5CFB15A89BE96D77E1DF694D312500FF4DCBBA734D345BEC834AA28B22109C56CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209059, "uuid": "d3a22e57-233a-4fc1-982e-98bb19e200b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209059, "uuid": "c0eccbc5-9286-4e19-820b-093084243db2", "value": "49152:Z3e3RDMEGXf8irCCeWIAalPBYnIqdEvL:Z3e31L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209059, "uuid": "901d805b-381f-4fcd-965b-218ecc2baaec", "value": 2528256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209059, "uuid": "1c5c84f7-f6c0-4708-aace-5c0a1b4ea12b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209059, "uuid": "875c4904-7056-44f0-b24a-7dd91258a758", "value": "HSBC TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a25f8b0-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215325, "uuid": "154e64dc-6358-4379-8946-f4d928d35ed1", "comment": "Malware payload", "value": "799c95724e9c91d5f9f9f59b9cf5547a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215325, "uuid": "1dc6aa56-d7e1-4e36-9c58-faea6e8da32d", "comment": "Malware payload", "value": "87e18f4cc965ba6a9b30326b7332196eb08c75e8bd213c5f8f77bb7e6834c842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215325, "uuid": "7044dd0f-6ac2-4f3b-8fd2-df9ecc6f20e1", "comment": "Malware payload", "value": "c850aabea0f4380de9a6157932ea279c1fa9fe22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215325, "uuid": "e8efd5eb-a6d4-4649-8d10-6e5c0d69b745", "comment": "Malware payload", "value": "5cde1a3ff0d8741c7beaca8c269aecbc59ca781af1f9c5bb5abb002f55615ab058d118cc3ed3a75bf00bec9055dcf98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215325, "uuid": "3ec431f6-11b6-4407-a0b4-315291300b03", "value": "T104E5F11AB5648C74D493D4331015D7A3A206D68EBE18CBCF23B01D0ABAF59E78B167ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215325, "uuid": "3f45fd73-83bc-4205-ae0d-085d7a1b8f63", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215325, "uuid": "8eaa2a76-8ffb-42ab-9839-3c6201c5063c", "value": "98304:1q29KaNjf5rBIZU86Ch3/NCFBdkPo3TsWVL:h9DNr558bhV8dkwDsiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215325, "uuid": "5c0fbf13-555d-4abc-9444-2dd86c6906a1", "value": 3285396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215325, "uuid": "6c3a00d9-497d-470c-a489-93aa403aa235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215325, "uuid": "b1938d85-9a63-4bef-8df1-19f13384a0fd", "value": "799c95724e9c91d5f9f9f59b9cf5547a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e7ae29-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681204495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204495, "uuid": "9de96df5-f564-4e8e-903d-8b6ae425d4e2", "comment": "Malware payload (GCleaner)", "value": "d8af9112cb979e7cf803a1130dc21ee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204495, "uuid": "dad79403-9f0f-49ce-8478-433ccdb65f08", "comment": "Malware payload (GCleaner)", "value": "882c26437f13e0ac3047c698101b57d9028e4df372715ed0c037d64318235fea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204495, "uuid": "4d9480ad-da23-46c1-b0bb-b9d96b27bc08", "comment": "Malware payload (GCleaner)", "value": "5442002b1356a058c8df09ae9a3fe64d5a697e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204495, "uuid": "f5f1cbc1-6a0c-4c1f-ae48-2491efc60692", "comment": "Malware payload (GCleaner)", "value": "3a36aaca0dcf6f5122f2abe387c37145d96d08c9ba8ab3ddcf824f9e20e2353ecd55ac0f27400821259ae958d4d8195f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204495, "uuid": "38c2fa58-1f86-4137-9c2f-4e3a9cb56e57", "value": "T17F44F1327DD09872D56AB0358832DA555EBF79211234468BB3FC26AEBF317D02A3534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204495, "uuid": "938bfa3a-80bf-4452-8ac4-ab1b30423e6e", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204495, "uuid": "f65db402-951d-4c77-9eff-dfd77c83892f", "value": "6144:228WoGDd4/d3RP4rZh82exQ4m14jcu7z9ykO:U18sYrXia43IQByk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204495, "uuid": "2d6ed3c5-91f1-468f-9685-b73f01156ab4", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204495, "uuid": "50a2e37c-b054-4fa9-a2e2-c4a07191bcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204495, "uuid": "90eca896-0ca1-412a-ba13-ed5cf3348f18", "value": "d8af9112cb979e7cf803a1130dc21ee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d6c628-d890-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681235041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235041, "uuid": "bd714787-2325-4f50-aaa4-eea6f1633b5b", "comment": "Malware payload (AgentTesla)", "value": "41bd1dd6a26503b3ff7165c22385c2dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235041, "uuid": "29adbbc3-5267-4f9e-bd54-5cbe3966bd21", "comment": "Malware payload (AgentTesla)", "value": "89ddd74ff391e9b89ca13cbd5f6d3b9568c1b5bfd1e7a0ff7b860444fc7e7a34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235041, "uuid": "7794b894-f886-4b0d-9908-997ff7615f0a", "comment": "Malware payload (AgentTesla)", "value": "20ec3083b7ab89525777945b8143b900dfb01880", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235041, "uuid": "8d04aeb3-be18-47b2-8161-b07e4b0d35fa", "comment": "Malware payload (AgentTesla)", "value": "7cad77f26e28c862e5ec08a145274b5f5198fd0482495e56215260dfb86fc943110a6487da6bdab154cb22fc07a24d65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235041, "uuid": "9b344885-416a-41d7-a951-d0b717b1f963", "value": "T11D947023D18878D8B2F7AF03139F2EE97BBB16E09D5D05EC2488552662DCCD98D905F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235041, "uuid": "a23e5e75-e556-482b-885d-28ea81335725", "value": "3072:kP4AyZsfZuuFcSggabnXLuUu4uFutuvu+ueuluzu4ucunuouru3uUayeasas2:ZgmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681235041, "uuid": "60b398b9-5d9e-4aa3-b49a-527843a9a5a6", "value": 413336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681235041, "uuid": "de126f00-6ac4-4f03-b1aa-d593aab25099", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235041, "uuid": "934629b6-40b1-454b-8fd4-4e1592a2e372", "value": "originss.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e3067d-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1681221821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221821, "uuid": "5832ef35-d9dd-4fc0-b331-b5f039a1e52e", "comment": "Malware payload (RecordBreaker)", "value": "c27addaeed77dc2683e9f7cd6970b63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221821, "uuid": "46b2a715-778c-4f1f-bed2-d937f4e07794", "comment": "Malware payload (RecordBreaker)", "value": "8a6b09020b568e516c55e458e6e95b2a5d0dafa73b4efffcd46ef87b8e6371eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221821, "uuid": "bb4352b7-2b98-4398-916c-04b8e4a4f31f", "comment": "Malware payload (RecordBreaker)", "value": "e9bbe3d3400c9206c5d117c9912ec83320829b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221821, "uuid": "853e2e21-9715-478c-b44a-d2b6f718c00b", "comment": "Malware payload (RecordBreaker)", "value": "bb060486f7b550dfbff983be2496fc5b578a6b7d58b93258385602f6c20e64500fca12491afeb60a499038c6d17634b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221821, "uuid": "b03c165c-a285-4793-9212-6ebd4b2ac183", "value": "T10324D0317AE2C0B6C5AB45708520E9B02A3EBD7193A1C64F33A857BF5E70792477A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221821, "uuid": "93681a08-fd1a-4d74-8998-f4cec3fe7073", "value": "ab082a716c28869a457cab71ba8dd878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221821, "uuid": "2d5e573a-8713-4c06-97ec-d0b642ac0c39", "value": "3072:kW7y6u8Oqh+z5OzSQlSdlLHq51VCMBR7HAA75SV13S:ZZsO94BoPD7HAPVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221821, "uuid": "f494f442-1d7a-40cc-a123-377477fb0be1", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221821, "uuid": "63cf7784-2339-4ce2-a2c8-4d2c53f54326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221821, "uuid": "1e850e7b-26e0-4d8a-821b-489bbaa17966", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59902d9-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681215398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215398, "uuid": "2f6ce592-ae3e-4ace-9143-148331e1715c", "comment": "Malware payload (AgentTesla)", "value": "06b4188166647753575a9ace562b4f5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215398, "uuid": "d459ea95-c0ed-40c0-ae03-ad5dc0b741d9", "comment": "Malware payload (AgentTesla)", "value": "8a7ad0ac9a02dffbfd56debb206f3ab221974ef81540861409ffc412873d3da6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215398, "uuid": "a5177482-5c9f-4528-82d3-2f493417f963", "comment": "Malware payload (AgentTesla)", "value": "0d97cb3f85af5e7adafde06e673ab514f7f0ca3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215398, "uuid": "036e7367-5bfa-45bd-b032-0a50645dc777", "comment": "Malware payload (AgentTesla)", "value": "c0d65dfd2dbe5eab76d28a71891598725c5707530126be9cd546dcea6a1e4da1d0f8646a52cc0a91cc0edc5abf17968a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215398, "uuid": "e0931af2-ea66-4148-9bc2-5af6005dc7ef", "value": "T130D4011C27B5DF61C05C2BBD6410064553B0E28AB592EB2FEF86B3D28EF6B461D4439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215398, "uuid": "e3ebfc25-7448-4aa2-b2f3-a57bc5214779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215398, "uuid": "ed54dd16-c01d-4254-9dc5-1b8933f5f5fd", "value": "12288:JfX6G8ymd0XjWm33Zrdipd5VBbMsxP2rYXdlWbbMQqh:JyGXqm3Zdin5ksxPm0mbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215398, "uuid": "63016abf-7895-4480-89f8-9539f755b5cc", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215398, "uuid": "94e4672d-e3a5-4870-9c0c-55ff902ab9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215398, "uuid": "e452cda5-e5eb-4af1-9568-8236758c6d01", "value": "06b4188166647753575a9ace562b4f5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19780a3f-d86f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681220719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220719, "uuid": "751b601c-53df-4da9-b58d-ba66e9503ea1", "comment": "Malware payload (RedLineStealer)", "value": "ce7cc19d258d61e39227e60256aa2f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220719, "uuid": "418448e1-7acd-4ab7-84ca-bf251bbaf448", "comment": "Malware payload (RedLineStealer)", "value": "8b0b6f642019bf4a5fd4e341717eb427dd2dbfc3f349bfa6862776b05ca6729e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220719, "uuid": "576c2bf7-be71-44b0-94db-7f99e9923815", "comment": "Malware payload (RedLineStealer)", "value": "6aa7e8c268907ee188b4b06aa47e7e2c5269b9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220719, "uuid": "16d64fe7-82bd-4b54-ba06-926641fc04e6", "comment": "Malware payload (RedLineStealer)", "value": "e8f29c07a106feef547f97913676db681dbae27233d38128c9a7e22066d52658513caa0985973b4dcca5f24bc84e8f7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220719, "uuid": "3f620422-c393-43fe-91f1-6a41f9278dca", "value": "T1C6252302B3E45072E5751BB048F716A31B33FCA25A349B7A7349E18F5CB2654AC7239B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220719, "uuid": "9905c692-b5a9-4dcc-ab41-0aac01ecca04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220719, "uuid": "0bb9fd4e-41c8-4b5b-93ad-87829ae92690", "value": "24576:FyGk7FrLZm/odv/wmmbnLkuvCclXhNrDp:gGkRfZuoh3mbnhvC0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681220719, "uuid": "9bfa224f-f65c-49b6-820b-974dada23dd0", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681220719, "uuid": "cad36d10-ee7d-4014-a42f-6d1e1cf70ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220719, "uuid": "90354a58-9c3b-48c3-8e43-4346f7a5e287", "value": "8b0b6f642019bf4a5fd4e341717eb427dd2dbfc3f349b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5f65af-d854-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681209129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209129, "uuid": "5b21421f-3f82-401f-b3c9-1aaa661d59ee", "comment": "Malware payload", "value": "f200adff179adc93fafb4ffe9daf4a7b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209129, "uuid": "442f510e-ce5e-4b84-9da8-d1dfb09a5100", "comment": "Malware payload", "value": "8c04cdab057bf61c29e5028c6aa003f8c155abcbc2dc51cb31539faa4e9ea327", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209129, "uuid": "91819576-57d1-4a42-bca1-73e7ac2e1754", "comment": "Malware payload", "value": "8f3ef4901d08db317e35699f95d5a9bc8eb7b98b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209129, "uuid": "4e3fbf8c-2c99-47c3-85b9-0f8bc0d4d5e9", "comment": "Malware payload", "value": "9b65edb3b60e7b6dd3fa02cee3266e061449d6e1fc43053c5ebcec4e65ce2b4618a3c52ac9574a7c606dd740476465c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209129, "uuid": "d90e7fa5-8970-4141-a0ac-52142a20c660", "value": "T1BB112C1E9C1CE185527537FAAB1BA70CDDE1447B2613E612768CDDC16F340244594D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209129, "uuid": "4c47dfb0-5f36-4528-abbf-1fd3189ae87a", "value": "24:p+jZa85my142MfcmZE/CA82cEXEkfdbNb0qee:Ua8ZPSc6wVNcEHFiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209129, "uuid": "658faa91-8c65-460a-a9d5-7797378b3be6", "value": 933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209129, "uuid": "ba10a54f-cc70-4028-801e-f3be90a3a39c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209129, "uuid": "a69e6b39-f716-4af2-adc3-e11803942426", "value": "JCM_RFQ_DS15_FR# 0000071916 -pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27fbe52-d87c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681226613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226613, "uuid": "69e436e5-df22-4507-979b-a733f2ece877", "comment": "Malware payload", "value": "133fc06f89216c88bef1f5f9a49d6ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226613, "uuid": "96c26379-fc04-4dbe-bb5e-daadaca76fb6", "comment": "Malware payload", "value": "8d4bafbdb15653fe34ae9bc31fc0d4b3340a44ca541505850f063bebc218a8fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226613, "uuid": "9287013a-975b-4313-a9c2-2cc5a0090bcd", "comment": "Malware payload", "value": "a7b888f2465f6f203364bbbcc019104029ea5fe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226613, "uuid": "657ff910-a4c5-4b2a-9fdf-b9548f591e0b", "comment": "Malware payload", "value": "868b67a3672302cff813112f609ecc27ae2ee7d4dd83cc92b338ceb2ce243df4479f7c82a32c73fa640312f710d73892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226613, "uuid": "d8df59c7-5935-4fa0-bb85-24a366996c3c", "value": "T1D4027397F7918E3BCCD80278455B433232B3E872975353131909B2B52E427C92F6E9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226613, "uuid": "7680871c-4e0c-444b-b011-5de79e3cc2fd", "value": "96:GQAsZTY0FVJ4HmYH+CVIUK7q1rOKRCWe7rzvelSdR+Wx:GQAsZEIV9IJVIUN0KgylS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681226613, "uuid": "786563dc-0844-4c59-bd16-0a86a9076575", "value": 8776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681226613, "uuid": "4a5eb52c-e9cf-4274-a0ea-9da4b7a74894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226613, "uuid": "1a8789fb-7132-4c48-a50f-ab73e43c44d4", "value": "MBR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a833e3a-d86f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681220721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220721, "uuid": "781b06b8-ba1c-4860-af94-f7d50e410ea1", "comment": "Malware payload (Amadey)", "value": "c2647e0b2d1a82f7b0cd8597534fe679", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220721, "uuid": "691db3e0-db3a-4cdf-839a-da4c40797644", "comment": "Malware payload (Amadey)", "value": "8dac4ec3a72c968dfd4788157126a29e9f8cbcf5625b0004b11a2bb971efd4b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220721, "uuid": "5c28fd7c-8e9c-4aa2-823e-ba79bf4f0639", "comment": "Malware payload (Amadey)", "value": "5ac2f82f6197f300b33aec830526e1cb8f6716dd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220721, "uuid": "58506cbd-6602-491d-ab3f-4bb39162f82b", "comment": "Malware payload (Amadey)", "value": "5b4b48f58f0a5c920751f6c922e38effdb492220fc8ae604da5cc664d4429c936244114d66426c19fa0da7de955358fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220721, "uuid": "7a4a9d48-65e3-4463-b3bd-3dc000963ddc", "value": "T132052207F3D48537C931673458FB06432A36BCE1E934935A2B59988EACB39C4697372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220721, "uuid": "7aa5f093-b0cc-48ec-ac49-5a895b530f27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220721, "uuid": "f235395f-2dd9-4b3f-a02c-1b98b0f3bdd8", "value": "24576:kyD3WwRuxJkBosX7/lpNiVJUHbxLJmU6Aa1/daRe:zD3WsoCzAgHbxgU6As1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681220721, "uuid": "5b9c5c6e-06f4-445f-b171-0c17a0a9996c", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681220721, "uuid": "e4dc6792-d36e-4b90-822f-8b2437de5c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220721, "uuid": "a2ce866d-200c-4fd7-8d12-2fbed4c7ef95", "value": "8dac4ec3a72c968dfd4788157126a29e9f8cbcf5625b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5543d961-d89d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681240577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240577, "uuid": "459f2c63-9551-4040-91c8-a4de14e98129", "comment": "Malware payload", "value": "d00a6b08f489fe7e6ef61430a0fa0a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240577, "uuid": "e6a9eb52-dc8c-4805-a249-70a689fe8fe3", "comment": "Malware payload", "value": "8f55ce5d7f390d44ebbff1e06e416ebb2ee044ed53182f5ceee6124256bd64cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240577, "uuid": "aed3e54a-c9a8-4eb2-9998-0d73ab7690bf", "comment": "Malware payload", "value": "f3fe73d259f51bf1f97c24f4c23220faf60da670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240577, "uuid": "c2ed4311-48b7-4cdb-a8cc-da1a42ee7544", "comment": "Malware payload", "value": "e9f3c08b104cf6516e2c66b9aecfb26afa0d780431f18b180e9430c20c73a21c234cedc4f13331dfc9b48c741b04dd5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240577, "uuid": "4b554c4f-91da-4236-87aa-88962ccec729", "value": "T1E0A53A343DFA9019F173EF764BD8B997DA6FB7733B03545E205003868622A41EE9253A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240577, "uuid": "57b93800-31f0-476d-826d-46069b571c64", "value": "24576:uZto2Cna7BhmR5rYyzRFoRuU2zLq8jjSBlexvTMIOkKA5:OSchWVzoR6Ed6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240577, "uuid": "430c0097-6870-4439-8920-a2f494da6ea7", "value": 2217472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240577, "uuid": "a173b695-083f-46c5-b95e-6ee63e0c503a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240577, "uuid": "0c9a2b25-769b-472d-ad2c-67b8e7889011", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccfca65-d866-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681216913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216913, "uuid": "8ea66b7e-e3c4-453f-9794-1940d0e5e0ca", "comment": "Malware payload", "value": "f564408eac90527cddeac1e0f255a52c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216913, "uuid": "140d571d-7804-48ca-936b-2d5d5bcedc2a", "comment": "Malware payload", "value": "90013ef675be493c7aef23aab48164b38ddd7564697fc15b137d2775b1bd142c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216913, "uuid": "15e249af-71f5-486f-8eae-2146174bc193", "comment": "Malware payload", "value": "aa6b6227133068a9fd5607aec1b587d3f4271337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216913, "uuid": "236ada21-56ed-4d8c-b374-fe01336ab4f9", "comment": "Malware payload", "value": "9856b3ebab3716f33a33e69f5ebdc79f34795a176862d56416b806cf6b3c20358b60507d90c31273455e7a5edb69f9f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216913, "uuid": "3b650b8c-6def-4ae3-b9e9-6ca5e1ba373a", "value": "T1ED338E2F39E40673D1C3C5F025E08B367F3F2121226195939E58AD662E316E99F3AA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216913, "uuid": "c7c5093d-6052-4f3c-85d5-cc69ab5e8158", "value": "384:APkO8369N9ABTE8YVlLrpkm7RUcpWw09+0OrqxB4CarUyBoyJEW8L:XOjUE847RM+PqxBXD4HEW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681216913, "uuid": "9f035e91-d603-4142-aed9-20d43056745c", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681216913, "uuid": "093d86e5-0298-47e5-a451-741e460bf430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216913, "uuid": "26bbc186-d808-4321-b8a2-58061df04486", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen8.7616.9173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7475b09d-d836-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681196391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196391, "uuid": "1e34f3cc-9cad-4ea6-a50a-a5e9b2b16466", "comment": "Malware payload (RemcosRAT)", "value": "a151f0a53c44165228226f73f42789df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196391, "uuid": "6d4278d9-0216-4dd0-828d-9a3560db432d", "comment": "Malware payload (RemcosRAT)", "value": "91591f30fa6c90a96fbb95b72424ce5bfdf1f6342630991bfc69f980086eda14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196391, "uuid": "e75019eb-3db2-4be4-96bc-2d406a2d7d56", "comment": "Malware payload (RemcosRAT)", "value": "a7302138aff2bdd8e1b3635dc38b3726543c263b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196391, "uuid": "2866fb84-b88d-4681-b6dc-04438bd6373d", "comment": "Malware payload (RemcosRAT)", "value": "7f21da3df0713f81b3dd5bf9d2bb0be8857f2aac5551bbdcb050e06f086bc4bfaf58507073bd9081f19bbd601a707959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196391, "uuid": "009bf80c-887f-4825-b98a-1c5a1b5201ab", "value": "T1598401E03119E466D8A48D34D43F61FA5AA4ED2EF9607D47E3C57F1EBD332E09226242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196391, "uuid": "acdf0c9c-9d3a-4490-8e58-42716a7962ab", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196391, "uuid": "7123d8e2-3e0f-4100-b3bc-db3ac501d3f4", "value": "6144:VT4DtsQ8+SSlrveTVNPnjX+P+xLfDeUZk8WnKNMh73/k5cAduFWUfYic+JjmEY:VTB7SxeVNPjX+P+LfNm8WKNMJ/0d0Wyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196391, "uuid": "7a0dbd77-ff26-455f-8abf-227832cd51ea", "value": 384808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196391, "uuid": "d6683960-815b-4559-af15-b1e4c59d53fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196391, "uuid": "b640b8d5-4222-443c-96e1-b3a49aa0d887", "value": "price offer Ref SCML-S-704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8945166f-d84c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681205875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205875, "uuid": "45cc9f60-33b6-48d0-b6aa-a8ac2c5d4c3f", "comment": "Malware payload (GCleaner)", "value": "21a71b6a7f7c140a7b3a8a9112f86318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205875, "uuid": "53affea8-368d-4fa8-95a1-eaf0c551c45e", "comment": "Malware payload (GCleaner)", "value": "91ebf3d6754fa3615c27f003cadc820d0f22d15eb43c1991da905d50f871805d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205875, "uuid": "12fa849b-a524-4ab2-8437-13a1b3c8a93d", "comment": "Malware payload (GCleaner)", "value": "0efef77ebe958a59dde953e75d39725e7efb5c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205875, "uuid": "e43554f5-281a-4165-a2d4-0b5ac213390f", "comment": "Malware payload (GCleaner)", "value": "767da406d18e89d35137d9e74c9205399bf2f5ebdab21893eafca7ec07f4dc3e1fdbd366cf993ac421ddd0e7f9b59e42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205875, "uuid": "7113f2e9-4970-4790-909a-86664f3e1c23", "value": "T1E944F231BD904831D89B7A358832DB6526FFF9536631554B7BB823A9AF217C0173238B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205875, "uuid": "2dd97c80-2a96-404e-be5a-86ced2a783d2", "value": "4c3723f654b7ebef4d253c089e97df92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205875, "uuid": "62744caf-db4f-409f-85ab-6fd29efc4467", "value": "3072:kG284CxTIuluIbCETuXsP2o/AF4OGxgpKiYYFm9caiCjQ+9argtKuDlY:N28Dd8WJfP2tFwfp1iC8+9VtJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205875, "uuid": "020897b7-7c3c-4199-92f9-136f94528926", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205875, "uuid": "e566bd84-c489-440a-b0ca-94c451001bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205875, "uuid": "36a59d36-c4f6-417d-ab3d-73fe6651232f", "value": "21a71b6a7f7c140a7b3a8a9112f86318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb25fcc4-d802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1681174202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174202, "uuid": "7b6c86ee-1ba2-47aa-b325-c9458a842abc", "comment": "Malware payload (Stop)", "value": "180bf710ded7263871c5e371af11491b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174202, "uuid": "ac64c552-df09-4e6c-a15a-912fb13314b5", "comment": "Malware payload (Stop)", "value": "92283c519a8217870e49bb095c7ae0d7da60aaa444e943bb7d793a3d5da7dcc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174202, "uuid": "45e26dbc-bf79-4dab-b57a-c41e2ded3f7e", "comment": "Malware payload (Stop)", "value": "cf348c625212198e9a71b1cd4485d4b622c5fb37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174202, "uuid": "278c8519-6537-4fef-9bd7-8b6f3a78baaf", "comment": "Malware payload (Stop)", "value": "b148bfb138900423c3c2acdcd3d55d9a521e29b4b0c7e61be8290782de6f67b75d5497f856a6f1f5cc7b46bddd704cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174202, "uuid": "07adb633-8532-480b-8970-8094c98fe4f2", "value": "T16CE41322FAD1C472C16B517814659BA0BF2E3C35C309CE8B5738A7EE5F606C1523EBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174202, "uuid": "c96b90b8-ddd6-4e05-aaa3-d254c9b840e6", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174202, "uuid": "62db8ffa-cfe5-4650-a467-ad05312dc032", "value": "12288:8LeFJQlDHFmyEswjoZ0CR6O/VITP0Rq0i2qCqe1Wg5yLUGQoApkzYdxMuB66r5QY:keFJqrFrEseGgOlDiYT5yLHmAYfi6NQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174202, "uuid": "7c8f9292-23ee-429d-9fd2-c91e8a85d161", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174202, "uuid": "8bd87ce1-0fbf-487d-a2e6-073244ffc0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174202, "uuid": "1820be8e-eec3-4d14-abda-0005fd31a32d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff78963-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242608, "uuid": "12244f1e-ebd3-41f2-9407-705dfe97e11a", "comment": "Malware payload", "value": "364f68b27aa6f5064fb665e2b6d4d5d7", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242608, "uuid": "bf5d224b-43b6-4cde-8b0a-9451b3ff0a8e", "comment": "Malware payload", "value": "92899ef29519d9c665bc0cb8e23289954202829b52a794c588e5f7c065f4fc01", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242608, "uuid": "ab7b1f5b-b637-4e2d-8a09-6e0b683cf74b", "comment": "Malware payload", "value": "0d5b0a0c46bc727b21cb2de660802c408d4581ff", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242608, "uuid": "91e52ff2-3161-4e84-9650-ffe36bea40ff", "comment": "Malware payload", "value": "4680d7b537f0d5b9564b8a6165efee612f1ba2866079eb59b71aed4a40c85397f6917d5095d625e47e88d1d73e4c2f5f", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242608, "uuid": "d54c20ad-c2df-4b5b-8245-293a894b6dde", "value": "T18463F19AFAD84CCDFAD7DB2A53287A1A146C7563CBD060C2303919CB4CC8D34A5566EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242608, "uuid": "59a697da-eed7-45df-b3a3-737f686d043c", "value": "1536:Tvf4CSwbt4ukU7heYGDw9v/cx/W78BECsi+3mZ3FS2a:TKwbt4ukU1eYG2QM8BEpigmZta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242608, "uuid": "00d6c0ab-2f46-46e0-86d9-dd7435939930", "value": 68066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242608, "uuid": "b4bac2d7-e189-4e44-baa1-76fa5067134b", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242608, "uuid": "55747ba1-675d-4659-95b4-51f1ef241d81", "value": "rv_December.15(59884).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad213472-d829-11ed-88f6-42010a9c006e", "comment": "Malware payload (LgoogLoader)", "timestamp": 1681190902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190902, "uuid": "86954e4a-e5ec-4028-9c72-965c64e881ac", "comment": "Malware payload (LgoogLoader)", "value": "58ad2aa0207ba9e35d89bb043bee822f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190902, "uuid": "fb846f94-6e69-42ac-b757-c154aea50e19", "comment": "Malware payload (LgoogLoader)", "value": "930a63282cb708987359d4c68a18b8d31ce83bd112bb792ecd803556714741d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190902, "uuid": "088cf339-4f70-47ed-8b15-d27f3161efbd", "comment": "Malware payload (LgoogLoader)", "value": "2e6ad85bc62f131475583e0819dec7d6a4a32192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681190902, "uuid": "00e9763d-d600-4459-8f75-9c77a0de4c7e", "comment": "Malware payload (LgoogLoader)", "value": "f159b8ab22cf108528a14b620cd1bdc37c5700143cdb91785d9c60acac848a33c748437ccf20544a2024d62d80318a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190902, "uuid": "6edab4b2-e828-4ed2-9a74-c36beaa1926b", "value": "T179554A2439FA501AB173EFA64FE478E6DA6FB7733B07646D1091038A4723E81DD8153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190902, "uuid": "e044a950-5254-46b9-8133-ce7b9c5e0c02", "value": "24576:pX71x9GDZJ0oA2m3pugV1y/vVyBs/FY4C:9ZO0oA2ZtwKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681190902, "uuid": "982be04e-18e8-4c43-922f-6df7953ec521", "value": 1315688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681190902, "uuid": "b4eef176-0452-4825-b702-e0ee037c2c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681190902, "uuid": "d14854b5-ddde-4c5b-997b-dc93d547e2c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96b9a48-d85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1681212827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212827, "uuid": "9922f001-c187-479a-be80-af9ab74f0c29", "comment": "Malware payload (GurcuStealer)", "value": "4f0402bf30445ece92c85cd3ee8240ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212827, "uuid": "04d50fbe-86d1-4cd7-9095-339708dbbad7", "comment": "Malware payload (GurcuStealer)", "value": "94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212827, "uuid": "958b356b-2781-43bd-ad7a-0baa58636761", "comment": "Malware payload (GurcuStealer)", "value": "26d327332540b1bbe091db0f7e2345a1295ae271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681212827, "uuid": "415d5c31-650d-4e5e-bf59-358cfb7ba5af", "comment": "Malware payload (GurcuStealer)", "value": "555f3ab97d0701f76f6e0f240324e01b1b812fe2476675e2a804eb4e031fc425b8c50d30dce6632d57c96cd66554d36a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212827, "uuid": "5916b998-b825-4bca-bc4c-5858ce4cc421", "value": "T1D3033B23B298D339F2980B7155B242291771C3437B42E74E6CDDE09E6ED37D48292AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212827, "uuid": "4e545779-ee9e-44a8-b7a3-6419fcffb63a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212827, "uuid": "413d2b9a-0a9f-4651-aae5-6506ad8b0709", "value": "768:qz5oDHOiKsJOqee51+SJ5K1BbDUZLxilVHSc0m/pWtHWpHWXBZlLBB1DezPmE/nz:qz5ziKsJOqeov4bDQOxQbeRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681212827, "uuid": "5b501b62-e3af-455e-a7cf-9d37d49f475e", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681212827, "uuid": "844ff322-6d6d-4b42-a660-eeceb53cc06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681212827, "uuid": "e1c076cb-207a-44f0-b18c-4de3567bf7b1", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.25609.10697.2823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fb3b66-d89e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1681240903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240903, "uuid": "9e2167e1-9f3a-427b-8457-0a42eafbc986", "comment": "Malware payload (Tofsee)", "value": "a5c546d0ae979c3e066b4d5158c9d0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240903, "uuid": "33b423ba-4cda-4a81-a122-8b09429efcc1", "comment": "Malware payload (Tofsee)", "value": "9503d2df4557c2acc790e6682d01b19ef513dd831436941f895ff2d092aaf305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240903, "uuid": "ba1641e3-bf1c-45c2-8cf6-c265d0d34e02", "comment": "Malware payload (Tofsee)", "value": "0ed6d7dcc5549a9c8738b8728ccb992ccc3b61fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240903, "uuid": "45f34fe4-e9d0-4593-8678-1e7045d958c1", "comment": "Malware payload (Tofsee)", "value": "b40efd88eb368a3f082f0199fe8fa2f1df8b4f277811aa94655428903f5e080e4223f8a743d3ca455b66dae95f04a7e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240903, "uuid": "a5075c9e-a17c-4892-9313-290452a3e357", "value": "T17414D0B1BEE0D072C16F817005A4DAA47B6EBC519735868F233CD7BF1E20791866B71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240903, "uuid": "b5b92a1c-e4ec-428f-8311-0205524bdd99", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240903, "uuid": "6f75328e-f4fd-40a4-9e8f-31f610ceb5bb", "value": "3072:zTcCZanO5cvXQzl6UFa90YKUVVH2GbCkgC3WfRzReK:HYO5c4zfcVVHLRgC3QzR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240903, "uuid": "254dcc68-ca62-43e0-9c06-b17f09e8283e", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240903, "uuid": "54a1c812-e747-4b27-92c8-48349433bb31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240903, "uuid": "4932c9a3-6dca-431b-b180-746efe72482a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf6417c-d87a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681225772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681225772, "uuid": "bb8ceef6-2910-439c-852e-a70701802a6b", "comment": "Malware payload", "value": "38d1762d06d99153e1e70681c1455d83", "object_relation": "md5", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681225772, "uuid": "117ddfaa-3f6d-4f38-8259-7ce795f49f09", "comment": "Malware payload", "value": "96513e4ff76b39e9a32b32df5d43975047b25b427c326dfb98be708b82b080ec", "object_relation": "sha256", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681225772, "uuid": "24adb0a5-92b5-43c7-9849-bd006071faad", "comment": "Malware payload", "value": "0a9573efbc9204620c85a51068d1f3dd688bc1ed", "object_relation": "sha1", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681225772, "uuid": "fd1a7a17-db7b-48a0-866b-e724db84c7b0", "comment": "Malware payload", "value": "e8caadb6fc1c369ec5844dd63239efd977fa448d06aa2fd1638285a2feca0366c3385c345fde9921fd109143b2d05921", "object_relation": "sha3-384", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681225772, "uuid": "a1b45f24-bcab-4c66-8617-4717d7965318", "value": "T161B4235A137467AC0CCA28A028163473F0D5B72816A3FD398C61D675E8F94B1E39E7B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681225772, "uuid": "0ca42dff-514b-42e0-ba10-40707b97c0c4", "value": "12288:8SEBNzWUMCmQ+hTv3x3MfmpxuI7KsY8o5NRUcYZma7gHYH:8xNiUMCmJTvaiRlPo3yxga6YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681225772, "uuid": "258442da-739f-4cfe-8c7f-dbf100d04395", "value": 501797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681225772, "uuid": "aa189dc6-57fe-456e-ae4b-b770747881c8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681225772, "uuid": "987a6397-17f9-4ac0-b979-b0ab57778087", "value": "nRecebimento pago OC456337.JPG.r13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a2137-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215315, "uuid": "6d9d139f-50c5-426e-9872-e13ee4993fc6", "comment": "Malware payload", "value": "d9119df1f66194f5fdf05832aa94d3c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215315, "uuid": "d4e3b09b-ffc8-42ad-ad46-5254359da13b", "comment": "Malware payload", "value": "97af703e9ef4ee13b2ccfcf5edbb760698cc61ff0dcf2a7b5385e3b7a611ab5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215315, "uuid": "7838a13a-2022-4fa0-ba4d-abb1cd10a405", "comment": "Malware payload", "value": "00b5be85a1bac5ca6eb377776c990c54c81eb00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215315, "uuid": "76c7b3a6-9236-43a8-ad7b-d6221a517558", "comment": "Malware payload", "value": "d6b17a7c0d581154774eb5f5d42b30016a5b40e6e8781b120b499a918a817c7ddc78ba58dccac37f501a5ce93e294400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215315, "uuid": "13fe1cce-3a3b-4cd1-821c-6108680b433e", "value": "T140F5C022FDBD4439C46312719E99677D676BBEB42636011720943F2A7AB37821E3D833", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215315, "uuid": "bb4de43f-893b-4a68-b715-8cc51383df58", "value": "8745df7883a801a0067a7a9eb683d9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215315, "uuid": "c65a99ed-a542-4587-9dcc-386f4a76c050", "value": "98304:Wbjsyw3BKLujJ5iV0hH1bRWydCOHoFN6WtljaEy9/FLOAkGkzdnEVomFHKnPQ:We3YY1bRWybHmN6WtljaEylFLOyomFHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215315, "uuid": "8b1dac45-3526-4893-aa0c-0a77414d9820", "value": 3383993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215315, "uuid": "42914fe7-fa87-4161-8a69-9a3f3c5ba0e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215315, "uuid": "519d94eb-83a7-48ef-a1e3-5582bb9daa0f", "value": "d9119df1f66194f5fdf05832aa94d3c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f611b53c-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1681204339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204339, "uuid": "48ac1822-1bab-41d0-bad9-2ae2732bb0e6", "comment": "Malware payload (SystemBC)", "value": "a13a5fc5d8435746a107fa215569dff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204339, "uuid": "ee1f6127-3bac-414d-967d-4f7b20a838ba", "comment": "Malware payload (SystemBC)", "value": "998b16d93ed1043b616cddfcae2cbe10b6f4ae05b9bbd1abed4a99ad11205444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204339, "uuid": "8fc500ba-3877-471e-9ae9-eee8cdf2674a", "comment": "Malware payload (SystemBC)", "value": "8a57abae4d0476a7a3bb8c2c1a13840764bacc64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204339, "uuid": "4fd5032a-4d0c-4faa-9f9c-9a570d897dcc", "comment": "Malware payload (SystemBC)", "value": "aa9bd578196ac57dc0b239c9e21cb2e674c032ce9b4b3875fb99a5d955963b67d1e1adbb0faba6000f10633610461916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204339, "uuid": "1780843b-5cf7-4b3b-b8eb-c6b32189e9eb", "value": "T11D24D0127691C071C85345B49834DAF82E7EBC726A98CD4F37183BAF2E716D1B672326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204339, "uuid": "4991a4e5-8f7f-4360-9ae3-e4b8ebe264bb", "value": "8b8924b9f5a673fd70977d21932a217f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204339, "uuid": "d241ffdd-0290-4671-900e-99c9a60bf387", "value": "3072:WB0TLZfEOrp49tv1WvDQR/Splb5YY7ibpyhuQ3xJIdBAKlpfhuekCj:I0TLFdVQR/Sp8Y4IhfqWMhL1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204339, "uuid": "3f660a34-69f3-4163-bfa7-2846d1a4b799", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204339, "uuid": "96bf11e1-4eb4-4b78-8984-8f3849b76fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204339, "uuid": "7e8ac065-e42e-4713-89f5-ca36ee1faa4c", "value": "a13a5fc5d8435746a107fa215569dff8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59df7cd8-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681195487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195487, "uuid": "2023136f-a51c-4424-8b6b-507cdbdd8e2b", "comment": "Malware payload (Formbook)", "value": "a39ac77792715123da91a9b77a804783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195487, "uuid": "5f4d2ebf-b5c2-4349-8520-b5bb18c42e63", "comment": "Malware payload (Formbook)", "value": "99a833a7f0d2a24daabb91a0c92132015c8f13043469199b284bc7d9e1f3c0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195487, "uuid": "f91314c3-b61d-4ec5-9ccf-6ceed74de1d5", "comment": "Malware payload (Formbook)", "value": "f12d5ecfd7b4754f2a67b10a33479ebdb7c21f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195487, "uuid": "e1e11f16-29b9-493c-8b26-db1a78cd6dd3", "comment": "Malware payload (Formbook)", "value": "f3ed39922de80fdf70d8124190eb183f419db0fc675836b8dd8312ac94eb3a37555eb2e0812d00d83b1b81c15516a379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195487, "uuid": "d5bf2c58-94ae-40e3-9870-88e6362889f4", "value": "T1C95412179561C22FE5E347325FF5DA619FE7B2526DE8434707A0886D3973380A90F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195487, "uuid": "9a5d9be8-ae96-4e84-85bf-f1e578b8b813", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195487, "uuid": "2def19c6-0b70-4a4c-bca9-e6f1df110047", "value": "6144:JhtyHU2eaCK8cPAeRYu2GsYXAoTQ2ReoOi60TkV13uOJM82X:Jh4sK6bI2i60O1M82X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195487, "uuid": "1641b16a-942c-4a22-a27a-b0260832ccab", "value": 302144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195487, "uuid": "acb8cd96-0beb-4632-ae9b-48dc25bb07eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195487, "uuid": "6f228505-d899-4546-ae75-8e82d22d0ed0", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42041ba-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195719, "uuid": "13210e47-8a24-488f-858d-ad679bdf407e", "comment": "Malware payload (AgentTesla)", "value": "fb5e4cce4d0532a6da8cc43c2b63475b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195719, "uuid": "1f0a7238-c3b5-4f3c-9b04-94926ad2acaa", "comment": "Malware payload (AgentTesla)", "value": "9a9ec942e738710b75529481a394756af7787a2da6af85e17e9a707ce4e3550e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195719, "uuid": "f2510238-df7a-419e-a3da-031f33412bac", "comment": "Malware payload (AgentTesla)", "value": "52357388f72bc678297b7b373277b002ac53e2f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195719, "uuid": "d2231e6c-7b49-4347-a320-7da7e6b7f06b", "comment": "Malware payload (AgentTesla)", "value": "cfac3fc7fa0db17574df96d301c92b74cfa50c885a6507d6c920686511f2d9bf44cdbfbe8a27051059d749aa0fc0e3fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195719, "uuid": "da01f762-7d26-4901-95b2-17a6669c3d39", "value": "T1AD546A9D766075DFC81BC8769EA81C64FB207477A70BD243A02312ADAE4D99BCF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195719, "uuid": "5a261d57-866c-4da6-8940-42d6c372872e", "value": "6144:ccHVU6Xpa6EvRFebweYHqn7zU2J4eh/ZLxI:vZePAV7zfZLxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195719, "uuid": "033e4f54-dc35-43c9-b7df-077600aa9e99", "value": 286952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195719, "uuid": "a4fc7f29-942e-44f7-be5f-8eb9a6feb009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195719, "uuid": "51ba78ed-f70c-48f5-83fb-1116d5aeb0bf", "value": "Yeni siparis listesi10042023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc4ceea-d80d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681178693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178693, "uuid": "011a12be-a347-49db-87c0-e4adbf314dc8", "comment": "Malware payload", "value": "706c9260a05eb12e656c7822927271c9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178693, "uuid": "aa9255a1-5ef3-419e-8e18-8452a64bdd2b", "comment": "Malware payload", "value": "9b19e19abd0c1953b4e634ccd32d8cf5e92665ec6bfe4316f435264ec3b60c34", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178693, "uuid": "9fbab07d-162b-4e2c-88b3-989af41215a9", "comment": "Malware payload", "value": "ea4e823e19ff8fc00d8a57367dc04ae02248dd46", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178693, "uuid": "4d5107fa-1f96-453e-b2c0-e5f695e5e345", "comment": "Malware payload", "value": "1a091c40afcd4fb05eb166488d4c25d1382e0b7593151c6caf8b622fcfd132d2365dadf3bcb26f16d7d1e48cf1bb818f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178693, "uuid": "fb1a2855-f23f-406e-84cb-2de0d8031951", "value": "T1D56633703F30597BF74F40BA6A640DC1A2E876406ECACDD077F7788409AE5D215BCA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178693, "uuid": "b1440253-016a-493a-9701-8c3260c4e8a8", "value": "196608:2Wu2Qd6zFK3J17mzlhv/RHuwLYT1llx0EUSgra3+ZJXxmo8uIk:2h6zFK3J17m55RHuwL01llqVTaGXJ8dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681178693, "uuid": "888b5f7f-aab1-4350-bf50-0d4ad3e5a58e", "value": 7061742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681178693, "uuid": "07b4188c-4dee-4752-b69e-67ef0294a3c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178693, "uuid": "1914761e-1bda-4b21-9b74-53e3ef5d18e7", "value": "Sandeep_Lamichhane__videoMaguindanao_video_from_CCTV_LEAKS_FROM_CAMERA_HOUS_-_SECRECT_FROM_911leaks_CAMERA_(1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e21109-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240086, "uuid": "263d48e2-0486-461e-829d-434f1ae9d233", "comment": "Malware payload (Mirai)", "value": "5a03391aad155148a87dfb67d77cb057", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240086, "uuid": "3d283829-7f36-4dc5-a77a-61ee82741175", "comment": "Malware payload (Mirai)", "value": "9b77be28356f01198e6fdd8aafdcde11ab8372f345f1e654d4c9a99a5c0b1753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240086, "uuid": "758f7d66-7b44-448c-ae71-f9b249145369", "comment": "Malware payload (Mirai)", "value": "916f2b8893ecc23be0e721725052446a60cf2259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240086, "uuid": "8ca7257c-1017-4805-8877-124156e223e6", "comment": "Malware payload (Mirai)", "value": "bb59063ada330bce9f9620205cabef3f5c87a506af520edd43f40bd9517a20a512f4b4932cc984c92b5c39bef0363fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240086, "uuid": "75af2d8f-afe8-4bfc-bb06-e3506a92ab82", "value": "T13493830E6E259F7DFB99863487B78F25AA4823D627D1C542D15CEA012E6034F341FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240086, "uuid": "dc883e89-4ed5-47d7-9747-91307df4ffa5", "value": "1536:yvzdQR12WYhstqsJFXLdwv5HWmBrEsCFq/TBIged:G22PhstqsrXav5HWAEsOQlInd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240086, "uuid": "55b92d1b-fb5b-4510-b4d3-ae9eacf47def", "value": 97436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240086, "uuid": "03e10452-ab6a-465b-a353-690c72c09718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240086, "uuid": "b3a87749-7770-4ae7-8a60-c849dda738a3", "value": "5a03391aad155148a87dfb67d77cb057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74df61c3-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681205411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205411, "uuid": "904eb2b6-77c1-4385-9edb-31f093114251", "comment": "Malware payload (Smoke Loader)", "value": "066b02711e1f408bac89314fb7276995", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205411, "uuid": "a996efb2-a551-4f96-9a6c-489a8f0f7195", "comment": "Malware payload (Smoke Loader)", "value": "9bf7a5f2f86ef5ed1fec866ae9f9eb20148a0d27a0769eb9aaa9210393e4e38c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205411, "uuid": "7cf3d232-f441-4174-8aaf-a07e1cf9b0a8", "comment": "Malware payload (Smoke Loader)", "value": "082c2bff03b9a8ab2d1b2c7ff99b2d0ad8474cba", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205411, "uuid": "02996fd6-9744-4122-acc3-6d40efc4f0f3", "comment": "Malware payload (Smoke Loader)", "value": "6a756f8dc994282e0a29afdd3bc16b64719a3dae3e1d664ce02b3604e029940200252cb353bb9e0d5f7c62b527090792", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205411, "uuid": "77e58326-5327-4618-b2db-e84e6237fea8", "value": "T13B14D021FBE0C1B7D46B45714820D6E06BBEFCB19B64918B336467AF1E30ED05B26366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205411, "uuid": "742688f9-ddef-4584-a5f7-2fd3c56b9ad5", "value": "a1cd3e7956f73508d7120d1c096b4596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205411, "uuid": "c7fed7f0-712d-4382-968a-2418fa7c8156", "value": "3072:/M28nc6SCINHc3G0EnrS8kT4c6U5GeI+GYG5totb4HW/bunrpXhOv2a6:028cr83/ErS8k4c60G5tST/s24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205411, "uuid": "879b8f55-eb4d-4ab3-a33a-1535204f9e69", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205411, "uuid": "628538a7-52c6-4c0a-96f2-379ae40e4d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205411, "uuid": "b15718d2-3032-4303-8a80-c844f3eda2ae", "value": "066b02711e1f408bac89314fb7276995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1fa254-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1681221803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221803, "uuid": "49842650-271b-416d-9996-96b67988266a", "comment": "Malware payload (Socelars)", "value": "8ba5a77cdeb81b4277c5e1711d167760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221803, "uuid": "291159e7-28f0-4851-b318-99fd9b21d1d8", "comment": "Malware payload (Socelars)", "value": "9c4c6ce395058f16942dd88e34dc4472663bd25a501c11ad0eb9d69ca241ce04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221803, "uuid": "3d6fd664-6de8-42fe-9f0f-4fb6b11c03d6", "comment": "Malware payload (Socelars)", "value": "dd5eaf2daa7f07516ca73132639631da5933d160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221803, "uuid": "c31ba755-41cd-405d-b7a7-ac4d68d0fcc3", "comment": "Malware payload (Socelars)", "value": "83ea5463e41b4f130921efa077b7a529c121f3ef8074ffc13ee7522a48353d05a1d49010cde1e4eeb78ba7e56a0b53c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221803, "uuid": "9f56391e-45e0-45c6-8919-f1f4141660e0", "value": "T12B658D21F7C26032E8E310B745FF66BE9D3C6A114708A4D7D3C81D999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221803, "uuid": "c35cfe9b-1e80-46f7-8961-82fa1decd422", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221803, "uuid": "93d97934-ad8e-4da0-b6e3-b4b72ab18bf9", "value": "24576:TVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEDN5hst2W:hpJOl8xFMRy/SeQgZ52gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221803, "uuid": "d37f5e88-f1d8-4bba-a8f4-1e6c36651c3c", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221803, "uuid": "34a51478-12de-42f4-8774-65564045fb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221803, "uuid": "391bf96b-d6a7-4d81-9ece-35dfcfebbe8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a9c127-d890-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681235099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235099, "uuid": "bb2cf4a1-3717-49e1-ae68-60e306ecb82f", "comment": "Malware payload (AgentTesla)", "value": "95c586af180858c3bdb82c8c5da52075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235099, "uuid": "a834abdb-1914-4ba9-a32e-07ac7895ca5b", "comment": "Malware payload (AgentTesla)", "value": "9c9055a2368db996be7840d7e3245b6baca98a91f61fed1e04277316569b8c81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235099, "uuid": "bc977f8a-8e2e-4380-9269-ae96e99ba05c", "comment": "Malware payload (AgentTesla)", "value": "a39d52ea6017c19c931e2d9fab3eecee59ae8c11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235099, "uuid": "55ec1ba3-a0fe-498c-9efb-8c549bf5496b", "comment": "Malware payload (AgentTesla)", "value": "9804400481386cac80323e1403c9c89fd0a29c37f2db901e705220a75d04d7f1e3cbabaa8ded5ce55fd8fc0b303309d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235099, "uuid": "1779a054-c744-4662-95db-681235918fbd", "value": "T115F47B012A54C3D8F5D1B43E3638492716F47C4E5BBE9AB1C6B279D379933CB90C2A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235099, "uuid": "64c423e4-8588-4390-8417-0c015125ed32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235099, "uuid": "e54ed723-09bb-41f1-bf5e-98550d821b79", "value": "12288:/p2iNGSv7TfSvVCu3u/z+ybE8QXGgJ4nktmU6aZY:/p1QC7bS9Oz+GJQ5ek5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681235099, "uuid": "b40a353d-532c-4d33-b240-e847d19ada3d", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681235099, "uuid": "fb409d72-95ac-4186-9dd0-e206848468ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235099, "uuid": "1c2b40c4-6931-4b19-9f88-1cb7b6de0183", "value": "WaybillDoc_7807431483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f90a74-d875-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681223418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223418, "uuid": "66ebf56a-2702-43f7-b943-65bb09d9e823", "comment": "Malware payload (RedLineStealer)", "value": "0255276250f7d361287913c229383415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223418, "uuid": "33eff6f0-5a33-4d1a-99e3-6877c52f9b0b", "comment": "Malware payload (RedLineStealer)", "value": "9d980e1a7317c89d5056147704ac837e531309abed0401c2f845cf186f15828b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223418, "uuid": "d5253e8c-aaae-42d1-b797-f8f74ee24192", "comment": "Malware payload (RedLineStealer)", "value": "543860ab5c7c0f15aead2f62dacb1451da75349a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223418, "uuid": "45f9d633-7ae7-40ce-990c-33980b025f94", "comment": "Malware payload (RedLineStealer)", "value": "714d55ae808b5dc1ede98e019b5a8cd2626b89c4f97676371309fa507db51679130f8af58d673d585189ce97cf7bc9bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223418, "uuid": "73bf82a1-bfa7-48a4-b08f-c7ca3522e065", "value": "T171051213ABD44273E9B6977444FB02C307367CC4987883AB2755A86E1C736D4A87636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223418, "uuid": "be644c8a-f752-4204-b24c-6cef5d3df8c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223418, "uuid": "b1b844d1-1a00-4c36-b4ab-0050f429afaf", "value": "24576:DywmypP/IDeCC4H5gPbbLdG7bTEVuUD+:WwTID3uPbbI7bTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681223418, "uuid": "f18b0a4a-061b-4d90-bc12-7d53f9aff16a", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681223418, "uuid": "81c6169c-89ea-4ade-a68f-5c0fa073f052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223418, "uuid": "0d2a7ce1-f46a-4fbd-880a-311576359e86", "value": "0255276250f7d361287913c229383415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00f68c5-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681214154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214154, "uuid": "afaa58c4-1f15-4943-9c5b-5cc5f41fea1d", "comment": "Malware payload (AsyncRAT)", "value": "8ff30ec3731ef9eaf5564e7f1f9becbc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214154, "uuid": "6f061f65-946d-4dc5-b920-6fd85522a7f4", "comment": "Malware payload (AsyncRAT)", "value": "9e8322dea12684f3e7bd7c3673efe6616cc7588e82425eba31b5198fffa4fb01", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214154, "uuid": "c7b53041-4b45-48f5-aa59-bba6df004a7f", "comment": "Malware payload (AsyncRAT)", "value": "1ee30222e4280f23bef9770b0022521a66c84c79", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214154, "uuid": "ad5510cf-976c-4f51-a1b7-f8f6e5ad3235", "comment": "Malware payload (AsyncRAT)", "value": "860d0898726398cdf26137716b419c173484dd1ca79995b9d0674e726f48fffd66a03f38e9c7e71412bb048b78c37865", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214154, "uuid": "448eed15-0d7b-480c-9135-9adbc7ff5d1c", "value": "T133346B8C366472DFC827C876CD982C64EA6074BB571BD213A45726ED9A0DA9BCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214154, "uuid": "7cb52d21-6776-475c-9cb1-2bf7ecbb7657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214154, "uuid": "8297ba79-12d4-4454-ab91-757a8ec40b05", "value": "3072:lWzzLUvtOGq924tuHlSAFwAYybc8EQO8msPERl71Oh5GZzhvhk6QcQ8EKEHI:IzLcwV+uaEQOusf71OKZdvu6QcQ8ETI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214154, "uuid": "60dc07df-bf02-4449-a941-c67d8dc09599", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214154, "uuid": "82823481-309b-43d2-bc75-16b3608092ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214154, "uuid": "8cd73732-f6d8-4305-b7f3-418cfec916e4", "value": "8ff30ec3731ef9eaf5564e7f1f9becbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2854f992-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242649, "uuid": "59b8bdb9-593f-400a-8974-d44b30c480cc", "comment": "Malware payload", "value": "e341205970e643fff3c5f6a54e8ce9cc", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242649, "uuid": "fc61b9ba-5aed-48be-8ca3-a4020c4a000f", "comment": "Malware payload", "value": "9e8de6df1ef630bcdd89eb927de496e44d54a42d113a6c0829bb2daae7562131", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242649, "uuid": "b03c3bfa-91ae-450c-b84e-b68f16f8900c", "comment": "Malware payload", "value": "b2f35934447cac101ed8539dc252bbe801476d50", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242649, "uuid": "b6a43eb0-2836-488f-b6e1-177085f73d17", "comment": "Malware payload", "value": "3dd22ae575eb0895fd97a99a05e67ee4c023d6704fbb8a3c18e79a71e38c2ddec8a99e1a5d928558a6d275a0a2794270", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242649, "uuid": "deeb1c55-84cb-4334-95a6-655e01c63962", "value": "T18D63F1BCE4A81C5DF8E69B51673876ED942CB143A2DC181374740FA93C98E489263B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242649, "uuid": "b981c322-7d18-4da1-9187-f2903505af05", "value": "1536:xvwJMo9gSAuYuojSCkBhqMUnzGzVZOOnCCsPFJunLh:xouo9bYZGCuhpJkpPSLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242649, "uuid": "c3e863f4-473b-469d-b115-165004330680", "value": 70810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242649, "uuid": "101b7dfc-5ac0-4b6e-abc5-985c920b9232", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242649, "uuid": "a85462cb-1156-4ed3-ab9b-cd7d72bb9086", "value": "KY-May.7(74868).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a105da5f-d84f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681207203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207203, "uuid": "29f4eac5-6853-4e7e-80d0-0f713b7395b6", "comment": "Malware payload", "value": "fece7b72cdd4c1157f6fcf946ba87cca", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207203, "uuid": "9e8552b6-6c08-4f70-ab2b-f772b7a9fcf4", "comment": "Malware payload", "value": "9fdacd4c64d853387c08f6881eef31d1ec70f81755cb88b05ea167159f9690eb", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207203, "uuid": "122372c7-bbb0-4d17-b19c-e2e3281000e0", "comment": "Malware payload", "value": "a855c56765efe2a8b8ee278c861f9f8979028159", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207203, "uuid": "84dfb09d-7f97-4e6c-a84f-aec8f750683b", "comment": "Malware payload", "value": "4803815446afa35d1585b3e2b01253c2a443f70f968333c1bb87888c116e11a6fa5ef6fda60f630de18f84f1c1110f55", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681207203, "uuid": "ec07591e-c378-4c40-92c3-86d2dd2ba846", "value": "T182F2E17E733BE29200C5222C5D6428A69F82D67077968549D50CBE46BEC2EC609EE07E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681207203, "uuid": "a5c7af26-352f-4b61-9238-c94c5076efbd", "value": "768:YvahIfsRJEBwUx7U/Jwxc67RiVbtphSwAGV1cw38wnKnOCQBQHBLu:YvfElUxQGpiVpr9VmwnKnOzQhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681207203, "uuid": "4fe6eb85-cf48-45ff-8615-f9aeda2fc81a", "value": 36970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681207203, "uuid": "163d7dce-07ce-4655-af2e-004c41773d19", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681207203, "uuid": "7be7ec0e-9069-4428-a52f-a0d0317cddd0", "value": "iodcxsrild.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d135956e-d861-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215015, "uuid": "5f061d11-7f86-47e9-9f48-127f34d6a7d3", "comment": "Malware payload", "value": "33e438c362c05e0af21e36fc80903e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215015, "uuid": "69d44a5c-b982-4508-835e-31f2092a5bcb", "comment": "Malware payload", "value": "9ffacb75b1d260b2287079e473d5ba1ac703a724edd2ac9eaf02e7767805e0aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215015, "uuid": "1666fb2a-2e64-47d6-baa5-d53e441f7db7", "comment": "Malware payload", "value": "396eb5c718a237294c3cf47d7bc5e36873a58bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215015, "uuid": "37a4a523-8b42-4321-a924-e3d4fe2d4e3f", "comment": "Malware payload", "value": "dbe5b93961f6e0c040655d9201b152a44f686cbf240eb7cd15d5a26fefab30dfaec99b39ce04b91dd583efdd6f33ecf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215015, "uuid": "90459639-98da-4845-bf9f-fa14f8b3f527", "value": "T1AE263340A5EEDFF2E73E44F9E32F76A6B8A55020F5012F108969B4972DDBB351A84C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215015, "uuid": "2c854bfb-ee08-4228-b975-96eff3354bd4", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215015, "uuid": "ed39621c-d19d-4311-aa15-85000fbd15b4", "value": "98304:6qIem7a1uR+l75i485PvTNQxieQZgZ55VfjSQUX6lHvK:TIeSut5iNVTaWG5fthl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215015, "uuid": "032acd39-74a7-4ffb-a1d8-0be36b321cab", "value": 4513792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215015, "uuid": "292514de-bf84-4e78-8e5b-ad7e0fde0189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215015, "uuid": "f88b635d-63af-4c70-9b69-e3080010dc5b", "value": "33e438c362c05e0af21e36fc80903e10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414f58ec-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681195875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195875, "uuid": "e175949c-2a26-49ae-a9ad-ce7f91537dd0", "comment": "Malware payload (AgentTesla)", "value": "7537d6b0dc06f34aa274c8c361b40714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195875, "uuid": "d171db47-0112-41c9-970d-15e91bec3e21", "comment": "Malware payload (AgentTesla)", "value": "a00b290cc12ad7042a413db8e0d0a54d13e307793aa9e0f60797de992c91dc7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195875, "uuid": "53f56133-9e48-4674-97a2-1f1ce3433b7b", "comment": "Malware payload (AgentTesla)", "value": "f21ea4242760fa3bde4d3ead96f117c3a9f3fd83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195875, "uuid": "30228507-eb31-4f4e-9161-ce3a662982df", "comment": "Malware payload (AgentTesla)", "value": "0a6908312d4e1bf4be1c4f02767294c47d4a65a7936c2778560a7c9bdacfac3bc82ac256d547ba7e74e0d637f140e9f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195875, "uuid": "17e28f21-9fda-489e-b9f0-bfc9a3086bc6", "value": "T196F46A112254C3EBF6D1B0AE3438491752F5784E8A7CDAF2CA727DD37A867CB61C2906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195875, "uuid": "59558cbc-8c5c-4bd2-b7ad-f7287e9ea09d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195875, "uuid": "a19d692e-1e7f-45d7-8bb3-27dcb6ae3020", "value": "12288:S5NIXLCQAi9ChDuQFSAuUoeWBDbfo++eUYFUuKCr:GbQl8pJYNUUv/5KCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195875, "uuid": "913bbcc7-b7ba-41c1-8964-7ac8630aa814", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195875, "uuid": "2fe60dc8-11af-417f-ad7b-1df485488f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195875, "uuid": "aefb5afa-2b63-4aa4-9938-8ce2e4de987d", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65820083-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681203667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203667, "uuid": "8a5e0228-ffb7-4e7b-929c-2ce8416c139a", "comment": "Malware payload (SnakeKeylogger)", "value": "b77972e43d7da503afc524aa2ff7d831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203667, "uuid": "c5548a54-8e18-44d4-a809-172c083389f3", "comment": "Malware payload (SnakeKeylogger)", "value": "a0facc9a3b42d4bb953fa64010dceb92d9f422c550935e725166056c9754bee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203667, "uuid": "5ba7b270-1b31-416e-8544-745b0f7188df", "comment": "Malware payload (SnakeKeylogger)", "value": "ea2958acef14bcca5249c309e4da51c3eb81f8fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203667, "uuid": "f50543ed-c97b-4284-8f38-b63eb27d1e99", "comment": "Malware payload (SnakeKeylogger)", "value": "8f736fc7786ccb3aefd4f61d0469e3238452eb5a6ad4ccafd7886d2285ccff3bfe2dd7ac90be2a764ef5695182224926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203667, "uuid": "e65a767c-7390-464e-a223-13bdc88a0541", "value": "T1E1056B4F65B09437F89E50EE4A3463CF2F327262712CF2561E7AA9499D06FFA72C8141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203667, "uuid": "d33bc210-eab4-4811-be54-0b803f1e906d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203667, "uuid": "016515f9-ab77-4a2c-908c-4203cfabb7ff", "value": "12288:F4JprVmilR3PcReiNysD1s+rUSjxqOS0cuIGDnUVAsKSyy3myhk:IprL/cRRVwn0cuIu5lC3myh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203667, "uuid": "95f2af6f-43a2-4c09-aea0-2ac0e4d62517", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203667, "uuid": "5d2fb513-1d82-4f38-b912-5e0947a6e66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203667, "uuid": "261bf03a-5fd1-4d7f-9f0f-d9d628e1a9ab", "value": "b77972e43d7da503afc524aa2ff7d831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109bbc5f-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681195794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195794, "uuid": "eb9f8ebd-15e2-49c2-911c-af2e110dcea6", "comment": "Malware payload (GuLoader)", "value": "36f06f28ee24038b2b6cca35e6fe3764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195794, "uuid": "e742c990-84e9-4453-83ef-c4db1452050e", "comment": "Malware payload (GuLoader)", "value": "a10c47f496d40583af7bfb8b2fd41014e9f37a527ed72df784a874fceaf558a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195794, "uuid": "1c5845f0-42b3-4fca-bcc2-988a187eebd6", "comment": "Malware payload (GuLoader)", "value": "de62445452766a1f2f568a09ff5e7bc50ce33e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195794, "uuid": "8668d7a9-9488-4267-8562-61bb6ce457c7", "comment": "Malware payload (GuLoader)", "value": "a22abed0e99bcf44ebb1f4c2a0a7dec50738bf849a0bc8023a4d994f60ec5d5eef6c776106226f0dde646a29bdadb1e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195794, "uuid": "bb2140ac-df98-469b-9d2d-9615f9d68ee2", "value": "T127641228AA50C83BE4E30D32403B5129DFF7D9239F7017079B541E9B7516B61E62EB8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195794, "uuid": "2a723126-2f6f-4bb2-8473-3795f0fd3667", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195794, "uuid": "1686bd9c-6a37-42ce-82cd-bcd656e79c87", "value": "6144:1htyHU2eHjiuGCk1arvlbKRizoC8xjkIHeMK70o5VjGXPbx:1h493IDQyoZZHex5Vijx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195794, "uuid": "8810d58c-e4dd-456a-aa9d-b04834092b80", "value": 307296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195794, "uuid": "75c3a97f-6563-474b-8db7-93b8cb0ec178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195794, "uuid": "078e4823-385e-4d9b-abe8-5d01577fffd8", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffebe94-d87c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681226421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226421, "uuid": "7de6010d-77f9-4f8a-a9cb-5473572facc9", "comment": "Malware payload (RedLineStealer)", "value": "302c1e06d3f8a6deeebc205e8a71cb5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226421, "uuid": "73e79f63-3316-47d2-a3fd-f39b8b7dd6cb", "comment": "Malware payload (RedLineStealer)", "value": "a141a6c6622894c66517a96b4c46bdd8e60365ff27b88f3197c3dbea0c21e509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226421, "uuid": "3a16cd90-c944-40f7-9fbd-f7a036351bf9", "comment": "Malware payload (RedLineStealer)", "value": "3669fba111f9d685437e824926c03f210740e39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226421, "uuid": "408c50a5-db69-4166-8335-9d9fae413d88", "comment": "Malware payload (RedLineStealer)", "value": "b253fbf568857c5548986f459b4a25652ece5970b34cdc61572e9fb2948d583f7117a37c76fe86427bea31dcff027cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226421, "uuid": "9a276c66-cba4-41bf-a19f-bd689c3a6a42", "value": "T129352306BBCA4922E47097701CFA43171A357CA19EB4936B671A785F0DB3AD4AD3132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226421, "uuid": "bf44426c-2b22-47bb-b054-c1d644b68857", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226421, "uuid": "6f26c20b-ed5f-4a4d-8547-129c3656f840", "value": "24576:dyQQxdj8gBG/nqujB03k3/0pFQRruO2bjLsmBUBvVdgZ1+aH5:4N9enqqCkvEF02bj5BUB2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681226421, "uuid": "18a62e60-9b2f-4616-b4c6-9f24b7d08b90", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681226421, "uuid": "83e3c41b-589b-4f7f-8d5f-f5566b7e2cc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226421, "uuid": "0a498c48-578f-4013-85bf-4ba238e7fba5", "value": "302c1e06d3f8a6deeebc205e8a71cb5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ad2f3-d802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681174089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174089, "uuid": "10486dd4-3f75-45f9-bec1-7b947ed016bd", "comment": "Malware payload (Vidar)", "value": "af7c985afb2c66bdb2f4f64d60d061c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174089, "uuid": "63cfe55e-ee7d-4323-ad8e-dc583dbd989b", "comment": "Malware payload (Vidar)", "value": "a19c5d432f8a0d62e0e2a4d87521b9665d8963102b17384286acaba2356643e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174089, "uuid": "cee7fc8b-b2a7-4c1d-aa2c-e232eda250de", "comment": "Malware payload (Vidar)", "value": "11e2ca71d01047da019e98eedfb8e65a28bcdd8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174089, "uuid": "b16b378c-60d8-48c5-8ecb-85813fa9aba0", "comment": "Malware payload (Vidar)", "value": "d5ad5e2f658491ae635ccd210702894d2902121a38c2cccd9b266620de87c64e7034a14184c3bee55119a8649adee4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174089, "uuid": "f257f7d6-076b-4696-b535-ef9ce6a857cf", "value": "T14164012179B1D0B2D39F41784810DDA16EBEBC72962581BB336407AE1D70FF09B2BB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174089, "uuid": "38ff09ef-d217-475b-96da-b8ab5a68d0f7", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174089, "uuid": "3b5e1ac5-fc63-46ea-b6c7-9c1dc941d1e1", "value": "6144:+28F5KF47RIg7qVBv8Kin+0kRhUa0XOPRvLA:c2a15+zija0XOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174089, "uuid": "4928d38b-b62c-4bb4-85a0-fb32a616afe1", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174089, "uuid": "ec287cf4-c4c4-4162-98a6-58077f04e07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174089, "uuid": "1b69b9d6-835a-494a-b9cc-58635211a7a7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bcc47a-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681194915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194915, "uuid": "e94b1316-7324-4a5b-91db-66e32c74fa64", "comment": "Malware payload (AveMariaRAT)", "value": "24b58901a371adc86a36b7cc1189f2f6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194915, "uuid": "56e0a690-94e9-48a4-8cf1-64430c25a9d9", "comment": "Malware payload (AveMariaRAT)", "value": "a2231cdfce2e5ec3adcdb8535b1663da96d390e65c0f0c83c385a96d97790f0e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194915, "uuid": "21c8e3a6-0824-4598-8ce5-eac93af8fe38", "comment": "Malware payload (AveMariaRAT)", "value": "4421669b2b505db421e5ecb36119aee48ade108f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194915, "uuid": "f7b3aaf5-c356-437e-9e88-d7ee53c70cc3", "comment": "Malware payload (AveMariaRAT)", "value": "b084418e2dc84517c89260c12c9f8f02ba79e72493d4b2431fb18a1902843b02871a8a24f3ab4a58ecd461809ee92204", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194915, "uuid": "7616a32a-5d53-4f28-94ec-8569aa83060f", "value": "T177057C11E5918477E5A2163C9C0BC2B9A82C3E516A39F84B37E56F4F3EF4290282D7D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194915, "uuid": "d87c47d7-f135-4631-8d01-b4079c0ae3aa", "value": "3d3dfee0b73b800a9bca6b50b5fb8258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194915, "uuid": "172fbe0d-b63b-4222-8ae7-c1990340198e", "value": "12288:m8rLgxLKQfJJuXFI3MU+oVv6G57D1l0JttQCMO+U1xldIuau/T2SAzCk13h:RrLgO0023ZQK9qEO+U1xldqu/T2SADh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681194915, "uuid": "cf9d272c-f93d-4522-9c3e-0a32e32b1176", "value": 867552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681194915, "uuid": "d4858e04-7169-476b-a828-5705ab8e0d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194915, "uuid": "bdaf88dc-d1b7-41a7-aa8a-8a5760ef0943", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981b78b8-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1681204181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204181, "uuid": "ad470685-9e4c-4b24-a4fb-4b29e4d49aa2", "comment": "Malware payload (SystemBC)", "value": "b1d156c496219977a9cd4355094613f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204181, "uuid": "492847d2-638c-4b19-9905-c7e9f7d0ef51", "comment": "Malware payload (SystemBC)", "value": "a2bf4098b65e0efb8bc9cba70cfb5e36d01de5f591d100bb429a5dc3ef6c3bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204181, "uuid": "85afe0d1-0ebf-4274-a9e4-dfa7e858c9e5", "comment": "Malware payload (SystemBC)", "value": "2f0476f22e05455ff4e56171438d16ff87291ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204181, "uuid": "0d2f0f5c-82fe-40e6-aca8-4c5678cece4f", "comment": "Malware payload (SystemBC)", "value": "ae7570d1ef424500e50121ac85f125d7f8e1372ed2b46a838cc900987e43a64b6164e2e6053dfadcea715e4e13279e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204181, "uuid": "2d68dc26-48ac-4d04-979f-a4894f153344", "value": "T10D35CFBE32BF8F52F2622B746607C7A9603387522215F0D2913E19D374CE1AF56CB685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204181, "uuid": "e283c7cb-aa37-474d-b663-bb6dcdcd459f", "value": "6b08e8c3977bf4e3460f254a90ce4250", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204181, "uuid": "750a7e68-7223-414f-83b9-bca500a1a05f", "value": "24576:kob9rHzThqel1mK5XJent7IL+PYL65XPr5JfQZZ0WgisS:kE9TTRlvS5YL6ptJfQZiWg3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204181, "uuid": "e5dc2847-d49a-494f-9673-adb154cd8b59", "value": 1141848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204181, "uuid": "cbea2654-3a03-4ff4-a6db-5779edf9bd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204181, "uuid": "093e5d44-de68-42d1-ad2c-516bebc8516c", "value": "b1d156c496219977a9cd4355094613f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f92bcf-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681195558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195558, "uuid": "c3588493-8127-44ea-ac51-a40abb37a34e", "comment": "Malware payload (Formbook)", "value": "f74a3d805ebc8b4338d78c67a727c746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195558, "uuid": "6dbcc0bb-2674-44f8-91ad-1c1d8c6107c4", "comment": "Malware payload (Formbook)", "value": "a4b88076b93151b45a51e3d53b71a107b64470b2276f65ebbb9297380d37f3c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195558, "uuid": "c88a89da-78b9-4ea8-bb7a-b05e8c9fbf7e", "comment": "Malware payload (Formbook)", "value": "e7ff4793dbbf1ecbaee4bb03c0057a696489cc0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195558, "uuid": "66a50499-63ee-427d-84a8-b8c17c507304", "comment": "Malware payload (Formbook)", "value": "0c847498bdbfad3691cac49eb122052222ba7c6d4478fa32f83d7a69de71fbf9bf16167e6571edd72c5a377e40f6db4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195558, "uuid": "616d2cd1-e4ca-4ba9-acf1-170c6118f5f2", "value": "T1AEB401CC62DE4711D1BC73B453B37548037393A98A82CF085E45A6FC2AABB9153A7793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195558, "uuid": "b2ada32e-84a8-439b-b0a0-104e53afff6d", "value": "12288:DM3dEESbTL4G3Wh8HOgMw3uyh59jA/HM3P9:DM3CEQr31JnuW9kP29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195558, "uuid": "32f6fb11-db3a-4e28-91af-e3d0d647ab93", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195558, "uuid": "d9fbe51c-d41a-4e1a-a714-c4b0325aa04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195558, "uuid": "43fa57f7-6d62-4c6b-ba54-4ca36b8c085e", "value": "CCBANK00000002424T246345235235353523623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9faa842-d85e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681213795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213795, "uuid": "c6b73c8c-3db2-404f-b1b2-6dbb669cde62", "comment": "Malware payload (Rhadamanthys)", "value": "ca3df403430c5375f6308d8daf3f4652", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213795, "uuid": "b4f073e7-ea71-4828-ab75-18ef159a9e5f", "comment": "Malware payload (Rhadamanthys)", "value": "a543adcbb3b3edc471dc15e77c1b568410026e077ea53145adaf98bdaea411f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213795, "uuid": "4a05d648-87fd-4498-85c1-6449d8048663", "comment": "Malware payload (Rhadamanthys)", "value": "1f7bcb6bccd85f95f51ebfc9091dc47b35f6440c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681213795, "uuid": "aa162d29-2072-4edc-b25b-23d92935bf1d", "comment": "Malware payload (Rhadamanthys)", "value": "2c3641edd2d2ee615e2a79797d6d82207ac22b51ab13279772b20e8c6e4536b113916e8a8de66f2c77e755d0891437d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213795, "uuid": "c20dba10-188a-488f-9457-735fede044b2", "value": "T12736BFF23A17E1EFC2528474AC16DE0795A813E3CA50AB16FD563C7C8A53D0937CA768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213795, "uuid": "93b1e410-5d5d-49ee-b6c8-dba5f40f2594", "value": "5502dbdd579c1fb27fd18a21a20af6e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213795, "uuid": "5b33ee61-ee14-4667-878a-2bdfe24b77df", "value": "98304:PeeDTN7a2FS6xqUZnD6OANtQcO5ITzV8EO3msoYG4:bvN7a/sqUJDHAnR5J8EO3ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681213795, "uuid": "5364a13d-04ff-4426-be61-e573e6b927fa", "value": 5263832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681213795, "uuid": "e5e7db1e-56c9-446b-887b-443f8e26ff6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681213795, "uuid": "b7c790e9-6861-426d-a8a8-60308165f0a3", "value": "ca3df403430c5375f6308d8daf3f4652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99280af-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681214170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214170, "uuid": "4f07ebe9-0f9a-4934-93e6-a05b27b21f52", "comment": "Malware payload (AgentTesla)", "value": "44de8797068dfd10c64255cfa8689677", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214170, "uuid": "ab872212-0cfb-4f0e-b3c7-50fe1795cf5b", "comment": "Malware payload (AgentTesla)", "value": "a59cf85abd5156d8de00b535148bc19e9def8503ed7a6058379bcecf6f688647", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214170, "uuid": "de52518b-b3f7-489e-8ef9-53f24e0e5304", "comment": "Malware payload (AgentTesla)", "value": "53dd1f49f70aa900da90f6df0aea83b78d35185b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214170, "uuid": "504d46ae-8795-497f-b2ae-6de9a1d4686d", "comment": "Malware payload (AgentTesla)", "value": "32948fad95d672dabde095a8caed56f38215de7ed9a33e000a26a5d105594a75ebe5f246f0e5dc0ff29fead724eee1f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214170, "uuid": "3340a3d3-832c-45d1-9c3e-b4edb12588f9", "value": "T11CC4015D13B2EBA1E49D0FF858801445177CB289A1B4EAA98CD713F787B2FA250487F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214170, "uuid": "2c529cf0-b819-4653-971d-b2da2efb6088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214170, "uuid": "e8f0c33e-de45-409f-a467-5d4d3f62ccfe", "value": "12288:JZv0T2CgBgDRCpiw2ObXjh/f2NyASQYE10SQrGabpvhGZgWbkw:JM34JPp2NTSQ/fu+CW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214170, "uuid": "c87c5b5d-4e92-4430-9754-bc062cd15b50", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214170, "uuid": "610798a4-e21a-4e0b-a41f-4678944b9a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214170, "uuid": "975b577a-3f8a-4057-b731-66d68bf7cb9e", "value": "44de8797068dfd10c64255cfa8689677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94650aa9-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681195156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195156, "uuid": "1a254ef6-0a59-49f5-b90d-921b8a61d3bb", "comment": "Malware payload", "value": "a1b491e532e81e45cab35fd769d43ab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195156, "uuid": "bc0edaf1-8a1f-4e9f-91d0-9225e3a5777d", "comment": "Malware payload", "value": "a691e279bbc3870663eee9bce090e96f5359f01103489b3b3ccf2b4afc523e33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195156, "uuid": "f4f615c7-1bba-4f3f-872b-82182eb8f8de", "comment": "Malware payload", "value": "4f172fe6ec1a6393c6b21b00b32fcee1525daaa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195156, "uuid": "fc87c967-19d1-49e4-a86a-fc9e20704a3d", "comment": "Malware payload", "value": "4e32ea1fdaffc725e3cd947d843a283035317e5b128efcba7e5cec5089de36d0d5ee71fc301dedd7d580b14724a60630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195156, "uuid": "9094dc27-a35c-4023-8d93-38bc0048fa7e", "value": "T145049D133080C432E967C1F464E8C6755A7CB4752BE4A0C777CC4B6E9F669F1E7A822A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195156, "uuid": "54928602-0be1-4a89-8572-033d3d682809", "value": "c5cafc3cd56661be310b19febc40278e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195156, "uuid": "f8505393-4e25-487d-bd16-742ce5f79c73", "value": "3072:Q+ibgzRd4jJTM2+3vPQ/AySbLgeY6K1edo89fxV:Q+ibqRb2Qrgec1Soq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195156, "uuid": "a54d8415-4422-4f2d-8489-4d1eff52aaab", "value": 183048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195156, "uuid": "4df4cfd5-441b-44fa-8279-b206e555ae06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195156, "uuid": "e6f0d472-7143-4586-9ae7-91227c0fd961", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56913ec-d884-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681230027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230027, "uuid": "710fff23-4cb4-4086-b3b2-829407bc6794", "comment": "Malware payload (DCRat)", "value": "0099aaa30ee45e4ca8122824ce23f2e2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230027, "uuid": "5653fcc0-a16e-4961-ab6b-9450e8546341", "comment": "Malware payload (DCRat)", "value": "a6aa3ccc30b95de5481523038e8d520a72f55a75e2d77c4767e1302ad623039f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230027, "uuid": "5783efc1-f0fb-42f4-bdf6-787d557cf234", "comment": "Malware payload (DCRat)", "value": "4aa13abdbf8443fff921c4997b813a610944ebaa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230027, "uuid": "47beeb5c-5d33-4638-a522-ed7ec573eac7", "comment": "Malware payload (DCRat)", "value": "63671ff0dcaec4004830b55dae079c2752c3fad4bb823976260e96c71f887bcf13bbb8aed2aa5528f91d566df534e730", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230027, "uuid": "b0821065-9a00-4a20-91d8-31f14e30f8ce", "value": "T15B455A027F44DA11F0091633C2FF450847B4AD50AAA6E72B7EBA376D55223A77C4DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230027, "uuid": "634a5b88-c570-4f32-a7e3-a99c16b46034", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230027, "uuid": "ae431716-fa3e-431f-9ee3-9acbd2a1dce6", "value": "24576:u2G/nvxW3WieC49TPmRmPJSoRQnI5aNJNuHnG:ubA3jCP/JmrNQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681230027, "uuid": "092fa73f-aff0-48e2-a89a-f5c439822875", "value": 1165985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681230027, "uuid": "ab3a0dc2-f945-48ae-976c-91e76643677a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230027, "uuid": "53a85503-3b28-4da2-adfb-bb4083f04496", "value": "A6AA3CCC30B95DE5481523038E8D520A72F55A75E2D77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a8ee5b-d8b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681251897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251897, "uuid": "82d311de-42af-4e4f-aae8-10412a1c1701", "comment": "Malware payload", "value": "e061551400bada201f08367cb36a506c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251897, "uuid": "09774845-184c-43cd-aef2-5c37dbe60030", "comment": "Malware payload", "value": "a6fc53214af7578efb636eb5d5f67a21807c92d0784f9310cab97879bccda850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251897, "uuid": "eb75f948-92bd-460c-afb2-6cc497f6579f", "comment": "Malware payload", "value": "8f878df58ccee01f122663a61da293a1fabe3ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681251897, "uuid": "8a084e7c-eef9-4494-8c52-7409d8db44eb", "comment": "Malware payload", "value": "14274bef57d6cc8f4ea12d1b19e84f7bd6d40f94370f9f50998d5b4ae17cb0005c9e6ce08fc5c0da9e24a0d978010273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251897, "uuid": "a3a17338-0bd4-4d6f-9ffd-a5d9e79daaa0", "value": "T1B06523457EF84072E9B1BBB06DF602830E36BCD19CF483571706AE4A5EB2395A635336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251897, "uuid": "c8836495-eae3-4126-8e3c-a928ba5e6ba0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251897, "uuid": "41ae94cb-79f0-40a2-9233-0e11862ba53f", "value": "24576:cyYB3sAEr4EgiMiAFX5+F9VCP6yQtlhm+G/molRL8kXZSpXG8Gxigm+uXsuQxkXo:LYBcAEBgiMi6X2YP6XnhU/mmRo6QpG8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681251897, "uuid": "fff911f8-b78d-471b-bd2c-a701fb00249f", "value": 1445888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681251897, "uuid": "ac603815-81a7-41b3-a6a7-c60600681237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681251897, "uuid": "2ce67b7f-077a-4382-b7b9-ec82c6e2167e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167365eb-d855-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681209547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209547, "uuid": "437ff551-c664-4a41-89c6-29b46b2fd7c2", "comment": "Malware payload (AgentTesla)", "value": "eb1afb13243e1adac9f104edb9931318", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209547, "uuid": "a2490ed7-9402-46e3-9f26-802433af53e6", "comment": "Malware payload (AgentTesla)", "value": "a79309e3fc6b424c924650cbd0dbb62081a5dd7514284304498ca77fcdaa1865", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209547, "uuid": "ee5bbc45-2ad5-4fc7-aa23-b47791dd9a4d", "comment": "Malware payload (AgentTesla)", "value": "53f27e6aec5614478d9571b1daa4ed862683e143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209547, "uuid": "7f4a7b8e-d008-4e90-ae76-cf1b9f0bfdc5", "comment": "Malware payload (AgentTesla)", "value": "cb906d9691c5b1f68d3dcc78c97116eb3224a9c3b64952b8d899d75f204127080ac9eb8e80818eb4122c496500f5a2ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209547, "uuid": "03179831-310f-47c4-b8dc-bf10232267b0", "value": "T1605423CB6F24866ACE39A42CD5338843F27DE19CD8C04B4F7679A54362A4FB35DB9406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209547, "uuid": "20dcdf84-442f-4e2c-a3d0-5de73bd00cb4", "value": "6144:xR9haNKSeNI0aD5rBVtvVkDUgwtHP8YKJnrDg/FDBt:L94wIdDLvV6Ug0HPDcDg/5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209547, "uuid": "45261dd6-44d5-4f11-a043-01b6b7a874dc", "value": 298770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209547, "uuid": "2280ffbd-587e-457e-ab64-e4ee790f291a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209547, "uuid": "d499da3e-ca8a-4c0c-8f89-caffd1aae154", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6ed628-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1681204507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204507, "uuid": "58304c56-83e8-40e5-88d2-7351263eadbe", "comment": "Malware payload (CoinMiner)", "value": "eaaa300d023597a9aca59225b4270c99", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204507, "uuid": "c3622c7b-e3b8-4ab7-ad34-5b931bfcf780", "comment": "Malware payload (CoinMiner)", "value": "a8e604652a602e200a53836f87cdf53648d18f1f853cf0852f33a74992b7fc82", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204507, "uuid": "66de9f7d-c23b-4c2c-9028-58978d614fa1", "comment": "Malware payload (CoinMiner)", "value": "2eec52537b4c5e32f565e19df223cd8a52fea554", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204507, "uuid": "a5491b50-ff62-49a9-af5e-931bfcc8346d", "comment": "Malware payload (CoinMiner)", "value": "f2870047956eb6a8eabca1799d1df8a34e094767e6ae62d7400ff28d4a738d46fd3c302d5d48f48e77b4f727782e2658", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204507, "uuid": "ae247d5f-b7a6-45ea-befa-4b09b5d688c4", "value": "T1EAB6F1DD77066E6CF2B86938B2C2D3311489FF311E138958EA8695E3D574C9B9F09A0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204507, "uuid": "1b0abe91-8dde-40fb-b0ba-2e87da44f6f9", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204507, "uuid": "40c69045-7932-4731-b43b-43e4f1122f6d", "value": "196608:if2nVA2e10n9TAhrJVywK/89KwGxvhob93pRLoyvZQPqMk1qrxI:+WJe1QTAhroUApoZLHQCMkOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204507, "uuid": "f6beff0c-5983-49f9-8926-a8878581d20f", "value": 10465696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204507, "uuid": "d524c9ec-c910-4fa8-9eba-767ec1669484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204507, "uuid": "1210a602-d134-4aaa-bc33-f69082bcaaff", "value": "eaaa300d023597a9aca59225b4270c99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36402c7c-d889-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681231935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231935, "uuid": "0e61e588-fdba-473b-b4e9-a8b81f48b297", "comment": "Malware payload (Quakbot)", "value": "88a20c66c2868a86b86aa284d399921c", "object_relation": "md5", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231935, "uuid": "9933c022-5ea9-4fee-ad5f-7e67e1128835", "comment": "Malware payload (Quakbot)", "value": "a9342dd549b5e8ce479724249fe4f2a38eecb548f54b3a65c2360b6eb41a5ba2", "object_relation": "sha256", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231935, "uuid": "6282af30-6c17-4fd9-9758-116a5b6a6bbd", "comment": "Malware payload (Quakbot)", "value": "c33dca6accd4973c8c9f6fc19e688218015ab464", "object_relation": "sha1", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231935, "uuid": "7a3b9e4e-dc63-4cfb-a370-6eacef67ed9a", "comment": "Malware payload (Quakbot)", "value": "a45405716991db5b854b52147f3b714241e753ae2be8864613f6287c678696d720dd788e7d83b2e2f6fa7b4eb67f4866", "object_relation": "sha3-384", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231935, "uuid": "0245658e-782a-458d-9d21-6bd65c4fc05b", "value": "T169831254582B163EF2FCE87AFC105D9CB35DEDC0E1B0B5A93BEB81609D48C8519F2560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231935, "uuid": "5f743885-a09f-41ad-9824-461c06935bae", "value": "1536:c6StxUwkeFZhjWDDp/SolvaAbFBC7qOhfUjQ0FWJfvOMhR:cP3GSZGp/SwyNPUjpgJfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231935, "uuid": "a8ac5c35-0dd2-4d8e-b98a-64eff02bdc02", "value": 82603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231935, "uuid": "7ca24e36-80aa-4629-a56d-59cc3b71f18c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231935, "uuid": "6dd908f3-51fb-43c0-a67f-3230de999da2", "value": "6433a06b72f65.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c9bda1-d88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681234539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234539, "uuid": "8a787695-2fbc-4a48-8959-e6910dbb643d", "comment": "Malware payload (Quakbot)", "value": "7a070fee5ae3ce9436f413a9d5aaa799", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234539, "uuid": "9b74f745-e4c3-484c-b555-7cd43bb55e07", "comment": "Malware payload (Quakbot)", "value": "a94601a0a623c21b673fa0e1fb78d0a9c0ab17d7f724977a232ca41d757c602a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234539, "uuid": "7dc76d68-9f64-4309-b646-4118a7f7cdce", "comment": "Malware payload (Quakbot)", "value": "8f534ce0f78fcb75b032086b272dbbf8620fe037", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234539, "uuid": "6d345103-1211-4fd7-b1d3-1d28bebcf5c5", "comment": "Malware payload (Quakbot)", "value": "aa083527797c166a449fc3df15e731afb37a8f21918a708ef66f0b9a9f8ad1da0d98dc0722c3265a8d4646465eeff8b4", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234539, "uuid": "e8a31086-3b84-439f-ad6e-b814dc6cad04", "value": "T152140A708E2FD11D1E73A61B752E4880E52406934208BD47F67E6185BFEE4CCD2B9EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234539, "uuid": "da233401-f907-4816-bb4c-836c6de5f262", "value": "3072:lA4M+lX22tDaDxUrF4xGqEFle80IjI5wTjl3xNE67LCFzQD8Qe:Sd2ZoOF4pEF2IM5a3x+67LCGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681234539, "uuid": "572c6976-bbe1-4400-8eb7-2d6ef8c8d25c", "value": 209224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681234539, "uuid": "ddd8b3b7-6e78-4fb4-bcd8-0d3598867ed4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234539, "uuid": "fbaadc88-6461-4725-a13a-085e46fa3c60", "value": "RP-April-dCCs(02).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aa8518-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1681215267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215267, "uuid": "b4fee84d-3a87-4161-9f87-c3691ce17ef4", "comment": "Malware payload (AuroraStealer)", "value": "d00a4e573c049d1736de039cc21be082", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215267, "uuid": "b8ae0644-b4b9-46bc-a4cd-f8d2ba977733", "comment": "Malware payload (AuroraStealer)", "value": "aa068d4750721142c0ccce9d2cc3630c596511fba65c3fe481b2887b7138e579", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215267, "uuid": "e32bad16-d5ca-4dcf-9f5e-72b62db608c0", "comment": "Malware payload (AuroraStealer)", "value": "f1664ca5a11e036477f5c17850746859a8305ce2", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215267, "uuid": "356f2c8e-8920-433a-84ff-111790b5eb0c", "comment": "Malware payload (AuroraStealer)", "value": "db73808bdeeb5954bb9ceae8bd1c345919ccfdc9408c2ca276c8a188e79db33b02a5bddd19d7f4eb8323a0669a34a042", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215267, "uuid": "61f69950-5f42-4dc8-953c-f16d3ce975af", "value": "T139A50843BC9581F4C0AEE234CA659213BAA13C99073463D33F61A7F51B76BE86A7C354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215267, "uuid": "f870f6b2-e710-4c5c-b93f-dd2a0957c692", "value": "24576:WW3Xm/58TiluXH/OGLOhEdwXwCXO9ehI5qyKB8JBaUMjOzH:WW32/5/uXfOGcCwXwJeAqyKWJBa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215267, "uuid": "baedd340-1752-40c9-823a-de52cf74ea03", "value": 2115261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215267, "uuid": "9af85f5f-5370-48af-bdac-dc6af8ff9d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215267, "uuid": "54c0f6af-d005-473f-827e-9fe5fab776db", "value": "d00a4e573c049d1736de039cc21be082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d620201-d863-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681215706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215706, "uuid": "2173fb0a-5c6d-4ae9-8cc4-8648905bd2a8", "comment": "Malware payload (SnakeKeylogger)", "value": "03087cb5faae80d2ac03f7f3ed2ab410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215706, "uuid": "965fcf30-5872-4dac-ac20-469ba73d30e4", "comment": "Malware payload (SnakeKeylogger)", "value": "aa84eafd007d8026cb24762b1bf53e0acb0899257379153c6a31acb75d5e0c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215706, "uuid": "4033eb4c-9b16-4807-aac9-5855c2b5b270", "comment": "Malware payload (SnakeKeylogger)", "value": "9b6c94dd4f52964c6772e941b1ce3fc715dfb486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215706, "uuid": "e018eae7-6c11-4230-b825-13a5213ca91c", "comment": "Malware payload (SnakeKeylogger)", "value": "2656e987afec1efa79f2cc991dd43f5297c08f68b0ab1094d802fb5ca385aa88de8e5ddea6a57bb6409a0d5d29ce1c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215706, "uuid": "271c1a50-0ecb-4982-ae9b-3b7f96c67ce9", "value": "T115E4F19D766CEE22D66C0274C0C7441813F259935373E65A7ECD6AC92E073EACC8A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215706, "uuid": "6281bdc3-d663-4923-9630-5908c89cd20b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215706, "uuid": "9b3ba9a0-c496-42d5-ba9b-17efd1de8c53", "value": "12288:LnxKyfleIJZDcstWBSs6+vhaOUYj3CbBzP5rzrOIyB:TxKyte4DcsUSsvhaOUYj3CBrt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215706, "uuid": "c8796e1b-1349-4d69-8352-257cabdb60da", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215706, "uuid": "d698ad87-3629-40f1-9161-129f7ef30f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215706, "uuid": "975495ce-d53b-4d61-be2e-d2d10a1030a8", "value": "CJEU Order Anex09756780097876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a22210e-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1681203621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203621, "uuid": "f869e3e7-fc4d-4970-99f5-b26ed39e01e0", "comment": "Malware payload (STRRAT)", "value": "ad709327c57f43d9e3923e1178feda4f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203621, "uuid": "e50e3dbb-c2ba-40fd-b7f0-1f9a42c61483", "comment": "Malware payload (STRRAT)", "value": "aae8fe497becc1d8bc355e12f207e2e65692cf34dd8df79e28be8550f5010874", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203621, "uuid": "63a4bfe0-7c6b-4730-b2ce-81a80d5c2b35", "comment": "Malware payload (STRRAT)", "value": "db9bf57b02888833de37165a36fa6127f27c74d3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203621, "uuid": "d584d513-c147-47b1-95f1-e986eef895ab", "comment": "Malware payload (STRRAT)", "value": "c6e4b5c92951cab618fd7de625d1bca180e828810b0547663c050d453e4597c10ef5a5cea61f787e09807bcf20625756", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203621, "uuid": "f8e79ed9-23a5-44b4-a8b9-8b784168721e", "value": "T11C0413CF4FC040CA98B79D1D2639DB15EA3C82B112B4AC5AE7E3991D904EAB9450FF91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203621, "uuid": "696e2d8a-f585-40ca-8adb-98920e8e0ad3", "value": "3072:nTf9sTFSNf3K9li1FWkhSbs6kCSnNvRQ+cjl/e8VB27AlpNCSn2hVjuY:nTf9spSdS8Wk+s6khNv3O1b27uEAQjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203621, "uuid": "acf497e2-4831-42b4-a736-a90c28e04ad6", "value": 188918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203621, "uuid": "3f521203-4568-4ea1-9d6a-2f1159cafcf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203621, "uuid": "d3fa94ac-24da-4f8b-98a2-ed332a7f2acf", "value": "PurchaseOrder.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6768f1f7-d8a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681245761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245761, "uuid": "6615b2b5-f1ee-4da6-b0b2-d5f0c7b2e5c4", "comment": "Malware payload", "value": "88a1da9940b1f507533caa48b00e3678", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245761, "uuid": "acf32ae2-f6a6-4306-b8ec-4066d5e98568", "comment": "Malware payload", "value": "ab5181bca52e92eb02d2d231731bd3cfa5f4c51ef303896bddad657044af1efd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245761, "uuid": "1ee82542-531c-4e9c-8c8c-c585c480d744", "comment": "Malware payload", "value": "2c91cc7d1f8e6d6f5df3528bcc0ccc763a622745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245761, "uuid": "d5cb450f-76af-4feb-9147-fcf2a2e8131d", "comment": "Malware payload", "value": "a7f53cca9cf8dd8f231c4cc428e991b7f403f75185c7b37189de7e7294c762f1664f45f2aab04d2244e1083337abea49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245761, "uuid": "f43ca6cc-c4d7-4d1c-972e-686683b970f3", "value": "T10C452321E3D84172D4BA27746DF701D71E367C618D38032B5358AD1E2CB3AA19A7A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245761, "uuid": "1f036963-30ed-4aa4-ab37-f933057f3d27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245761, "uuid": "d1bd35c6-62e2-476f-8500-21fab18d009e", "value": "24576:QyE0zEO/md0Q1qPUoaafsTe/fPRQcK2nAZXTx0+QyFy:XEyLXPU7ap/fZQDeqXePy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681245761, "uuid": "9b4f01d7-6414-4452-a2d2-315be128fabf", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681245761, "uuid": "38ca2863-9166-4052-a105-420f57eb4913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245761, "uuid": "65f39586-6064-4af5-95e6-44cb2c3639ba", "value": "88a1da9940b1f507533caa48b00e3678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b38ac3-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681214006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214006, "uuid": "bbd701e5-ba39-4b50-b000-b3a9a79ae664", "comment": "Malware payload (RedLineStealer)", "value": "4cd30a4bdc730a118dd7dd9a84d9e872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214006, "uuid": "31499e17-80fa-45c1-b365-112efa284ef7", "comment": "Malware payload (RedLineStealer)", "value": "ae06cd0d4e8ffd5bf82f11fd12dcdb6007934515c69e456bda7529b62d593092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214006, "uuid": "ebaddb93-194b-4dc3-94eb-1b6e147cca34", "comment": "Malware payload (RedLineStealer)", "value": "a1c03f3bae130f11064f5c02e79c4945fe0c9ca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214006, "uuid": "9326e1a2-2f55-4fd2-85cf-01b48b028ca1", "comment": "Malware payload (RedLineStealer)", "value": "cd9b47333f994e5e6ec80d893da18a52a11a9538eca26e43f14069db148444de017bad2d0f63ee666b9b47118b2d795e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214006, "uuid": "a51d7ddd-aafe-4fcb-9342-8ed942bb92b7", "value": "T1D8152253ABC85862DDB24B7009F913970E31BEE29CB4876B1B56581E0CB3385E5B076F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214006, "uuid": "d46c4db7-50d4-4a9d-a60e-91f8b2abb0b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214006, "uuid": "3ab576f1-5bb6-4e15-a053-9abae96cd2a1", "value": "12288:2MrSy90jiSZkgDtw6si7/57dslD0HZ8gWGvKzPTJUQ/YIWYRXp9tzJiAq:gyFSZ1T57dADAZ7vKzPT2Q/YSL9tdnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214006, "uuid": "648ff3ec-2214-41a9-8dbe-953c97e2d520", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214006, "uuid": "cded001f-21e9-4df1-bffb-f9876736ba09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214006, "uuid": "831a2ee9-f59c-40a9-8c43-5cdee4811c94", "value": "4cd30a4bdc730a118dd7dd9a84d9e872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7815217-d84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681206784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681206784, "uuid": "d69ae3b0-d744-4778-a2e8-ceec5dc8ba32", "comment": "Malware payload (Loki)", "value": "960a17c315be4ccb8e568faab84701a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681206784, "uuid": "8b27ec4f-e69e-4e62-8447-2d71b001d998", "comment": "Malware payload (Loki)", "value": "afa62a3ded633db07eb64e61967035ac39d807e9725770b74d56a6a8aad75cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681206784, "uuid": "18befba2-972f-4f84-8a5e-759d95794f3b", "comment": "Malware payload (Loki)", "value": "814d2823126291269cf0f2bd10ae92a15442ec74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681206784, "uuid": "b86e5049-76f1-4206-911e-69e8107c388e", "comment": "Malware payload (Loki)", "value": "595321763069ac7283e0d3f9b50ad1332a10099b86dd9d32f58fdc007835132ea064955292df3a7d14c6511a550a80f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681206784, "uuid": "923a949f-0b38-4bd8-9907-8b4b67f1f8fc", "value": "T1B4C4025C3218991FCE6D47FE5462910E43B49436AB06D7FB2DC528FEA6E3B948101ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681206784, "uuid": "899ef328-e743-4d13-8918-5758029d99f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681206784, "uuid": "f2c8859a-88a6-45c6-ae72-113240e6ab4c", "value": "12288:iutzLwrVFcmIM6JQE0PVtM2mo7T47mADSv4KlLeuNINO:mhFcdM6JJi7mo7T47mADSQKdRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681206784, "uuid": "1c13728f-952b-458b-b9d0-e78ac1be9765", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681206784, "uuid": "a67cd8a9-07e0-4c4d-8c38-1b96ed35b9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681206784, "uuid": "09a5daba-171e-4940-a26c-d6c64a04aa38", "value": "PO_#40016452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f446aa-d81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Ransomware)", "timestamp": 1681184414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "f6c76922-c03e-4390-b426-87a36bd0fbfe", "comment": "Malware payload (Ransomware)", "value": "6d3d62a4cff19b4f2cc7ce9027c33be8", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "862c9b68-92b9-477d-9ee2-58df07db6c1b", "comment": "Malware payload (Ransomware)", "value": "afaba2400552c7032a5c4c6e6151df374d0e98dc67204066281e30e6699dbd18", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "84c88059-42cf-4e6a-9e1a-f32d961f8424", "comment": "Malware payload (Ransomware)", "value": "e906fa3d51e86a61741b3499145a114e9bfb7c56", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681184414, "uuid": "c63fe5a8-9a45-4b27-bb0a-3b5853433f34", "comment": "Malware payload (Ransomware)", "value": "b64e6c2fda303a5c505efbd616d8311fb6855d67f18f3a7dec203a88c30570b45103254944a9d00f57ad5188da3e0edd", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "fbbbe416-20d4-4ef8-8916-bd962e7edb84", "value": "T1AB44C01EB64394F4C2EB8B744B5FF3B91511ED9A8470E97AAEE93E577833691208C031", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "b4a62ecf-bd75-4245-a2f2-c5facd24e2f7", "value": "99bff35f43bcff8998b2001d6df68577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "7f83be6d-4910-495c-a896-95fe988a1cb1", "value": "6144:93g0BQG+aZiycigV5bbEo6dZbBODPIsjQ/UFsYWo:93g0OGjZiycigVRbObBODTMUdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681184414, "uuid": "6519991a-2b3a-4b41-9faf-43fd0a98cbde", "value": 267278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681184414, "uuid": "7e0a2ba0-4fb4-4b36-ac47-80898edb477f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681184414, "uuid": "de2117e5-83a8-4b97-bb6f-8836da9f7c3f", "value": "E906FA3D51E86A61741B3499145A114E9BFB7C56.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce020b55-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231760, "uuid": "c034347b-ee7f-4424-8168-081f4cc4a914", "comment": "Malware payload (Mirai)", "value": "2965f5473d2af8dc415b4b47aa9e75ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231760, "uuid": "16c77733-7365-4b62-abf5-f6837c60ed02", "comment": "Malware payload (Mirai)", "value": "afc4c395e5e77ffa98bcf921e8f2e43c1d5fae1982f9a3f82c45e10522f463d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231760, "uuid": "6d3e545e-a308-43c5-83bd-5993ce451bc2", "comment": "Malware payload (Mirai)", "value": "6d547f9bbe091cf1384509cc4de2bd642bdbbc73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231760, "uuid": "5eb8cd46-073d-4380-9307-8d4c84d6d1c2", "comment": "Malware payload (Mirai)", "value": "ff1f54bdd703d0b9cf05ded756ac83aa80c73ba98fdcbf8a5914fba1535d0550319e615dbd1bd00b14c0fc9b3c5b1e17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231760, "uuid": "892d2538-33a5-45a9-a3b4-afeee0faa11a", "value": "T1D7534B99B5028E3DF88FE9B984160E05B93023D112A31B276BAFFDE37D331659D06D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231760, "uuid": "48a06453-9c0f-4eec-a77a-b282b013bec6", "value": "768:GeIIVAU204iEkRH3/i/gOnrFeQFtO7gFHUx1euM8B8vJul70LlfX8KZ9o/dCy3u:GITEkRHvtOJTVFm1XM8B2K0LlfMKZQ3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231760, "uuid": "5bfeec67-ccc0-4868-bbb4-8c67ece3f0b6", "value": 65104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231760, "uuid": "8a4ecf6b-96f2-476c-b1a0-8acaf186420c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231760, "uuid": "1b510f02-f029-46f7-84f5-881b4f22e5db", "value": "2965f5473d2af8dc415b4b47aa9e75ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a85147d-d83b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681198360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198360, "uuid": "b80b2d60-7158-455e-81c6-1fc1ab63b120", "comment": "Malware payload (AgentTesla)", "value": "10b6fc66577e3c012b783e43ea5d5f2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198360, "uuid": "7e78ba7d-226c-4abd-8792-20e35ff19826", "comment": "Malware payload (AgentTesla)", "value": "aff2ddb70aad9b77ec815bf35e83c7381b164a63e2359ede681a7c09e3d545c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198360, "uuid": "fc32a1be-16ac-4bc0-98b1-a123c759273b", "comment": "Malware payload (AgentTesla)", "value": "4e7da0cbccb82858e0966838eaa4590f2dfb34df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198360, "uuid": "32fe3354-b982-402a-b64a-483599b8e70c", "comment": "Malware payload (AgentTesla)", "value": "cb4aa5b754e4a247ae07be7dd20b44464e7d3f36b441730196e8da3634d5602f95d1ec77d8a30f328fd194e2a3e40c8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198360, "uuid": "bd09e289-a464-41ee-8f82-df2818571aee", "value": "T16EC4E0F08605CABBDAF810B4E01A05A46FF2BC749150F3D77D98B4A2A7B37D78366542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198360, "uuid": "6012bb50-8545-419d-8cdc-efafcacb8a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198360, "uuid": "c1fa860e-ce8c-4751-8124-d8e51796bc23", "value": "12288:4V1cF6bk9eXD3daQwtQpgAl9zDnnFyoeRmL3e:ccSiuibA/nFpeRmL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681198360, "uuid": "ba85b468-416f-49c9-b079-23e0971e9458", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681198360, "uuid": "31deffad-78c6-43ce-a6e4-91c5c3632836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198360, "uuid": "cb09bbd0-f4ca-4c32-b988-adf03a7da685", "value": "Payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691088e0-d867-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681217417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217417, "uuid": "42daab97-868f-447e-a097-e1d9a291385c", "comment": "Malware payload (Amadey)", "value": "e0c0d352c203af52a20e0f1299e49b29", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217417, "uuid": "dfe0c76d-c3fc-4188-9b63-d7461977f1dc", "comment": "Malware payload (Amadey)", "value": "b235c89cb397cb9b7be040944d64db8980088f27c3c58c9ffdb83405cc7a8014", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217417, "uuid": "20e6560c-fe8a-4d1b-a97e-b98551f2ae84", "comment": "Malware payload (Amadey)", "value": "b4c8a26a97293f09391dc508c9479b9cbd69ea75", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681217417, "uuid": "ef4f4278-8bd1-4860-9340-9915277dec2c", "comment": "Malware payload (Amadey)", "value": "96d867fbf5345759c5565eaf2fc5bfd5dc19ab88c177d67899b3ae8feb224c9c008345f6d1ffdb4f6248e32fe0c98505", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217417, "uuid": "7c87923e-40ff-454e-a07c-45f9d3a22cc5", "value": "T122252306B3C0C572D872177088FB12930F327DA29A749A3B2745EAAA1CB35A55D77337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217417, "uuid": "2380279c-1109-4101-9fcd-98af91b6bf3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217417, "uuid": "7bd37f6c-3ae1-42aa-8fb9-5e2041de04e0", "value": "24576:kyt6qSZzqDR/zcqqmSbnLsumhae3DIE9:zd4iZg+SbnBmd37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681217417, "uuid": "7d601612-4965-4e36-b46a-4f1c7575dbaf", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681217417, "uuid": "09611d0a-5a1c-4dbe-844e-386bc0e55128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681217417, "uuid": "de09472f-8545-4405-842a-74d41ce8fba9", "value": "e0c0d352c203af52a20e0f1299e49b29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198189bb-d809-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1681176911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176911, "uuid": "0bc77acc-1a73-4527-b176-7fe9299b94b9", "comment": "Malware payload (RecordBreaker)", "value": "b48df209aa23e574d28569bbcbcc053f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176911, "uuid": "c6830a97-4630-4be6-bace-7fe62eb289e5", "comment": "Malware payload (RecordBreaker)", "value": "b277d6c1ce11450ee68f69f69c37e2b1b3768f60d738956201ceb13622c84543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176911, "uuid": "4b211db9-37b4-486a-a0b1-2b4deac2345c", "comment": "Malware payload (RecordBreaker)", "value": "d641fc0124264e3420b79477ffb091b1040cb2d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176911, "uuid": "10536bd8-d0bc-4962-a1ed-747b25fbd77b", "comment": "Malware payload (RecordBreaker)", "value": "b9016d589f5d3927a7b50eb8ff3b0a8cd47c690e120ced7e07c483315932cc95eda1c8abaf22bbec51b754bbc36cd302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176911, "uuid": "af409791-afd9-4c4f-8235-7b2ec74866a8", "value": "T1D014CF11BA92C4B3D85745778814D6B4757EBF5E8B49868B33083FEF3C322C15A6A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176911, "uuid": "d9a10d2e-47ee-403c-a6ea-8b913bcbb871", "value": "1a21bc96f45cd14b947cc79f5712c961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176911, "uuid": "6f7fa521-4751-4bd0-8889-1b19e9489512", "value": "3072:b/bA7X2whJ8JftegDZNx//srkY5As/T389RzjrwOH5jn5TL:fA6w3kFegDl/koOF780Qn5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681176911, "uuid": "1f302de1-21ba-42c3-8cdf-9a3eaf88864c", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681176911, "uuid": "13f73cf5-2378-45dd-8b17-03e6fa50d51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176911, "uuid": "f9212b8d-5437-4edd-84bb-08b7923c2c73", "value": "b48df209aa23e574d28569bbcbcc053f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f26969f-d866-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681216917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216917, "uuid": "6d73a858-80a7-41a3-bb37-cda690145237", "comment": "Malware payload", "value": "e3c442b5237771b9f79b242fff308cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216917, "uuid": "224c0943-2b07-4d83-bc7e-aa57f8edb61c", "comment": "Malware payload", "value": "b32d7e0f8a89a3b573580098d6e4391061459279f920233910a95bc7c22ddb59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216917, "uuid": "709e84e3-2859-455d-a3f0-2df548c6694d", "comment": "Malware payload", "value": "e71cc0e2ad8795e8cdc0b1929b542b5a8344ffd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216917, "uuid": "7c167fbc-fb43-45bc-ae12-aef62eab6494", "comment": "Malware payload", "value": "cec1a2525c185f29a0be0984114146b3a2d7d8a4389a7d84f43423b9c1dfabb7841983f9c2c6b08c35ad165653f1d424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216917, "uuid": "958e37e2-98aa-41f1-980c-29fb3fa4a4c7", "value": "T1ECE2E1CCB984E00DE3200BF10EB79F71BA9DAC341B95D69BFA5C261A2F31615DD13551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216917, "uuid": "67d85841-2ba3-4690-a6d7-1ee6ef447946", "value": "c5f40d86eb387e31b53d3cbbaacd9a6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216917, "uuid": "51160c39-0af7-4892-bbe1-cf243b09cded", "value": "768:zvq5Xna/S+D7854r+aOf8M36U3betOg0SeJdqsqf:zvq5Xa/y4qao8zUru3eJdqZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681216917, "uuid": "cb35c9f1-f416-4377-98d1-39a7f8cb6dde", "value": 33082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681216917, "uuid": "fa225e39-752e-424a-bf6a-c6f1fb54bffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216917, "uuid": "75ddef55-f612-4287-a6a4-c11f232ea78a", "value": "SecuriteInfo.com.HEUR.15465.10452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b02fed-d83d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681199498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681199498, "uuid": "5027b465-b777-42db-870e-00db8917306c", "comment": "Malware payload (Smoke Loader)", "value": "c3336514f95cf6950f858cdd10d5da9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681199498, "uuid": "2ae9be5c-5af4-4cc7-9222-638b29ce5a7e", "comment": "Malware payload (Smoke Loader)", "value": "b3d29d2085dc447fe17069b8bb314dba757cad78e532ad7e0b15abc99f247cab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681199498, "uuid": "9aaf9662-5989-4e16-93c6-4b3302898b8d", "comment": "Malware payload (Smoke Loader)", "value": "7cd927187db18bf643824ef3829f7f8946820275", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681199498, "uuid": "d7949ec8-5395-431a-801c-cca78668eee0", "comment": "Malware payload (Smoke Loader)", "value": "0086ce2963fbbe7605d48907d29f7e00e4439e4311242b4baa9f5d0046902ed7762eb427a4337ba227a710c02b12ef1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681199498, "uuid": "103c6016-63ef-47a1-9832-73d10afe4afb", "value": "T19014C032BAE1C072C65785342861F6606ABEB9F19BD4868B33B817BF1E307D14766317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681199498, "uuid": "ab209ae7-acc3-49f2-a84a-8fcfe48573dd", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681199498, "uuid": "429171b8-5e69-40e0-873d-95fe7286f020", "value": "3072:13cB1oKaOJi0qMBfgz0ZCJVoMVjDlBHpxaxlTSUbMpetfRdVFC:1E59Ji0VBfgz0ZCJOQPHpIxluUSenTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681199498, "uuid": "d8cd507d-5a81-4a94-a7c0-e2c44e20bc5d", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681199498, "uuid": "25745afa-adc0-47b7-9c62-10dd05998c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681199498, "uuid": "fb8e2f5f-88ef-4ae3-8acb-d07fb0cb84d6", "value": "c3336514f95cf6950f858cdd10d5da9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decf7ee4-d82c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681192274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192274, "uuid": "f37486b4-a7ed-414a-8f12-71e88245e9c3", "comment": "Malware payload (AgentTesla)", "value": "90f4f26161c1edd5e59e0a92aa17396c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192274, "uuid": "fd93eeda-17d2-4bbf-918f-6c609bb2014c", "comment": "Malware payload (AgentTesla)", "value": "b53d9876abb5ece740b8371ee63c6196c297ae9a1767d72216d33ba09c9cfdb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192274, "uuid": "b642a1e4-bb56-48ab-ae4b-c3cc610c52a4", "comment": "Malware payload (AgentTesla)", "value": "85f00cf771db1de283664cc4eceac073b3e13c8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192274, "uuid": "a84f30e5-37a1-4dae-90d1-867edb4da8b8", "comment": "Malware payload (AgentTesla)", "value": "f069268aee7f79b7e28ba6249a066da680b378195e1f5bcac93819bc9ebb67b9fa0202779b2ef969ab19ce63e90e05ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192274, "uuid": "455f4990-20c6-448c-bee5-266cb0e5e6b0", "value": "T14AE433AC20C909A5DB5A627ABAF7BC7FDF3145421DC0BF28209C473C9922B971CE5D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192274, "uuid": "b90ad83e-8333-4721-a86f-44018c1e4190", "value": "12288:XZx2GLEfRoqdjQPIRFk91LRujABOprfIg5SzT5tq0ddCK7+8XGmm:XGAEfaqdqILkXGYkrwF1VdTyIzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681192274, "uuid": "f5836301-de40-46d0-a083-21c29ee87c6e", "value": 702247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681192274, "uuid": "349b2383-6bb8-4759-93cc-8694a3d7e0e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192274, "uuid": "4ffa8011-d667-49d5-81b4-a3431ad4c398", "value": "202105-USD122986.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a930306c-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681214089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214089, "uuid": "1bd67ee7-54ca-41c7-ba90-ed4711e3963a", "comment": "Malware payload (Rhadamanthys)", "value": "cd86c5536e6a4ac8ea153d37894ab600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214089, "uuid": "73cc457c-9763-4c76-bb9d-8b97b3951344", "comment": "Malware payload (Rhadamanthys)", "value": "b579df3a8607cb6b251ee319bdc8c1005ca3a6ed1e360eedf2433b3f6151d856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214089, "uuid": "dbb902ef-e66f-49f9-a5bd-3c3cb3621518", "comment": "Malware payload (Rhadamanthys)", "value": "20e391b9afd9617db223b86e27231ada8acccf82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214089, "uuid": "f2dcc754-87a0-41d7-97ee-bef966e0e7b6", "comment": "Malware payload (Rhadamanthys)", "value": "2f37f032bc4a51896585f7dcf60232c12fb3df1604299cb04e41faf5c4848fc960db195ba7062f37c40f70a46dd3fb58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214089, "uuid": "551b5ad6-9be0-4cfc-ae55-2ef91eaf3e66", "value": "T14144E13ABAE3C473CB9B96364821DAA06BBFBC715265C24F1314137E5E306815B7A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214089, "uuid": "755c1c22-02d1-485b-bd83-44ddd22f454f", "value": "94b862c07f0e4212c3fe2a5391e2e04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214089, "uuid": "9bd76c91-5f3a-4bae-b4b3-ba67535c41b3", "value": "6144:+QhYvpgNCyVf4M4zDo8SSVqHwsf37fuc0h:hhYvqCyVf4M8bVqHHTulh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214089, "uuid": "65b2adf3-2d55-4041-9433-d5dab42dd02d", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214089, "uuid": "2614d5b6-217f-4ee5-8cd1-30f164d3bba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214089, "uuid": "7d6d52da-ea00-47a3-9a18-e92ae40c55b8", "value": "cd86c5536e6a4ac8ea153d37894ab600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5df5b1a-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681231827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231827, "uuid": "b23881d1-15b5-415a-945f-19515f63f35c", "comment": "Malware payload (AgentTesla)", "value": "9c47d0030fe7da4d2ad4fcc32b6d1d65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231827, "uuid": "605b8c01-8900-42b1-80ae-5dfbc90dc623", "comment": "Malware payload (AgentTesla)", "value": "b5f05dc11b11551df7ae871ffe186c7f483570d40dc641445b06f3c1d0b2b55a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231827, "uuid": "ebbf4122-1d5c-4439-a3d5-2606178d5fc4", "comment": "Malware payload (AgentTesla)", "value": "f6d5657d7fa0463f582ab639223ce4a515296c50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231827, "uuid": "60047a38-b9fb-44d6-8609-10cd77def645", "comment": "Malware payload (AgentTesla)", "value": "fa3c9cac42667798412cfd5860496a812f0fed9deeabeab10712c31920fe134feada0bcae35cd737b27ae5790e7db126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231827, "uuid": "39a5df3d-f275-4c02-b02c-1a2767e3b676", "value": "T1ADD26F56E79E03B44B5101B7621E0AC9AABEB23EB351546134AC933433EDC6D4276AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231827, "uuid": "f4459e1c-3d8c-4f6f-a7d1-af7a53bf80c3", "value": "768:AFx0XaIsnPRIa4fwJMl4SqUy6WfriovU2/G6:Af0Xvx3EMOSqh66o2O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231827, "uuid": "f525be1b-d84c-4a91-abcb-8a38c1cb9946", "value": 28520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231827, "uuid": "dda50ae3-866a-4c78-a6a4-4d10570882ec", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231827, "uuid": "5b54b651-2b43-4697-8312-075e44c18c80", "value": "Orders PO# DE198594RT57.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0925ca91-d803-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681174306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174306, "uuid": "5df34195-0b38-4b89-9533-c5e027aeac97", "comment": "Malware payload (Amadey)", "value": "a653a10d94f99badae4c12f0e625995c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174306, "uuid": "04199c49-9b24-436e-962d-700fb7baeab9", "comment": "Malware payload (Amadey)", "value": "b63abf7e425e9793edde2d16e2cb39987c913b8af534dc5b1bc907f1755d6c8d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174306, "uuid": "d86f68bf-38e4-455c-8af5-69dc05750d50", "comment": "Malware payload (Amadey)", "value": "992df6b235bc77eca44b1ea270fd5881313eb0cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174306, "uuid": "4a0f3ad5-3f60-4e7a-89d2-768bec05526b", "comment": "Malware payload (Amadey)", "value": "9bf40c9f06778a851199a44cacec92954ae88b05891896fd8d27ce6fb9bd2f5bcd0a02c6179c5f706b8e39b75ea9f210", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174306, "uuid": "575430b5-def9-4ba8-9cb6-53ebe3fc4fe3", "value": "T15514E021BAE1C0B3D45B85742928EEA46E7EBC319751624F337457BF1E307E0466AF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174306, "uuid": "7f704db2-40ce-45ee-8041-ffba1e750813", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174306, "uuid": "6c9d7ddf-14db-4b6d-b1d2-729c7841b8e9", "value": "3072:hbJ28anvDUPNS2NuiZdWXmC5D0g4KyIzXccgkAnTm7HJh1gO8Wg:n28cWSIuEdW2C5IgjhT0kATm7Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174306, "uuid": "f7e03623-fd0a-4d98-bfcb-44dafc3a7b02", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174306, "uuid": "c56d9050-9903-4e82-966e-d871de3bcc38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174306, "uuid": "8e9f414c-da8d-460e-b60d-1736542ed58a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc302bd-d863-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1681215680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215680, "uuid": "48fbace0-b7ca-40cd-9394-906d8a2009a7", "comment": "Malware payload (Socelars)", "value": "9656a8ec7e267c930429d5f51c8ed30a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215680, "uuid": "34758233-d5e8-47cb-a6ff-7af52334679e", "comment": "Malware payload (Socelars)", "value": "b6444634784031f2ac143c2424714d62c339707c8e7d3ee3066747dd8ffe50bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215680, "uuid": "ab113def-ea4c-4b28-960e-fb94d89a424b", "comment": "Malware payload (Socelars)", "value": "6037563cd0c23da5f1727120a89858b1814cbfe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215680, "uuid": "8f1a0bbb-b279-44b6-8961-6c59d57ce3ab", "comment": "Malware payload (Socelars)", "value": "278a4fd3a91418671c7eec70e8518e9b138accdefbdbc1afa53bc50541b30eee92f53493b9ec6decc4c4f8601ca0b5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215680, "uuid": "75d0a050-0d9f-44b1-8cdf-204177db85ef", "value": "T1A2658D21F7C26032E8E310B745FF66BE9D3C6A21470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215680, "uuid": "f8de2ef1-6e43-4d56-b934-449848bfcd96", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215680, "uuid": "5e26cae2-be9a-4e02-9f4a-f2f7bd8a1ffe", "value": "24576:OGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRfQ5hkSq:NpEUIvU0N9jkpjweXt77Y5uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215680, "uuid": "19c85502-e6a0-4d61-a457-840d93dd42d6", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215680, "uuid": "a5f34be7-a96f-4a37-931d-98a68c5c94f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215680, "uuid": "8e53ea66-d6b6-4a18-a25c-7b9f60554484", "value": "9656a8ec7e267c930429d5f51c8ed30a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef631af2-d829-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681191013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191013, "uuid": "b663fe34-4b3d-43cc-a13a-ad52b695c84f", "comment": "Malware payload (RedLineStealer)", "value": "b9e3fc3c01e61996aa9a6f7b6295175f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191013, "uuid": "f6edd3bd-68a3-4506-9975-631c07df2dbd", "comment": "Malware payload (RedLineStealer)", "value": "b6e2f13792219fb689ba380d41834a74daa594b540e2600e279398ad8810a997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191013, "uuid": "9f7ef088-1df8-4bf3-88c5-4c85c839a92b", "comment": "Malware payload (RedLineStealer)", "value": "b1560474a10ca0a00250d36e73e25dcbdb1d4558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191013, "uuid": "9e8f67af-a495-4fab-b549-8f75af344623", "comment": "Malware payload (RedLineStealer)", "value": "dc3a72d742a364ac6140ad9c83d25bf005776dd5005fb008e56e04766774e558007f4202c500c30428b0cfd80c8a9b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191013, "uuid": "c71dd142-f0ff-45e8-9f0c-7198cd9ea07a", "value": "T1FAA35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191013, "uuid": "5d1cbb32-7b28-481a-9e73-ff52b0d6d7e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191013, "uuid": "37befb49-b3d8-4270-88f8-cb3148e4140b", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2q3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681191013, "uuid": "60471efa-59e3-4bf8-9073-915354d12c05", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681191013, "uuid": "3a3692d4-f563-4c42-a523-db87ff360cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191013, "uuid": "18ebfe56-f95f-4a36-8bd2-41d9cfaa3626", "value": "b9e3fc3c01e61996aa9a6f7b6295175f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a0dfc0-d887-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1681231227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231227, "uuid": "5da8ba8e-2cc5-4d8f-a04b-41cd356b95b9", "comment": "Malware payload (njrat)", "value": "0c2159394fad903fa30b154512f6a9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231227, "uuid": "e9cee79c-841e-4de0-814d-8f49f88dbe82", "comment": "Malware payload (njrat)", "value": "b72fcfbae33da6cb208d0977009e7852383b4083dd316539e501c6c07b734c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231227, "uuid": "972fa86b-73e4-4d1c-bd21-14b83c5abc8b", "comment": "Malware payload (njrat)", "value": "ce28beb3d0d85b6eecdcc94bb78b19d035f4669d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231227, "uuid": "53490b4d-05af-4b72-9e2a-447433715e88", "comment": "Malware payload (njrat)", "value": "639ead9551aad95bd7976fdf547c986ae8e9537701a6517e209b585ed67b3f8ea96c602d6b227d066302d1df67170020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231227, "uuid": "815b856f-db15-46c4-9199-342dd3e8a4ca", "value": "T17FF2294D7FE181A8C5FD167B05B2D413077BE04B5A23DD0D8EE6A4EA37236C18B54AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231227, "uuid": "752b5acb-e891-4319-9471-ca829d4e6cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231227, "uuid": "650cad83-156a-4219-a11c-8cb68dc10a3d", "value": "384:FmOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM39:nFdGdkrgYRwWS9rM+rMRa8NuPyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231227, "uuid": "c6a14740-cd71-479a-83c0-e4be7e90323c", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231227, "uuid": "387e7816-0427-4ca8-b67f-0c84a2cc826a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231227, "uuid": "fba58a52-a03a-4e76-b108-cdf368afd292", "value": "0c2159394fad903fa30b154512f6a9d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad728913-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215384, "uuid": "d170a407-6d0d-4993-adea-192ad721c564", "comment": "Malware payload", "value": "b67a2fd86a4838184b514bd547990c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215384, "uuid": "60058e45-2ca4-4324-ae67-e9f57d244cbb", "comment": "Malware payload", "value": "b8c4d2692900caa2d31557b568b39617fb8636fddb0e70942fb8fc96ee2a2dda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215384, "uuid": "42cf12da-61ac-488e-963d-a21b432b8522", "comment": "Malware payload", "value": "feb0ae4f0c308ad756231fd2aeb0d479a46e33ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215384, "uuid": "73b5d0ab-7c71-4c99-8b10-111691c73bde", "comment": "Malware payload", "value": "bd895568e2f62560711ecddb852de5cdd310817278edbe25b98b469f50ab2e6a68ad5bb9f4d7b18a9e828ae6ce6630e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215384, "uuid": "fce22b5d-6f89-4a4e-8823-d89f144d54fd", "value": "T1FA8533586E004CD3FFAFCA78515A24F975737E40804D8923B36E0CC0695F9A6E5ACE9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215384, "uuid": "601ddb60-8a1d-4583-aba0-2b88b3c2837c", "value": "49152:GMjXRbjn9BQ5OG843AoHfzhcmXE7DGZkTvL7blXjw+Bt5:XRbj92scwqfy6aBXjDt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215384, "uuid": "77fd8eda-0f58-4922-b263-29b950e4c692", "value": 1813616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215384, "uuid": "672a2788-bbed-407f-840e-f1724eaf8d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215384, "uuid": "28d71a00-26af-47cc-b2f7-23eac1a62aa8", "value": "b67a2fd86a4838184b514bd547990c85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113be094-d84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681204814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204814, "uuid": "0a985788-1022-4010-ab76-fa2c02c480af", "comment": "Malware payload (RedLineStealer)", "value": "ebc9000c9233ce8d2f0ec1d81ea6dfd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204814, "uuid": "5a133720-07b4-435e-8d89-cd67b8ce6e9d", "comment": "Malware payload (RedLineStealer)", "value": "b939788848ec0367f91d9bd3ffb17f9de4b0b7bd2c94dfc79212ea1d79e6c3c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204814, "uuid": "470ad102-719e-4b0e-9df2-a3ef620a85b9", "comment": "Malware payload (RedLineStealer)", "value": "04333e14123d57a1889881b1ed87d277a49c8450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204814, "uuid": "7aaff907-acdd-4247-9908-bb092a04478f", "comment": "Malware payload (RedLineStealer)", "value": "aa6accc9cb08d20f8636d451a1970a65570febe82960c79990c95ab09c00cb4aff5da5aff7be49e96f85c125d90ee019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204814, "uuid": "a10c0248-9f47-4f41-bb0d-8998d086d945", "value": "T16164AE937110BC36D02FD2FC76684DB9A59DA8610B1594B3EFCC2F2D0A579B081BAB74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204814, "uuid": "cc23235c-ac30-44bf-baf1-3ed912224d34", "value": "c5cafc3cd56661be310b19febc40278e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204814, "uuid": "b04d9ba0-5d58-4eb1-9e0c-fd4ec5d12f8b", "value": "3072:6+AnkTCmphR48m3vPyVuyubmC7z0A2A1P59fFZ9mqwS+Tdgk5Ju9u1POY7oT9fxV:6+AnGk8YxRz04PTfFZQqwLOutpol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204814, "uuid": "83bef04e-7cba-4664-927a-6598e7e9a3f4", "value": 326408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204814, "uuid": "22674d93-c121-401b-b857-c038ff785892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204814, "uuid": "c9da1d99-ddf8-4917-90d4-c420dfaec7b7", "value": "ebc9000c9233ce8d2f0ec1d81ea6dfd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48edab2d-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681204478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204478, "uuid": "db7259f4-5c55-4cb2-9339-c1b673d02f9d", "comment": "Malware payload (SnakeKeylogger)", "value": "d2c19f6af564025f9b96ba0012d30188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204478, "uuid": "70de1f54-5d08-4a0a-9808-a72786041365", "comment": "Malware payload (SnakeKeylogger)", "value": "bab9dc0fbc3b5002c5b43e0f45b67afb74662570c66a4163ce31f19cedc58b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204478, "uuid": "c3ca8769-23d8-4696-a24d-2b835e9dbb79", "comment": "Malware payload (SnakeKeylogger)", "value": "5332a1b8cafbc5c4f8819ec907f68b904ee702c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204478, "uuid": "444006a7-a928-499a-ad0a-93e466a15478", "comment": "Malware payload (SnakeKeylogger)", "value": "c3edd0de17c5d64aa917f19f5a47d37bd08f141623fa633eb53b4d7df7a5d57449e116173fdf3b7c73dda2dba3a0b17a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204478, "uuid": "2b832c90-fc27-4b79-bc8a-089096e747d7", "value": "T187C4022C27B6CF21C45C57B964445A4223B4928778A3EB2FEF83A7D35DB37432A05297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204478, "uuid": "32e3b170-540d-42d7-b2e8-fee46b179e68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204478, "uuid": "686ada8e-8204-4f0e-b4db-088fffe34d16", "value": "12288:O1IX6KN82023/HlVQNhLxtRtr2NEdyp15RJGv61aDMoasNRQqy:OhDadkhLxtRtU51aDMoa4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204478, "uuid": "4a915551-9860-43db-a979-31acf47767d3", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204478, "uuid": "48ae3456-c975-4886-b3e1-50f87eb4d2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204478, "uuid": "eb5fff68-faf9-4417-b0d8-374363b246ce", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd9b31d-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240133, "uuid": "484a7eb1-223e-4968-a783-3ec7fd1c7eaa", "comment": "Malware payload (Mirai)", "value": "13c0ddc7d56495c618b32758c22b9e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240133, "uuid": "ea432a47-3ccc-4366-8e35-22403292bc81", "comment": "Malware payload (Mirai)", "value": "babad77c702cb6a7f408201aa9c4fda10bdb3e80a1add42dc4fc12f57af8d29c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240133, "uuid": "1d0ed35a-18db-4198-adff-1513b83a9187", "comment": "Malware payload (Mirai)", "value": "ba0793ebad8c25001944676d30144dcc946babb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240133, "uuid": "7dfd8e9f-64f0-4c10-85fd-b9632f53b14d", "comment": "Malware payload (Mirai)", "value": "2ae9721cd8bc0ebf3e8a65a5501d057519b0aaad61a91dfa65ce212f5a860c0a57ffe85e24404a2d0e00ad3bfbca3cd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240133, "uuid": "f062592b-b9fb-4c0b-b462-340a79073178", "value": "T1EE639D7AE01DD990C5860134B9E89E341F53B18992B72DB71ED785A210879FCF904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240133, "uuid": "bf565b22-c773-4ae0-bc42-ec98696f04a5", "value": "1536:nR/Fv9MTa1wt5q7e//khUHUJZWFY9XXCnJ4:ntFF2WSq7e3khFKY9XXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240133, "uuid": "dca37795-4f97-4fba-965e-84d55c40d7e1", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240133, "uuid": "a3a8f5fe-d882-4d1b-8b0f-cfa8ec502d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240133, "uuid": "b41eb7af-d1cb-453b-a62e-8db7bee19222", "value": "13c0ddc7d56495c618b32758c22b9e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926f7ca0-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681204172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204172, "uuid": "5a1d9b44-bb6f-4941-abb5-eeafb425bddd", "comment": "Malware payload (Vidar)", "value": "58a58b94ef827335f91580d291914918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204172, "uuid": "0f96abef-b29b-447a-9495-6d407115965f", "comment": "Malware payload (Vidar)", "value": "bb608ae382998ceafe80c895c64fdd2f856a2dd50301208002019e778878d89c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204172, "uuid": "f3f31d1f-7745-4834-a82a-be5ed75bb34f", "comment": "Malware payload (Vidar)", "value": "d47a7a976cef923d9e2b82473a41ad3c8332a454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204172, "uuid": "4240e565-acb9-4770-a719-b23e5fd1d0cc", "comment": "Malware payload (Vidar)", "value": "b0728beef0e1253dd0dbe1c56561e1011d117ff75b47d45f62c54cab17029678ce6e03c1631d170782ba692b8c7ecb2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204172, "uuid": "71923e4a-bca6-49dd-b469-50a129c508ff", "value": "T1BF64F1227EE1D0F6D58B85310420EEB4AE6F7451DA6185AF2764C77F2E203818B7E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204172, "uuid": "bc8ba0d0-0739-49b8-8824-dd8b870fc2ad", "value": "4c3723f654b7ebef4d253c089e97df92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204172, "uuid": "a776d832-f2c5-4dec-bc8e-0c9bdbfb598b", "value": "6144:m28GE+elkxG0BT9HRfiCFsY/yHzgVCkBsC:EeelkIWT9H8CFhjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204172, "uuid": "1cca70d6-6653-4b8c-9b55-24b697380fd5", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204172, "uuid": "996263b2-c269-4a0f-b891-1c01b7d2ee05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204172, "uuid": "d92ace35-d14d-4b12-a8af-0ae1f405572f", "value": "58a58b94ef827335f91580d291914918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95a3263-d835-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681196050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196050, "uuid": "26143174-6a9b-4bca-9f55-3330477061ce", "comment": "Malware payload", "value": "6d2fc3110975661952b72b0458d29cd6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196050, "uuid": "7560890b-e32d-4d6b-965b-dc383621afa1", "comment": "Malware payload", "value": "bbabce42ac21b964fa80383653e2f9ccf7760c0a3f881429583360a42aaaf624", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196050, "uuid": "316f12a1-910e-4861-9bf5-7676a19b630c", "comment": "Malware payload", "value": "dd4e289a7229098bc07cacaa0f1ed2045ee12b3a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196050, "uuid": "0c3e8b27-7441-49a1-b0c3-86334896def3", "comment": "Malware payload", "value": "1dc89aa62e2b16f619aea6bbd24f331d2adf4ac6481e4f314ee671775da6094e577d2a55e34479275eda112c2fe7886b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196050, "uuid": "4eab77e0-9450-4e67-a10d-e478a4ed02b4", "value": "T179617C1457DA0708F3F3A73A69BE52994E3B3956E932C74E0059414E52F1A40DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196050, "uuid": "7d194dca-3636-4245-8103-705ececa5139", "value": "48:8wHaKU9Dmel0iglZ+q5rlpQfYj1sAT1rTRRSJxodgImcC:8wHkB0+q5x6YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196050, "uuid": "8a7124a6-2f9b-4812-ba46-477ed51d132d", "value": 3452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196050, "uuid": "e5e96a06-611b-4e8e-a3c8-100acfb98009", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196050, "uuid": "d2ca3275-d1e1-43d1-b33c-1d482e4af62f", "value": "PURCHASE ORDER AW100171 .png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812aeabe-d85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681211874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211874, "uuid": "5873ad82-388d-44f2-bbe4-3786bf89df1a", "comment": "Malware payload (Quakbot)", "value": "9a0a63f7b0dee209641328aa2e65fb38", "object_relation": "md5", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211874, "uuid": "96e9e85a-0780-4902-8a1d-7daf17551fff", "comment": "Malware payload (Quakbot)", "value": "be4823fc481bc09cbe98b8b4e5010b19a39ef198cd0bb365221523612232d6d4", "object_relation": "sha256", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211874, "uuid": "bf05b94b-05a6-4658-af9e-6653670fe747", "comment": "Malware payload (Quakbot)", "value": "de0aabc4d781f1d4901c1113dc871b9301b99af9", "object_relation": "sha1", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211874, "uuid": "3eed7084-1580-485a-9445-701cc2de782c", "comment": "Malware payload (Quakbot)", "value": "12498eef8a0a1185c7339e32edac7877ae16956a946f0e9a80a2cf2348429a57a61b37a140a7782f9089e174e7c9e599", "object_relation": "sha3-384", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "BB23", "colour": "#A371FB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211874, "uuid": "4110c27c-0c49-4f07-8ae3-d1315082a01e", "value": "T12CC47C36756740F2D41756B22097EBBF4234AA268874A57EF6E8DE41FB732B03719203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211874, "uuid": "90e0a2e2-3831-4fb7-8d24-7997f84ea11a", "value": "6863f3efdf3665c7c292b3dfdffa5eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211874, "uuid": "5ff27107-b8e6-4167-b212-f0a4afe78719", "value": "12288:Q1YEpoSVWkaD25m+ZTLQwx7Y+g3D7exRAqHNU/Zwa:Q1xp374GLbx7jg3foRl6Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681211874, "uuid": "4e06d225-9b83-4661-9e49-76fedcdca687", "value": 578215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681211874, "uuid": "6d5fd736-1513-4f9c-a5b3-e07ae70beafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211874, "uuid": "6228d5f7-9537-4bb9-a6ab-71d32380d4fc", "value": "Quatorzes.myrmecophobic.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f183a240-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681231819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231819, "uuid": "cf21825d-8b74-4f90-89c3-f9bdb5b8ed6b", "comment": "Malware payload (Formbook)", "value": "b1b502697446e8caefaeb0bcd1d937a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231819, "uuid": "9912144d-7e78-49b2-becd-201bd7d31467", "comment": "Malware payload (Formbook)", "value": "be4e2f260d194cb847bae634024b3ef73349811107e5fedfddae90709336df6e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231819, "uuid": "bd083a33-e2e1-4231-94e8-f42feade6735", "comment": "Malware payload (Formbook)", "value": "49739e57d1359ef4499946e3681511c3025e09d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231819, "uuid": "f77987b5-6198-4c2a-9ef7-634fe1a3f9ea", "comment": "Malware payload (Formbook)", "value": "ab70b623d86f163ecad7167fffb7a62baaea0e8054101163373c53096302916bec245e5bd32de7262e798a06d1263a2e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231819, "uuid": "f0aa2096-ec4e-4d5d-b868-88a7f3d0709c", "value": "T1674423A0AE6DBEFC1ED870266CBA10FEB5465F4B485A61CAB4E25085D333434CE45B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231819, "uuid": "02fd7ccf-8d9d-451c-8640-4861bac75818", "value": "6144:nX3O7lUzDpMMU9THld3oMBoSpLsUOwaEk/IcSMMBm0b:nX38UzG5RHT3yslaEkwcbMB/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231819, "uuid": "6c4e1581-8daa-44cd-97f5-546e2a87f344", "value": 263270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231819, "uuid": "2251edae-0b61-4753-8d65-b35bb47c2208", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231819, "uuid": "b78bae07-f74c-487b-938b-ad031d747d56", "value": "29302000039_pdf_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d632278-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681204137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204137, "uuid": "9bdd2c43-3fc5-4e41-b6d2-209ec4696ef0", "comment": "Malware payload (Vidar)", "value": "3cba06977093cf31c52f325ebded13f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204137, "uuid": "9f7fb559-d8d0-4781-9d15-e8a07ea8a761", "comment": "Malware payload (Vidar)", "value": "be4e635c156e8f4a486c101e9778e56143e5130b64075a4eed30f933c97378e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204137, "uuid": "3876ebbc-9e60-4779-8f20-3772b55b71fb", "comment": "Malware payload (Vidar)", "value": "b9fbe0866e1ed4c9576a9ceb5021f4de685edc4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204137, "uuid": "c45cdcfc-fabd-4ab7-b204-32eb737889b4", "comment": "Malware payload (Vidar)", "value": "8c60716c0c030c03ead9a677e5a7f52fc1d307809eb803894f7397b369af0faf9ad15c96d48474129892a585d7a79669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204137, "uuid": "04ed7851-ee2a-450d-9c82-2f5b523f59fb", "value": "T16F64F211BAA1D0B3C85385764465EBA0BE7E7CE2D15D814B3720637F7E303E06B6A71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204137, "uuid": "f0719e7f-1ebd-44f9-8ec8-1614dc550648", "value": "82ab9ed8901e93f77bae02483c5ed839", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204137, "uuid": "5d95de52-82ba-40e8-a413-80751b6295b4", "value": "6144:2928exxn5CmGiziD6tNfge6C9KWyhP6VYnIUJN/D:oWjBGizietWntP6yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204137, "uuid": "6e03de61-4893-4ab9-9e1e-252ac9b99aaa", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204137, "uuid": "7f5d84c9-0030-4041-9f2f-45e71a870a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204137, "uuid": "1c25d433-d58e-407a-92ee-c0085f010864", "value": "3cba06977093cf31c52f325ebded13f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3a5352-d86f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681220806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220806, "uuid": "1897db50-b19a-4cb3-917b-e693338e4b21", "comment": "Malware payload", "value": "47af318d8042a4f10a6224f6cb4ad77f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220806, "uuid": "1da00a41-5fe1-4ed5-a1eb-e30c955be1a0", "comment": "Malware payload", "value": "bed00a4353c25e29f84b159a6352aed9dfc3171b8b0d47fee5275ebab33781b1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220806, "uuid": "c735415c-a76c-4059-af1a-7024f9e481fe", "comment": "Malware payload", "value": "d6cd3bdee45a2bef0817293b71e369d31a9081d4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220806, "uuid": "1258c8e2-e851-46a1-bec1-fd60fd396e52", "comment": "Malware payload", "value": "8a3686e960b81dc4fa91d1ae09d83a1886162b6a29fcebf33a3e34d64594806e43e95e72765160c094c3238e514a628a", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220806, "uuid": "4eab3953-6832-4af6-a017-d19b42b102be", "value": "T166617B6053823B081EB391A4C2F05F98CFB55197A7063D18FA1D1B2FAF7D86044676EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220806, "uuid": "b4cce7c0-2d2d-4084-bcf4-2b033c6e92a2", "value": "48:KAu20fk1tRtka5giyd/BTX5oi4ncH2t/3cMW8tkGKRocO:uk1/tkQUZT5F4cWpMf8tkGElO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681220806, "uuid": "ec429fec-e0ea-4998-ac30-4829433fd66d", "value": 3389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681220806, "uuid": "fef52513-ba72-422b-a2b0-416b5580682f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220806, "uuid": "ed3777ca-f8b6-4983-9d93-3345c23e1b14", "value": "redacted.file.11.04.23.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6d2ca5-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240104, "uuid": "998115f3-569a-431e-87f4-b4de8e5bd508", "comment": "Malware payload (Mirai)", "value": "c8df24f66b7c2275bd5950ebb8de74a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240104, "uuid": "8ae64b6b-fac7-48b1-93ae-c8e73d41628f", "comment": "Malware payload (Mirai)", "value": "c0b0e155d1466049fe9e9fce96a27a0f2ff219ec409be17eed11cd7bbf181f0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240104, "uuid": "3c08d7be-37a5-4748-a3cf-8309a5852624", "comment": "Malware payload (Mirai)", "value": "432fae2b4815feaebab726e62dcdc6c86db36ede", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240104, "uuid": "57cdfbd5-0bdd-401d-8ed6-00fcb5703679", "comment": "Malware payload (Mirai)", "value": "c61c6f198cd6d300059e174b38aef2b714331828f51102db684a15a1729af3397045704641c57ff1728127acbbf65a55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240104, "uuid": "ee1990da-4ae9-4264-a0d5-ac134376336c", "value": "T1A7732989F4028D7CF947DEBE24514A0AAD21638176971F2B53ABFE937C331693E02D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240104, "uuid": "1ec71d53-c498-4afa-9852-6acc40809aa4", "value": "1536:ED5CoqqHaYvgFjovfj46wDtKb6/hVuwZtTdycDtzVGBNFV3SSH89KFv3v06tZ7e:EXvgFjovfj46wDtKb6/hVuwZDDtzVGnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240104, "uuid": "66bdda5d-b908-4453-9b6a-6d409433e8c2", "value": 73388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240104, "uuid": "7909f76a-b85f-4316-a5ec-8b92c2599518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240104, "uuid": "1367abb8-810f-4553-ae98-3e690b3e8521", "value": "c8df24f66b7c2275bd5950ebb8de74a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfa8fe6-d890-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681235061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235061, "uuid": "ab7e36e8-ce29-469d-9980-c0272b697819", "comment": "Malware payload (AgentTesla)", "value": "37471f10426bc0922a0cc4a486ad6497", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235061, "uuid": "2788f9a2-b15c-48d7-b441-b54a839b3010", "comment": "Malware payload (AgentTesla)", "value": "c38f4bfabf46a23f498803d6638007ce06bb50f972aa4119f86f462240576c78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235061, "uuid": "40f10a2b-64ab-4e1a-909f-620ecd355dfa", "comment": "Malware payload (AgentTesla)", "value": "abcd98dff3d1b6b3f6d61be19b2841f1b81c5d3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681235061, "uuid": "46cb3370-e38b-4f1c-91ef-4bf71ae23f80", "comment": "Malware payload (AgentTesla)", "value": "855202bf7f2ba268f36f2995e71a51cb5d26c82407bd3fbd78f02817fa796401af6a7f0e2e76aba56d8bf0c41ddc4648", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235061, "uuid": "01845e91-f311-41e0-a73b-70ece203ba5d", "value": "T11174D01977A48E7BD87E073650520A424B78F217B12BF30E06CE5CFBB9837E9564609B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235061, "uuid": "cebbb330-1093-455f-8d1f-a624472d4778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235061, "uuid": "bd4a6581-ee5e-4d4b-a141-5336af94c970", "value": "6144:e6ZRTthDeHaIbYkTHS3/8bamWQxLAbCtrLhdyWcRxiVb3E84CLRGGGGGGGGHGGGQ:e6PTrDL3WHS/Qx0ORrXcwi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681235061, "uuid": "a30b677b-9e80-4215-b39c-ef1dfbcda0af", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681235061, "uuid": "ff6e2ffd-cd9e-4ca2-b0db-eb6267e1533e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681235061, "uuid": "c14d9655-76e9-46ef-bc05-4355d9cc9c4e", "value": "Order_confirmation#87928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06d02c1-d886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681230851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230851, "uuid": "18833a87-27ef-425e-9943-2ad86b866047", "comment": "Malware payload (Mirai)", "value": "4d92fde328b856fd5e793a82ad4d1737", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230851, "uuid": "57c0a284-43c3-401d-add9-6a0228831ca0", "comment": "Malware payload (Mirai)", "value": "c3d386b3eefbb8af5bbd4a2e07143fb3c3c1fee1a1c21642a78de357ae43bb43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230851, "uuid": "ef305efc-4479-4918-aebe-9039224a6d96", "comment": "Malware payload (Mirai)", "value": "209edee8451c168092320c197c6b3a5e779a1bff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230851, "uuid": "fb9484e9-2477-4666-b7db-dbad0343c9e5", "comment": "Malware payload (Mirai)", "value": "7eeffe2e45ff9c9c54b860a0fa12a04bb211eb4107706bf2301ef1820f4602d3c7664e6c993d83ef7266976e5a3930a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230851, "uuid": "ff94fdac-75dc-4211-bcdf-da6bd148675c", "value": "T10E538D75D11DEEA8C0424AB4A9698E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230851, "uuid": "2cc9dc2b-6693-49bb-a519-909e6ed2601f", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681230851, "uuid": "72381fcc-8c6c-44f0-97c3-548a6771fb74", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681230851, "uuid": "42a35499-7ead-43d7-9192-0a40abd98e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230851, "uuid": "9dab1eb7-d825-4ec8-94af-1d1e75ebd7b1", "value": "4d92fde328b856fd5e793a82ad4d1737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776fe179-d844-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1681202409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202409, "uuid": "3d467e01-d716-4a8c-8601-acd957dcf80f", "comment": "Malware payload (RecordBreaker)", "value": "a548b5d4ac55b5265a15a836f01269b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202409, "uuid": "4a79acf0-0edc-4947-ae61-3181575d63de", "comment": "Malware payload (RecordBreaker)", "value": "c4ce87b7fd6207ee421dfa6007aeb71854802722ae67e8e1e4076bde2ddd9401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202409, "uuid": "e3281616-c13d-4e69-88f9-08dea0b101c9", "comment": "Malware payload (RecordBreaker)", "value": "d22a8965cc5a6cb703a9e872b8cf8ecf3029f8d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681202409, "uuid": "c2e65727-2120-4efa-8237-fcbc0c1c2de4", "comment": "Malware payload (RecordBreaker)", "value": "f0440031e8a80c35c57e7876e68306e9ce308704fa5ca7a0ed832b57b8f8e0e7ec8fc47fe57328c361eb7d07a2c78e77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202409, "uuid": "7d6e2d22-c8eb-4e63-8e0b-3d4acebe5665", "value": "T13154F80393E17D4CE9268B739E1ED2E8B71DF171DF897B6932189A6B04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202409, "uuid": "10a10be3-4438-4a8b-a497-c194e082c7e6", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202409, "uuid": "645b8ec5-499f-4f57-ab45-b2d887ca587b", "value": "3072:9Dy/XXLzeJtZ61hpFyRXixGPtqTDCXu54LnIt14LR:OXXLz5ZURXiotey/jW4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681202409, "uuid": "3b4a2453-f198-4bb4-9114-e564845fd5aa", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681202409, "uuid": "ef4ad696-8f2a-4726-9186-36a1f2034de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681202409, "uuid": "22f1e99d-6e12-4055-8656-1fe3cb423dd4", "value": "a548b5d4ac55b5265a15a836f01269b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811703ea-d89d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681240650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240650, "uuid": "1fa557d7-c657-4ab7-bd32-a1b1eabbf0c9", "comment": "Malware payload (Mirai)", "value": "b8d13f927508093ed5cc3ad501fdcd4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240650, "uuid": "b9b936f2-bbde-4437-9c73-070ede65856c", "comment": "Malware payload (Mirai)", "value": "c4ec091342e4db7848a296c89bb4c65b1622f784614d0a5e72b5e6b79e3e3035", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240650, "uuid": "85f901bb-4fe8-4bb5-9e0a-1ddbbc4f1d9e", "comment": "Malware payload (Mirai)", "value": "037691732e1a24b24aa1907d7ac5033a956c8c82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240650, "uuid": "b413b2ba-9746-4a70-92b8-d9c64b14fedc", "comment": "Malware payload (Mirai)", "value": "42fd7649566cf22e23ab01405ee3c8b92284494d8e81cc3fa6db6d645958624f04c0ac3f384d123cee3a7de127ec582f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240650, "uuid": "5573ff27-77f9-4d0c-9541-d53fddb8609c", "value": "T161831785B9828E22C5D8137AB92D118E331263E8E2CFB217DD115F6077C692F0E77E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240650, "uuid": "f3c6e63a-796b-406c-9bbd-fe62c12858d6", "value": "1536:gtnyJ4Qsm+BkAnN48qf9yYWe7Om9MX0SAttUqBLTtRl7G33zLIziKjhddzYU:PJ1mL4P9xj6mvtJTxjhddzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240650, "uuid": "486e3d3c-efaa-453d-8315-0bf7bbab6765", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240650, "uuid": "7333036a-247f-4ae2-a6e3-3ac6250b6285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240650, "uuid": "11767d2b-3aa4-4485-9188-94e2a9f52071", "value": "b8d13f927508093ed5cc3ad501fdcd4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba38374-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681238977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238977, "uuid": "53dc88db-20e9-482f-a2cc-f8609639e9b3", "comment": "Malware payload", "value": "746388fa2255d30b43b50c851208fc7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238977, "uuid": "d4f4ba06-5bfb-49d5-add5-daef032318fd", "comment": "Malware payload", "value": "c587c04ea596ec1f66bab4bb96dc894843babb3c6005cecef065fed772a350cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238977, "uuid": "d0eb5bf6-6e53-4928-a8ac-be696dd8d844", "comment": "Malware payload", "value": "d1360776a8255bb262274cc75341c605acd30675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238977, "uuid": "5a6d37c2-674f-41ab-b90e-f14e712120ec", "comment": "Malware payload", "value": "f711d48a8f9f40fe5973433e2c6cbd9f9f3e0dd7e50ffdfb34ae3ace037214af7b1cd1c761ed4137e293b2594a38592e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238977, "uuid": "f1bb2430-6de9-4282-b662-284dc8cbfb9d", "value": "T1A4635B27FAC8D473CC9807B048F702D31B35BDE1195857A32BA25CAA5CF22D4757A26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238977, "uuid": "b34f7386-75e3-44f4-90f1-174b4e145a6b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238977, "uuid": "5aed1fc2-2b19-48e9-a4dc-f9752c597c4c", "value": "1536:Kg9xXnNImo/ur1ZbLr+O1fs5g1WdPzE3ROovcK4zqhNC4:KGy+bnr+O105GWp1icKAAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681238977, "uuid": "96d552c0-fa3b-46f9-86de-15eeda993490", "value": 71389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681238977, "uuid": "8c8d563b-548e-4f4b-b4a1-eafccdd63291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238977, "uuid": "56c46bb7-e6e6-4570-88e8-97a3acbe93bc", "value": "746388fa2255d30b43b50c851208fc7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4180d57a-d88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681234530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234530, "uuid": "b60321e1-20cc-4fa2-b18f-7faeb6d4aee2", "comment": "Malware payload (AsyncRAT)", "value": "848a6a3ecbeca4036d6fefb67d2ca0b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234530, "uuid": "964da9fe-8511-47e9-ac6b-16250663f4fd", "comment": "Malware payload (AsyncRAT)", "value": "c6a78cfa84e1fce4e9c277d9854ee8f256b3dab886b304c802ba66c8e333c7c1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234530, "uuid": "c8aeb57b-dcb8-4b99-ba3c-0025abda53ce", "comment": "Malware payload (AsyncRAT)", "value": "b5c0b4f05091fbeaf1472f5f96d29e062714805e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681234530, "uuid": "cb64d1ff-e50b-48bb-9197-bc1737b1e694", "comment": "Malware payload (AsyncRAT)", "value": "44a33c05e627496a9f22464cd0e2ed2a4111b3418fe9bab55f6b10649e1f810af901539487b33351b0ee3c80511e91a0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234530, "uuid": "2b5e64a3-f725-422e-b207-1c6bf791779a", "value": "T12B9566ACA806D1A0D5CC093958DB08DDD17E245D6B4729629FD1AC29BE3C302FDED39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234530, "uuid": "accaa4e8-dc30-4a59-b667-719310ee1155", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234530, "uuid": "0de13274-fb07-45ca-92ee-4a96a27c311b", "value": "12288:f0wkNtS3kxkP6OsYAndRLebJNixIi6CxWOUV3R0qSQ2tYIk:MwytS3kxk3sYzbCWYxWfR0qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681234530, "uuid": "c88aea61-dbfb-44f8-89e7-e7ef7c9fda42", "value": 1942528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681234530, "uuid": "b1f9be04-1dcc-4995-bb60-0592ea69124a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681234530, "uuid": "9ac03e7a-f3e8-496e-bee1-275d7ed163a2", "value": "C6A78CFA84E1FCE4E9C277D9854EE8F256B3DAB886B30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41beb9d-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681203853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203853, "uuid": "dce4e255-e552-42a0-b490-c8718de9239e", "comment": "Malware payload (Loki)", "value": "b02b89d17c92d23902ca7ed6d17f4523", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203853, "uuid": "f0bffec6-5e29-4fe4-a824-770782680fa0", "comment": "Malware payload (Loki)", "value": "c7151038108909708473f719674d4cc4173ced191cd62539bafff2de692eec0f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203853, "uuid": "20c88a99-86cc-4e5e-8092-e488d66b29e9", "comment": "Malware payload (Loki)", "value": "73bea704306e16df6eeb170f8b754c2cfb1614c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203853, "uuid": "fdfbe2e1-106d-4da0-86f1-3100563b26aa", "comment": "Malware payload (Loki)", "value": "650d1652f749029a93acd1045d0762207a6f9f5876adcfae6888b02855c20747e06cb1208641923b832e6d9d2d379851", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203853, "uuid": "23acebbc-2ff4-43f7-a09b-ed809d6762f0", "value": "T15EE27256E38E02758F9112B6571E4AC8A6BDB23EB35051B1786C833433EDC2E42766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203853, "uuid": "d3446f1d-feb7-41df-96b1-4b11937ab0a3", "value": "768:zFx0XaIsnPRIa4fwJMEnq3IBhIj3mB/uDuXtIf+dzv:zf0Xvx3EMOv+s0u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203853, "uuid": "74f4977f-4eda-4e41-bcc9-c1863ab8493a", "value": 33185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203853, "uuid": "30f4c819-45e9-4851-8de3-719d2547fb13", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203853, "uuid": "8c3abd87-781e-4d85-863a-69ee954486be", "value": "Hsbc_Remittance_Notice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b7b88f-d834-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681195351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195351, "uuid": "1ae54b8c-b2e8-4aee-ac7c-2e39d72a152a", "comment": "Malware payload", "value": "fb97035d5bb8125ed066594682e406b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195351, "uuid": "ace32657-36c6-4cec-bc4b-803773ce81ef", "comment": "Malware payload", "value": "c7d3496eb57b524259fe87465c7b746d2fa3ee65f3b692beb8f7af65b958f197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195351, "uuid": "15e41032-c7fb-4452-b5ab-df0ae20ed34d", "comment": "Malware payload", "value": "a8aee01dae1952e031a959ef86bced1ed1c16c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195351, "uuid": "49d25024-f8ff-408d-81e8-b1dec1f2434a", "comment": "Malware payload", "value": "55036ce1ca413bb8c097acdaa76f1697dc2d26d71a20badb5c946e29075ea264f604d42dc5cf2b0febdb3710099eb563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195351, "uuid": "85f9a13c-ce67-4c9e-b0d0-f514e13cc91d", "value": "T16E95CF3342D3FED5E7B65D98E84621594C80FCA7231CE2987D8C54AB25A9524EF8BCF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195351, "uuid": "e9e00ed6-5062-442e-8239-9d45cd2980dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195351, "uuid": "19b4fbb5-a88c-4be6-85b2-2c498631b441", "value": "24576:/IFrfg7M9zJrbMZRFHwZepnK0IN0YtPRGAfCPyY1p3ZGZMqFPeKi6DAfUTxSExd1:WriM9zJQ2IjAlFPx52Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195351, "uuid": "a822a2f2-9cbd-4bf5-970c-191e38a20241", "value": 1885184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195351, "uuid": "edf5bb43-d59e-49f7-b453-ecd8eb810479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195351, "uuid": "24b83e39-92cb-4145-8321-8103aab4fe4e", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e321700b-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681203878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203878, "uuid": "e7fe68f7-dddd-49af-bc8a-bbb2f5a12559", "comment": "Malware payload (Loki)", "value": "24373ca3977c5b7a6a6946d41e92e663", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203878, "uuid": "2f61551b-d952-4c7b-8b68-a88fafb7dbc8", "comment": "Malware payload (Loki)", "value": "c8deccf878f3a069c62aa1c0ee01811b4c06ace8671d98e55c51c6727ebcee66", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203878, "uuid": "d9e254d6-4f89-484a-9dc1-70ecfb5cf279", "comment": "Malware payload (Loki)", "value": "1eca9207182580d3b9cde0848b139b4a63e0b966", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203878, "uuid": "2bad1cdc-6866-4eae-aafa-b0949e2f7517", "comment": "Malware payload (Loki)", "value": "9a6f925ca0bb85583106d37440a67b7f22e324be184efab78d6b62f78c25eea8611b7a1df49dbf600a7c7a590ff27e85", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203878, "uuid": "0f466f3a-e879-4600-bbd3-db50b86312e4", "value": "T1A5D26F5AE79E02758F5102B7271E0AC99ABDB23E735150B2786C933433ADC2D42766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203878, "uuid": "e2725975-a221-4e10-b46e-8602fee2b6d1", "value": "384:CQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZVCbLdFW8/v2XJhIqvlwm7yDKy:OFx0XaIsnPRIa4fwJMaZGxQpJNFt/v3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203878, "uuid": "1d53206d-d33c-47a6-90f5-a00444f9cf5a", "value": 30190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203878, "uuid": "08524b62-ab82-4256-bc8b-e122630139af", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203878, "uuid": "1bc8ece6-a8df-4d87-928d-d531e978c890", "value": "HSBC_REMITTANCE_ADVICE_000443356.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5bdbe2-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215277, "uuid": "f8965c27-b148-4ba7-a90d-a5d8e705bdfd", "comment": "Malware payload", "value": "692c5ea780ce6d745824502450b93d09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215277, "uuid": "e0f88b9a-e188-4a7f-9a85-67b7cf3d4d5d", "comment": "Malware payload", "value": "ca01e0dd3186cfc09c32567071e5e828b1c6bdf4569fbf1a61b00800ebf2819f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215277, "uuid": "339f96df-bc66-4111-af69-6f07058a604b", "comment": "Malware payload", "value": "d21642292f480135c347f1fa46787456b948276c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215277, "uuid": "c016430f-6dd7-4471-9a63-214fd7ed830a", "comment": "Malware payload", "value": "844b62308250252b4216fafb6522007f2ab31043817be19be973f12c10d573352880cf69c315ff9af5fe4aad9b156470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215277, "uuid": "c348916a-2cfc-41fa-9afa-84897915935f", "value": "T169663368333055D2DC223B7989524058A671BD1823F6E6A326D0AFB96F33E979D3D730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215277, "uuid": "a946999f-2ea2-46a7-9981-bca91ba1c089", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215277, "uuid": "1620683b-927c-4a86-a3c9-8dea310ef46d", "value": "196608:zYPaLXL9HLAlnipb7KX/Hd3e1BB6yLnlPzf+JiT4n3XWKsMQ:0PaLbxAlniYXPMBRLnlPSF3VvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215277, "uuid": "19a6e297-aa87-455c-b1a9-8dd1251b0b9d", "value": 6890560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215277, "uuid": "ed580539-5a4f-4256-b8aa-01a589ecc58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215277, "uuid": "3dd7e42f-62d3-43bb-91e0-119710556131", "value": "692c5ea780ce6d745824502450b93d09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2e6b45-d849-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1681204427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204427, "uuid": "c8d160fa-03e7-4fe8-bd1c-e0fe0c468e18", "comment": "Malware payload (SystemBC)", "value": "84499558c48c4fdebac20cab68253aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204427, "uuid": "5ee87006-df30-417b-a39c-e529e6427781", "comment": "Malware payload (SystemBC)", "value": "ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204427, "uuid": "cf4a67ad-2bf7-4c6f-ae6b-53b39a66ad1d", "comment": "Malware payload (SystemBC)", "value": "d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204427, "uuid": "4e454a30-3640-44b2-849a-aaefc889fd51", "comment": "Malware payload (SystemBC)", "value": "05794d35be60bd4603e14ca300b94fb33a8b73afbf60601b2fb6dd325318598d2cccf6c9f247966b1c3c06a45199c5f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204427, "uuid": "868049fa-aeda-4036-b64e-1a66fb403da3", "value": "T17D34BE50B7D1D467C2521932C825DFF46A3AFD82BC26AAC777647B0F6E311D0A1BA306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204427, "uuid": "704be669-dede-4516-b261-e96a1c6a114e", "value": "04021a7973cc9386d8ec65f9011a3f00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204427, "uuid": "3a122ec6-b711-4d4e-8f39-5638e06e4b25", "value": "3072:psLU9af5Y43YGpnzljr0E8aj8G9Ku+oukzuhWkiWBkOuRGK:GL2O3YGpnzlFBj59zukihIpjcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204427, "uuid": "2d068bd5-d8b5-4eab-99e6-06e2fda30ffa", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204427, "uuid": "9346ee81-6fe0-4696-8e57-82ae4cdb2698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204427, "uuid": "4b7419f9-cff1-495b-9d17-b038e0b7f464", "value": "84499558c48c4fdebac20cab68253aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaa152d-d800-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1681173128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173128, "uuid": "aef29c7c-3238-4b2a-8f5b-4a8e3467bf77", "comment": "Malware payload (CoinMiner)", "value": "5a9d88525f94bb4bc77c00c735a71e82", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173128, "uuid": "fb1b626a-4648-4c63-b4f1-da32d1ebe22e", "comment": "Malware payload (CoinMiner)", "value": "caa37459a6ca7ff93b0fe23ab6901aac04fcf85cf51203e7a7c67963c9854bc1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173128, "uuid": "cdfbee3a-1805-41f5-a344-9e6cb0154348", "comment": "Malware payload (CoinMiner)", "value": "ea39b5900e2c15b1f9416e75eeeb50aff82494bc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173128, "uuid": "48196079-c9dd-4a5a-922d-6ee05a96d6f4", "comment": "Malware payload (CoinMiner)", "value": "1e14aa2870d84e6b32b9cad8643c00c5e727ea716b91f3086618921c78d93e44b56203feaae2940d248d506dbdfd80eb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173128, "uuid": "66cfc9bd-b3c2-4f12-80e6-cfc2add559f2", "value": "T17DB51213E246DE9EE306C079D01BC171092F7C6DA01A8D2B25E1BE177EB1B97261EEC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173128, "uuid": "07be9a3e-d8b5-4d2b-a311-d5393486602e", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173128, "uuid": "c2e6de4b-eecd-4f9e-ba17-cae6e4785ebd", "value": "49152:WbDG1kCYmHley6zrSr1cPudk1VhWxsEPueWxYxeY+0teK4qRr:WbDGZj36zyc5hreWxEpzteKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173128, "uuid": "131355d8-a518-4fea-af00-dbb34b7ebf9a", "value": 2452248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173128, "uuid": "4b405fe8-95d0-41b4-8464-86b150aaf6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173128, "uuid": "7c6faa06-342f-4630-9c79-99334b0e9eb5", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff458d-d807-11ed-88f6-42010a9c006e", "comment": "Malware payload (Feodo)", "timestamp": 1681176370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176370, "uuid": "22e2425c-35a5-45e1-868d-59e1a4b3f873", "comment": "Malware payload (Feodo)", "value": "fb367e7c360735a58ac80fe625d9bf5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Feodo", "colour": "#0E0315", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176370, "uuid": "6fd5226a-25bc-435c-8bfc-c7511ec1a951", "comment": "Malware payload (Feodo)", "value": "cbe5f4afd18753839d7e47ee41e6a6c1a1d03e806a77ba7a585ac7b7cad92450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Feodo", "colour": "#0E0315", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176370, "uuid": "05522fe2-b8a3-44ed-9e9c-f914874230ae", "comment": "Malware payload (Feodo)", "value": "363cdfd737f6c5327a01ad1f77c4deb7ad12ced4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Feodo", "colour": "#0E0315", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681176370, "uuid": "c82a1cd4-5eaf-4651-bdae-924dc20124a3", "comment": "Malware payload (Feodo)", "value": "9836dba9eb10e85774a5761b44e02df0aeda3bbee9eeeb720e433519035bd9b85f5d5f5f61cf8306c6f9399db9b82e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Feodo", "colour": "#0E0315", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176370, "uuid": "1578f964-b6bc-413b-8f10-5171a3abf5fe", "value": "T12BD38C07FD814671DEAC2C3D56E95A3F463F9D0DA31549C39624ABA03C113F26AFA388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176370, "uuid": "311d6215-bcbd-4fba-aea3-d02e5d7aa9b9", "value": "a261eb054362802cb573314546e27440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176370, "uuid": "ac826e54-8af4-48e0-ab73-e92e86d5b267", "value": "1536:z5nX3jvOFfJfIG5N0AVRdAzDgToZCGMa10:NnX3jWFRS8wDgToZCGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681176370, "uuid": "8cd6256d-ea89-4f63-b8ef-828bde43658d", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681176370, "uuid": "218ded99-bc83-4a7c-93c2-c01daf664cbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681176370, "uuid": "f76de197-d470-484d-97c9-28dfa2334420", "value": "process.0x81e7bda0.0x3d0000.dmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf17950-d802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681174259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174259, "uuid": "1b7d6103-d1e5-4e6a-b949-219f9e9cdf20", "comment": "Malware payload (Vidar)", "value": "75189d86bf78ad51332c5e07fc2a7fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174259, "uuid": "fa82e997-04bb-44bc-8f74-65afbf221c57", "comment": "Malware payload (Vidar)", "value": "cc497e1245062037cfa1a5ab3d11ae10e04a7cc4fdb12fa13a7a4073ca81a444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174259, "uuid": "f21b6456-64f3-4db5-a989-12071b1853b9", "comment": "Malware payload (Vidar)", "value": "21d23050c8cd7d51c4f11abdf4752ebfa831b60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174259, "uuid": "c0f5bab7-27b1-45a2-8c39-05a7838a611e", "comment": "Malware payload (Vidar)", "value": "1603ae62e750ecbbb6b0065cd406355a8ac832b3c6b0d2c213269c2bb25889aba8886e6a7c26a88fb5dcb115d61fbdbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174259, "uuid": "57d7f39c-6825-4860-aa6c-4a6741379494", "value": "T1A664F122FAD1C0B2C47792B66934D9645BBF786187B1818B33E407AE1D703E1B7AB315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174259, "uuid": "7579fd42-4dd2-4fae-85c3-9c5ea9cfa4dd", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174259, "uuid": "07ea7b73-2238-4aae-a5af-f51287f447d6", "value": "6144:328sSL9qXNy2nn4yokjsJ0Stb9ZETitmsSJiuAeogK3v0gs:rHL9q82nHoUqzJmnJiuAbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174259, "uuid": "d686a4a9-c15d-428e-b05f-f120dc0121d6", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174259, "uuid": "0c9d6b36-66fc-47f3-8a05-0f59a599b40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174259, "uuid": "da626622-e8a0-4a26-bc57-fb2d718e3540", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40735fb-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681239044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239044, "uuid": "1b6e8795-f792-413a-b6e6-52cba60fbafb", "comment": "Malware payload (GCleaner)", "value": "f21efcb5c2715aafd457478084db045f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239044, "uuid": "095d265c-e79d-4082-b459-03ba7f641472", "comment": "Malware payload (GCleaner)", "value": "cc68d405191b4c0ab00b08fd6d113e8868d62a00dc0a885210009d23785969cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239044, "uuid": "7bd3aab2-f2a8-4d2a-87bb-75a49f778d1f", "comment": "Malware payload (GCleaner)", "value": "b0fb21af51ebff998642d30c1f6e02fce570d61a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239044, "uuid": "346d6299-0230-40aa-90a5-97f68943a80d", "comment": "Malware payload (GCleaner)", "value": "c67f7176784b214c7daa3e92935cde0d01db813be2eecf399874bccb1ea940702d2aa728355297093c5663f210cda096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239044, "uuid": "78a3585d-54e5-4fc0-97ad-80f8ccfe3fa2", "value": "T15E44F132BC904833D9AA25344873AF6519BF7D226235464B77F823AD5F223D15A323DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239044, "uuid": "654673f8-be1f-487e-b763-8e81cac824c5", "value": "94b862c07f0e4212c3fe2a5391e2e04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239044, "uuid": "0c0b63d8-03c8-4248-b34f-187ced79784e", "value": "6144:gpThQkai/QNQSiDPf3YqB6RQu9OjYgn1Skhg7yESVESB:gpThQkai/QNQSirf3vByQuexnNtV7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239044, "uuid": "138378d3-fa0a-41bf-b2e5-ca0aabe0246f", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239044, "uuid": "a395fd91-ec3f-4184-8dd0-e9732e09b6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239044, "uuid": "456a8722-c2d2-4e7e-8778-ae7894dc8a06", "value": "f21efcb5c2715aafd457478084db045f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3228be9f-d889-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681231928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231928, "uuid": "5b6da07f-f7af-4ebd-8980-8c3c624625e3", "comment": "Malware payload (Quakbot)", "value": "b8e4fe394ddbd64b2ddc4023e4cba708", "object_relation": "md5", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231928, "uuid": "9c990222-3101-4a81-a3d2-35cf756d3ac3", "comment": "Malware payload (Quakbot)", "value": "cd36d482a2c8e8cc753d57ef4b4ea7b9574ca457a443652d8d82da3d93402323", "object_relation": "sha256", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231928, "uuid": "a6315e65-64d2-4d98-a9fd-f57398a562c4", "comment": "Malware payload (Quakbot)", "value": "491eb31684d263de03eedb67f37cbf0c4e92fcc8", "object_relation": "sha1", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231928, "uuid": "08fdcb16-4201-4b5b-aff4-f3a752c51046", "comment": "Malware payload (Quakbot)", "value": "39b2700e98e50d3ff56c8b7df407a9814753e4f8c0f85229106b2f9a92f659511810d0c634ee443ecc9da540b53c3bb6", "object_relation": "sha3-384", "Tag": [ { "name": "obama250", "colour": "#E5FA6A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231928, "uuid": "e7815138-d276-470f-b344-df2fe42172d7", "value": "T18993E0D8827659D8D0424AF8FB4F45B200CFA1F25A11184B3D2CCDDB5742E87F576BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231928, "uuid": "78a80459-5b2b-4b33-a489-8bc25c784c07", "value": "1536:S99mEYrvrlOr3aCF4lOVPipU04FIEXuvgOOgQJ8DX0bo+kcZ23gAbvgM6Ktaoqkm:wkxOrLFDVPiC0423w8DX0rkD1gHkhBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231928, "uuid": "ea0ffe0f-ad75-4693-bcae-e63db5277c6d", "value": 92930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231928, "uuid": "191f4156-2d90-4525-8565-4df16ef17dc8", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231928, "uuid": "3e3702aa-aec5-43ce-b5de-0475e30eb3bd", "value": "ComplaintApril_1337.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a7c636-d855-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681209553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209553, "uuid": "0d4beb02-cf3e-4d84-8f2d-80e0de1b5eac", "comment": "Malware payload (Formbook)", "value": "a85155175a1de3305c196cb18c0233b3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209553, "uuid": "cc689a05-9596-4dc2-9795-bd8e19441098", "comment": "Malware payload (Formbook)", "value": "cd908ce476ae54b7b022ca183a9d57aa60f9485c2eeb8f4a3f10b65d0381a959", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209553, "uuid": "f52861a7-3578-4bbb-9c4e-bb471be871bb", "comment": "Malware payload (Formbook)", "value": "d96c5ed8c7ed7716806c81c3c5f5fc51e603fce3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209553, "uuid": "d9911fe5-7c11-438e-970b-d69bc056381d", "comment": "Malware payload (Formbook)", "value": "a8ba179eeb19cc5d50c2eebdf31f74bd2c60062c6985edd119960baef27bfebac40dc98b6eeb336781f1a20a992a2bee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209553, "uuid": "e9b8297e-9957-44d9-a285-826183f81acb", "value": "T10AC4235B81E8B39D4C149ED01E4C8939D8F191A2B76CFAFDCBAE0605A41C9EFF0B5815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209553, "uuid": "4784be1b-df34-4a2a-9db8-b427a9049a85", "value": "12288:NoZE8OPV9VtH45ezBJcgoHpFEqj94qDxPDlJM/H/jF:iZTSV9Pied/owM9ZJ7M/LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209553, "uuid": "a18e1728-f6a5-43ad-bf87-d69c4c345b15", "value": 552205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209553, "uuid": "77091b6c-e721-419d-95b7-0118c3cfd064", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209553, "uuid": "e1c3fbf1-bd3f-472d-8452-28d71117102d", "value": "\u10e8\u10de\u10e1 \u10d0\u10dc\u10d0\u10d2\u10d8 -\u10e8\u10d4\u10d9\u10d5\u10d4\u10d7\u10d0 \u10dd\u10d1\u10d8\u10d4\u10e5\u10e2\u10d6\u10d4 -\u10d7\u10d5\u10d0\u10da\u10ed\u10e0\u10d4\u10da\u10d8\u10eb\u10d8\u10e1 6 -PO-0117 #22091403.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2d66b2-d87b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681226119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226119, "uuid": "f38cfa18-3742-45c1-a224-deef929941fd", "comment": "Malware payload (Amadey)", "value": "c0820244f7808dbfdf66b323dfd00bf5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226119, "uuid": "f5cd1477-ba8a-4395-b22c-e71f47c75be4", "comment": "Malware payload (Amadey)", "value": "cf5268afb4431e7f2b589eba000c1ce59797fd02566032f57770fe3e1d56d5ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226119, "uuid": "65a3bbce-faab-4dbd-b4c0-c0d35f6cea16", "comment": "Malware payload (Amadey)", "value": "e0bb966906a56fe4ed9386b6d7c2ef16e1f47354", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681226119, "uuid": "52d661ae-e8be-4b1f-90da-515e87b55a79", "comment": "Malware payload (Amadey)", "value": "f6f0aa5ec41761b6ace2edbd8f813db5cba4d9d178c10aa6955bce28a55e1cd10000542a14ef5377568f7507a23d89f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226119, "uuid": "119c2fbd-f5ca-4dec-9d8a-02c52d24fabf", "value": "T100252343B7E40472E8756B7400FF17971B367DE25934061F2B5AA8AA0D33AC4983A32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226119, "uuid": "01caf885-491b-4cfb-9092-d1b469e25178", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226119, "uuid": "c7be2122-77e2-4da3-ab0d-231c2f2e856e", "value": "24576:kySr8FL5QdaCnWN89cGjCNIqm4bnLkhtHWFHju:zSre5QdLnWNOcGUk4bnotHWFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681226119, "uuid": "6136b065-695d-47f8-adc6-6933bf32e034", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681226119, "uuid": "989bde32-055b-4dd0-8ed7-38e7ee92ef84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681226119, "uuid": "af770218-bba2-41cc-80e2-155fbc34423d", "value": "c0820244f7808dbfdf66b323dfd00bf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085f8b96-d885-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681230140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230140, "uuid": "e00c5788-c369-4401-828f-cba6f4c44784", "comment": "Malware payload", "value": "9fd40b68825eb9aa79d9f2b106aaf59e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230140, "uuid": "b8952b08-804b-4e24-b6d5-1456827c32b6", "comment": "Malware payload", "value": "d0998b3d87f5f507fad02668e07f1e428b860fbb8945a902705cd231d4d185da", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230140, "uuid": "a78bea57-29ee-4123-b99a-e2178f22120e", "comment": "Malware payload", "value": "9b30c9ed81fea0f414a7cb9f1496616a35339f18", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681230140, "uuid": "68ca332d-392a-4944-a34e-33731ed681b0", "comment": "Malware payload", "value": "231922f5c91f5a915af253dd0dfb1fbb98975931ea9a582af3946cd8646b9c1d5cb68bf383364dfd7f9847bdc6b9140c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230140, "uuid": "d2b2d50d-cf98-4f75-9c15-5272c1e72ae1", "value": "T167453353E998604FC7BE3B3AC6276A2F8A9DC81312D55E7258ECD138FD171C16489ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230140, "uuid": "26418b0c-c3fd-4820-8f93-133f436a30d7", "value": "24576:pG0N8krrfvzU+YG0Uqw1bxbM435Qy3koCVs+BKDT0Dv94ncEjI:p/NJ/9YG0Uqol/z3ktVPKDAD14cEjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681230140, "uuid": "3323b369-c16b-4c96-8b21-8bf0b37c6667", "value": 1185863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681230140, "uuid": "5ad25c90-b6a6-4577-bb2c-25a89c432739", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681230140, "uuid": "85321884-5f14-4a6a-b6ac-abd3fb679a2b", "value": "d0998b3d87f5f507fad02668e07f1e428b860fbb8945a902705cd231d4d185da.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c64a716-d863-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681215651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215651, "uuid": "597652ff-7db7-4cfc-b334-402c1dec67d6", "comment": "Malware payload (Smoke Loader)", "value": "c452ca86033a0e3b08a790ce12e66d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215651, "uuid": "e0c70daf-cf35-4f10-9ee2-383823c19081", "comment": "Malware payload (Smoke Loader)", "value": "d0a86383e80d1c157e784f3162c9f9e1f73e18fbc65ac84785112126eceac46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215651, "uuid": "0d61365a-2c90-4fb2-a778-78c13767b761", "comment": "Malware payload (Smoke Loader)", "value": "a237fcb0d4825fe3d2496507627aea7035472547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215651, "uuid": "b080b7a0-6f5d-4259-a886-2361bfdd22cf", "comment": "Malware payload (Smoke Loader)", "value": "e2768604a2c9f2ada9cf029b671b3d1f6f9cc56111575d23c391061b58a604371ea885ce8b0ce58847a41041e54f9d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215651, "uuid": "a02c7703-3487-4444-acf0-480280421d7a", "value": "T14514D021BEE2C0B3D86B45744470EAB0AA7E7C6257654587276B5B7E1F303C18B2A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215651, "uuid": "96ece151-d169-403f-8921-790112d94316", "value": "4fa2892726d47130d81fc5e57831d465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215651, "uuid": "b5ad1534-7624-4ce1-b04f-5a834d69ca94", "value": "3072:iZa19U41FW32FEzT9vzQxEr9MFGg29Q485pqFIq:8OjzW3e0T9bQOr9MD4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215651, "uuid": "f3afa7b1-1612-4be3-96f3-ab026699619b", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215651, "uuid": "7c7df0dd-3bdc-4d5d-84e1-0d0dc70963ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215651, "uuid": "b0dcd02c-7851-4f8f-a8d0-7286ed7c242c", "value": "c452ca86033a0e3b08a790ce12e66d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865f420b-d826-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1681189549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189549, "uuid": "7bc8b892-f72f-4efa-9c23-aedc84f47509", "comment": "Malware payload (Tofsee)", "value": "c0e61d01289f3a5a54e54f53f05e669e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189549, "uuid": "64270f1c-b3f6-4b2b-91fc-a4d816bd3ebb", "comment": "Malware payload (Tofsee)", "value": "d0db1c583a923cc68693c9299997c8fe784295017d7d6e01a12dd8818bdf1ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189549, "uuid": "b22161fd-4313-48de-bd4c-cfcdd9308456", "comment": "Malware payload (Tofsee)", "value": "086df3e7728832745a0179c6a3368caddc6a5820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189549, "uuid": "81a80c2d-ff0d-401f-ae34-b840301af14a", "comment": "Malware payload (Tofsee)", "value": "9e61cc9ad32fdc6231a01965fbe59dcee34502cbcfe27dc65312378676e95762ffa7619ec3f99d4d4f56859a5dd91a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189549, "uuid": "b4353d02-138e-4b74-bd63-b62151404f67", "value": "T17414C021FAE3C073D99B84770460DAA4EE7EBC62F762C55B636817AA5D303C1467A313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189549, "uuid": "6b5cc077-2d7a-4812-80e4-e869c586875a", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189549, "uuid": "f96f83e6-c569-4144-a263-fbcdd3bdcf98", "value": "3072:4w28CrrrZi8q+8Wxmftll6Y1Fj1Iy0b/cUNvA9Nmi2hgSp:b28Ada90mftl0Y1HkUSAKRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681189549, "uuid": "9f3f5c33-4d58-407a-b26f-d2d481db18b3", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681189549, "uuid": "02310e57-cd50-401c-b88c-26ce77a05b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189549, "uuid": "04ca0de4-9876-4a7f-a244-72e615d6105a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa31ed8c-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1681203917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203917, "uuid": "a5cc9a6f-8839-40ad-92cd-832631356884", "comment": "Malware payload (AZORult)", "value": "b1517b1373f31cdb43777ea56f5a52d0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203917, "uuid": "483dae5e-d4e3-45e8-a782-126e5c33ae06", "comment": "Malware payload (AZORult)", "value": "d141daa3182e623f38cf2e26a9c9565db9ef7bb76b6c5f295815aa60e81cb727", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203917, "uuid": "f22505d2-d3df-4054-bee4-d34393ea3798", "comment": "Malware payload (AZORult)", "value": "00a7f0a4ef3ad21659d8abb19104ba05963ec559", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203917, "uuid": "def74777-1259-40f7-8169-3c43e7cdd392", "comment": "Malware payload (AZORult)", "value": "3479334d4151dff76a31adc718e89f26c2b3db56dc934d647e9f7d445f676c437a6f10997a235baacd9bf204c3369d8f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203917, "uuid": "53921485-99d1-4947-8cbc-6d08fc940eb3", "value": "T12414D032BAE0D076D66BC6314470DA602DBFBC615765859F23A447AF2E303D14B7B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203917, "uuid": "fb5ac8cf-a47c-4385-a426-7dcc2cbb01f0", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203917, "uuid": "33aaf912-095e-4cc9-aa43-def426330b58", "value": "3072:i15cV/nvOxDYXQh9bywfY9oej0elPedQ1zlfR8QlpiMjFU:w8GxsXKb/AKiG0zP8STG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203917, "uuid": "42153c98-221b-4c6a-a6e7-c4e83138e15e", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203917, "uuid": "9361964a-bd4f-4eef-9c04-26893ca1cdd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203917, "uuid": "35cf54b6-8c7a-4f83-8be5-ca016bd55d86", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71eadcb8-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681204117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204117, "uuid": "4250e2bb-0988-4f38-b14a-7ff1d37935c4", "comment": "Malware payload (AsyncRAT)", "value": "5f83c5aba3cf9c14bdb1c379ec09bfd5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204117, "uuid": "77fc16cf-7826-4f28-a856-606f2049769d", "comment": "Malware payload (AsyncRAT)", "value": "d18da0b1f7b0bf45b6ef60315797eb8f9861badc405a2e9a5a7a2f9ba85f8378", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204117, "uuid": "44ac6aec-7bf5-45b2-89fb-fb44570523ee", "comment": "Malware payload (AsyncRAT)", "value": "574c34b1918487d3d9bb470b6af659d9636806d2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204117, "uuid": "b520529a-6ddc-44e4-90de-ff26b6b514b2", "comment": "Malware payload (AsyncRAT)", "value": "fb8fdaac44e4547aa65440e9de341f7eb72627ab1be793fb2f22b8184b4c8e7e3b48d0339a289ac545beb95e38a05b37", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204117, "uuid": "8909e9e7-0b04-4f93-81da-834ec73ef846", "value": "T164E3BE6132D5C865C94607714CD3C2E62623FC52AFB74B8B3349F76E6E73AD08E42652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204117, "uuid": "086547b4-dafa-4843-8093-5eeaf504391e", "value": "3072:9ixEtjPOtioVjDGUU1qfDlaGGx+cL2QnAMesrbcZ+Wg26iQsG44FPUWDAetRydaC:YxEtjPOtioVjDGUU1qfDlavx+W2QnALR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204117, "uuid": "7983c0ba-ce63-4499-b8eb-444680307a91", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204117, "uuid": "d706dc33-9464-4bb1-a41a-5cacca1a8855", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204117, "uuid": "2cbfb94e-749d-4137-b812-73a725411abe", "value": "Odeme.makbuzu.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90ba409-d802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681174145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174145, "uuid": "87185d3c-3035-4801-9aeb-eac4f89cc635", "comment": "Malware payload (Smoke Loader)", "value": "3e7a00bfcdb32f0e0a9fa8333010c072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174145, "uuid": "31230c4c-b69e-45c3-b4e1-f6b9517c7057", "comment": "Malware payload (Smoke Loader)", "value": "d18f88870c1e1a3290812addf8e5c07387c83f89a0ca3746f5c7cf8730a92b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174145, "uuid": "e9994959-0991-4b70-9777-026d9c1822f3", "comment": "Malware payload (Smoke Loader)", "value": "9798898415c956f895c7191be6cd72b240ed6a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174145, "uuid": "d1fad566-fddd-45f5-8be8-405bc2f5a634", "comment": "Malware payload (Smoke Loader)", "value": "d1e5e09b704bc3d6849901b259da0ee468c02a93dab72687e325c8ef0e4655489f7db1308fdc5a63dfed4427a6cb976e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174145, "uuid": "29a9cd6d-2fcf-4b9d-aa3d-8dd15b2014bd", "value": "T1CD14D021BEE2C0F2C41B85711511DBA4AABE7C729765815BE32457FF0EB07904BFA352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174145, "uuid": "c5714452-eefa-41bb-b200-3384cce5f93d", "value": "407cedf3cd305e74ebcf3ed2bbc4e3b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174145, "uuid": "cc4ccead-c82c-4221-ac4f-6773d1a3acf7", "value": "3072:aiNv28a51DEQNOmbgnCHH5Mpw3oQWn0zl3OVyL5Yuk9PhOwh4wiXZl:Zl28OtOWgeZ4QSQ+VwYukFnhkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174145, "uuid": "78bdb9ef-2737-497b-9390-855344240abe", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174145, "uuid": "9afe1ee0-3b49-4be7-8c26-e652778c61cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174145, "uuid": "a3c7883e-5528-49ed-9601-3334043d3c85", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f5ec95-d836-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681196237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196237, "uuid": "26cd625d-390d-450f-8e5c-10148dcc1c2f", "comment": "Malware payload (Formbook)", "value": "0194af619171321c437e2451ad09c60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196237, "uuid": "fc01ab2e-5840-4fb4-b654-88adfca5b3ab", "comment": "Malware payload (Formbook)", "value": "d1d12bba5e07ac4c4a896d6a15dd2e5cef59d70dfb0d2aeb61d51b0de5838213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196237, "uuid": "188f7515-8e2b-4b9b-b887-99a4c5980807", "comment": "Malware payload (Formbook)", "value": "4f2041ebda93cb0044902f097d0d769004712b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196237, "uuid": "8df89996-a09e-4442-ab3b-3cc1f1ba92c3", "comment": "Malware payload (Formbook)", "value": "7af6a7bfb656b9063143e9ac14b8610ceba21364a4f7c5e1ff5ae9e23f3bcc5e82e6cccdb64c212a5bb44b4edc88548f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196237, "uuid": "ffefa683-23e0-4cff-b22d-166a5173ed3a", "value": "T12C44124463A0C57BD9631332087A59BBDFFEB6271929D74B33A04A1CBA552C2E90F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196237, "uuid": "9ea7f4a9-d75f-42da-8de1-5e297a7aa956", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196237, "uuid": "4256b556-bdb6-4429-83ef-d62d0d22de56", "value": "6144:/Ya6luTzIBhY0jaBV61lgUk4AKg+tw6oX1NFo4z:/YvyUvaB0NASc1NFo4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196237, "uuid": "7dce7794-ead9-4ef0-932f-d080d901fdae", "value": 268856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196237, "uuid": "a80acb04-a475-4ede-93bb-1598e04e226f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196237, "uuid": "8100f56c-3ab7-41ce-be4a-e2ee0e8d7f03", "value": "_202307031117365.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122e41c7-d854-11ed-88f6-42010a9c006e", "comment": "Malware payload (jRAT)", "timestamp": 1681209111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209111, "uuid": "42891de8-232d-48d1-85a7-a6d7111c690e", "comment": "Malware payload (jRAT)", "value": "17d2b4e40a2c1eb2fa54d0afc2e4ce7b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209111, "uuid": "10bdee04-210a-4b35-ba76-b1b325b706d7", "comment": "Malware payload (jRAT)", "value": "d33c4c092829064d99d09e08c4e6af12478bac638d1224b85c2113b00af7f95d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209111, "uuid": "a88cc7fc-6b59-4093-aeec-c9373c2e87cb", "comment": "Malware payload (jRAT)", "value": "dea7cd05f2fe0f31f6201c6fe50f3e3436e7a7d4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209111, "uuid": "65013950-6702-42d0-854e-c6c570763091", "comment": "Malware payload (jRAT)", "value": "c887d9ff3d9e44e44f7a15f5ebae1e22ffd8be6225b214272797a0a0a26c12be359f6fed9a7c82f82ec989b872a9fb7f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209111, "uuid": "183790b9-8ab5-489e-9893-65eaf0122dcc", "value": "T141F4022BFFCCD5EEF713413003A2C0226924558AF892E6675A50BA9E9C74D44079BFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209111, "uuid": "4ffb338c-e85d-4a4a-a932-626dc800aaff", "value": "12288:URvrLJvZLl+YBVeUYz4rVSmp/vgD7P1BqBVcSpVQ9tah5rae36fY2dL765G:ELJvZHBVelc9dvIP1+VcP9t0L3kY2dLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209111, "uuid": "4cb8ae0e-527f-4543-bc83-9587133c5fbd", "value": 760232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209111, "uuid": "25aed599-9f8e-4d0a-a078-9743c82bc5ed", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209111, "uuid": "32c07466-7a77-4c93-8bca-4ab6072839a3", "value": "factura000000000000.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669ed599-d86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681220419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220419, "uuid": "c784b072-1cc4-4cc6-b1c8-fc96db729cc5", "comment": "Malware payload (Amadey)", "value": "a6556102be26ec56bf655968cf36642e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220419, "uuid": "8ef2eb25-ea00-4177-a96c-66ed1796bdce", "comment": "Malware payload (Amadey)", "value": "d44e307abf7bafc4405038757e812dba7ecc73551db0d24b62a74c87e07c5293", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220419, "uuid": "633a14c1-8bfc-4203-8038-fce5ec5c9163", "comment": "Malware payload (Amadey)", "value": "1d81673984d471a4810c9ded44702efe63731a04", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220419, "uuid": "18a7dbf1-3953-4fae-98df-f732b96a8df3", "comment": "Malware payload (Amadey)", "value": "11cf6d7bf4e0e4c83019b2e1381b48a70c1e4b15fffe674770ce31f0f420cce409db00f556b2bc3942517e07d896f7c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220419, "uuid": "762b8e7d-9595-4136-bdf8-5e3930659284", "value": "T1E3352346B7D680B2CCB2277058BE21931636BCF19AA8577F3B55988B1D736C46C3132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220419, "uuid": "1c22b0e2-eeae-4d7b-a528-42fcab92ea98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220419, "uuid": "b08e6cfc-cb05-4904-9e27-df2f7c8e2fcd", "value": "24576:Hyz+EuhwmBPeyDI1/YPG40Y1H6AbpLk7dMBuYkTngoezlk:Sz+ENml5MVY3oAbpQdMnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681220419, "uuid": "af9812b5-e632-4a22-abca-bba49cbd4245", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681220419, "uuid": "76147142-5537-47ac-8625-b451f7717eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220419, "uuid": "f51394a1-9b42-4dbf-8b6f-4e91e77d717b", "value": "a6556102be26ec56bf655968cf36642e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cd2e7c-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218786, "uuid": "6b23bef9-e2f1-4b0c-8b67-85ba4f95096f", "comment": "Malware payload (SnakeKeylogger)", "value": "dad3ad7520f3b97bc4649824ac440b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218786, "uuid": "7e7f4050-50cd-4724-8094-9c12b3d51333", "comment": "Malware payload (SnakeKeylogger)", "value": "d516e4901dd234c9dadef6a593e04c85c00e83d092490d7a7398339d79c4b727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218786, "uuid": "0dbbd565-5d74-490e-84d7-17a1e3eea92f", "comment": "Malware payload (SnakeKeylogger)", "value": "07733a041aff2fecf1a185fd29d394a1743df7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218786, "uuid": "75ac4c96-3d70-4113-abca-12746469d806", "comment": "Malware payload (SnakeKeylogger)", "value": "4615d792b6ba947779d31eebdfd9f97bdab5c9d74d8cf0420d3e73b4dfe8dd4c68b123b200acc7b46b3914efb50fdaa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218786, "uuid": "9fce79e4-bca3-4f03-9910-00c20d687071", "value": "T13AB4016E17B5DB61E59C0FB414846885237CB255B064DDAC8CD323F78AB3FA210897EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218786, "uuid": "520b944b-dda9-4958-973a-7375808463d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218786, "uuid": "a3ab999e-4530-4c1c-8a0e-bc4a5af8546c", "value": "12288:0NEpaRGptmZ2p17AirmO/CZ4zAEI4Dr2+Kn:qsaUpB17d/y4Iir2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218786, "uuid": "48afd87b-324a-479b-a19c-6739aeabb1ed", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218786, "uuid": "f7ae434a-25b6-4df0-a18d-68068d211587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218786, "uuid": "a004626e-0cc7-4459-8a99-6253621ede31", "value": "AWB & Shipping Documents.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b873d7a3-d82e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681193069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193069, "uuid": "6ebc3997-203b-49e9-a853-cf63f6a51f87", "comment": "Malware payload (AgentTesla)", "value": "d40ac12a50ae7cab951c808c3bca869e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193069, "uuid": "5f27fe98-9746-41b7-90a4-4a4a08aa88ff", "comment": "Malware payload (AgentTesla)", "value": "d538a85c02623761ca0db6c48607202b30dfb20389182704900c778f6dc32b35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193069, "uuid": "7ca4bf19-1322-41b4-9086-5d0b184ddf87", "comment": "Malware payload (AgentTesla)", "value": "1e30c273b7fd7773cf8ce1361f5b138d848b46bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193069, "uuid": "a2ffa803-58c6-4425-9de3-78f8643fbe85", "comment": "Malware payload (AgentTesla)", "value": "7168c2d950026bbac913fd10c4982d9375238983575fc415594dbc306b9a7e71c554a29c98a3481ad75d24bdd0c30342", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193069, "uuid": "1d0e6b1c-b87c-4810-b6d9-ee2e3c850be3", "value": "T161057B2D2D8F5662D278A771C6E24020B3EE9053771BFA1B69D222D10F02BD6FC8D95D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193069, "uuid": "30a0d4e2-e10e-4b0a-8e7d-6fa5826b3403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193069, "uuid": "7ea438aa-da52-4c0a-adf4-a6b03379539a", "value": "24576:zY0Bw8Qin3TrgMM7GI6LrYvh5VOE/LdhyKZTjSHjROyO4s9v7GwZaU3:zGC0vCw4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193069, "uuid": "d3ea061e-b79c-4032-aaee-19642f0b65ed", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193069, "uuid": "dd39b792-1fba-4c8b-b97a-2ced238187a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193069, "uuid": "7b71f098-82e9-4fc0-9974-7b02052ac49b", "value": "SHIPPING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dfc6eb-d86d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681219819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681219819, "uuid": "735decec-51f9-4f8b-9396-f09dbef0e399", "comment": "Malware payload (AsyncRAT)", "value": "ff8cf4e39cf12b67fdb346ec56af1666", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681219819, "uuid": "3cb888d8-5550-42f1-8a01-7913fe36e590", "comment": "Malware payload (AsyncRAT)", "value": "d671e5813c1b003f20afde800839130d64eeea16507c2ee9fd7da8d61a272e08", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681219819, "uuid": "08191b32-8018-4e23-aeda-17b42320feba", "comment": "Malware payload (AsyncRAT)", "value": "5fea254c97819332b6a99a27c9fec33ba546ace5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681219819, "uuid": "7e982587-7fa4-41fb-9308-fe4111083da8", "comment": "Malware payload (AsyncRAT)", "value": "f97b8fe780ef062d3503f3dff46678f076ed749f9c3b7baac7eb20184134416c81060588b943ca5c1800e2d6a7203de6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681219819, "uuid": "01133e10-507b-4279-a724-a152fbd33c0d", "value": "T145245B9C765072DFC82BC876CAA82C64EA6074BB431FD207A05716AD9E4DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681219819, "uuid": "4affef73-4f42-42f5-bd7d-bbbf43889970", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681219819, "uuid": "97825fb5-af6c-4c0e-b6de-3e7dde8c8d32", "value": "6144:iBu1KB/vBIPq9GiVo+VmHtZE0z257KL/gC3c+lKrcDbI:0gK5GfRqmHy57w/gC3c+lKrcDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681219819, "uuid": "182a1ebe-17fe-4110-82eb-b1c8f935ef29", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681219819, "uuid": "daf1a621-733c-4284-8a1e-d923775e5337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681219819, "uuid": "c258bd6a-ea45-43ba-85e5-6a5fc64fc610", "value": "ff8cf4e39cf12b67fdb346ec56af1666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b4abed-d830-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681193997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193997, "uuid": "fece44cd-4be8-4e47-b8c1-5972068de2e3", "comment": "Malware payload (Smoke Loader)", "value": "a0e0f78ec3cb72fb11441a32c0c2ea1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193997, "uuid": "5ef46301-d8c4-4a55-87ac-fcb5a838fff1", "comment": "Malware payload (Smoke Loader)", "value": "d6b20c60a8b3bf78ef58ac893a1c10a5707419d4235cf2366bb9789642d2c18f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193997, "uuid": "970fc018-c294-4371-a060-ccd0d69ac982", "comment": "Malware payload (Smoke Loader)", "value": "bbe09d9da5f90ea15add8abae1ad84f6a484124e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193997, "uuid": "77c936ef-0e32-4327-9d6e-80ef9655dbb5", "comment": "Malware payload (Smoke Loader)", "value": "9b8e448c04217e66084f69ee07f76a6f1f4795115e293015d0f68c604f36cf54de0b9082a3c805261a928292b462be31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193997, "uuid": "f7265156-3a13-4874-9329-d0b0e86354b4", "value": "T16214CF32BBE1CCB2D5AB81710561DAA1FBAE7821539085DF239477BB2E307E14736316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193997, "uuid": "1b53ab03-c721-4326-952f-532c2299a6da", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193997, "uuid": "6bf98892-8102-4660-b690-c805bfcdeba3", "value": "3072:picB1oKaOJGE+28gSPy3lliyyjG/ONFvOlCwhdU2tfRVonMeC:QE59JPWXePyedJnWMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193997, "uuid": "2679a21b-7352-4b3b-86a7-f78cae54323c", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193997, "uuid": "9712d4bc-0cae-4142-ab9c-e56924241e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193997, "uuid": "2ab3fb9e-5402-4191-bc7c-6b4219e80910", "value": "a0e0f78ec3cb72fb11441a32c0c2ea1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c15006-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231737, "uuid": "dbd42c32-27b8-422f-86c8-36c1c3e61869", "comment": "Malware payload (Mirai)", "value": "2b48462fb86f1c36e8b43534b063bad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231737, "uuid": "1262bedc-7d53-4b81-8007-19d3744d9321", "comment": "Malware payload (Mirai)", "value": "d8efebaf96f7dcfa27cd89842c9f949bceb3b0933ec91687de0732e93d35611f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231737, "uuid": "d58cc638-eeb8-4b13-b74c-e5cfb34e069f", "comment": "Malware payload (Mirai)", "value": "538da193213444e98bfcfbda4e6104d7d508e8cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231737, "uuid": "b2586db3-e6bc-415d-b63f-f71d15914d46", "comment": "Malware payload (Mirai)", "value": "7f7c52e859924d2fa01661772e697dada6492039c7d74defc8d641536d0c788d61a557eb5e64c3ee13f097b95eec7474", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231737, "uuid": "1438d0e0-0514-477d-9bfd-704c79d5ea6d", "value": "T17DB2E1B1E1863E62D770213EB97CC60157BB56F8A0FA72712524B7AC4BD2C4B64B414F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231737, "uuid": "0a75c58c-4d0b-4fab-987b-11710f1f5a9d", "value": "384:GZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvd9lKhymdGUop5hK2:JX1De9kONQG5xD+jHMDzuHKs3UozY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231737, "uuid": "04d12990-1421-4a83-834b-afa97cf3995a", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231737, "uuid": "470585e8-6eb4-48bf-b28c-84587aeeecee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231737, "uuid": "3a518dbf-e050-467a-b548-ecac6867c564", "value": "2b48462fb86f1c36e8b43534b063bad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88373566-d800-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681173231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173231, "uuid": "7e6b7e5b-8a53-4e29-beae-3374b978b016", "comment": "Malware payload (Amadey)", "value": "e6bc697864a5ff306af52463cc9b26e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173231, "uuid": "ac72bbe9-635c-4767-a0f3-8c92de202fbb", "comment": "Malware payload (Amadey)", "value": "d9196919ac692942d5188b30b150be23726eb32338e3da97e1555d2cd6f03b74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173231, "uuid": "d4be9efc-d579-4d54-aceb-6f21c08249e0", "comment": "Malware payload (Amadey)", "value": "f9284ec6f073c86e7ccbbc40df9b8ed589799cfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173231, "uuid": "e5725030-c420-4b55-829f-990f5340a384", "comment": "Malware payload (Amadey)", "value": "640ce64f64ec505008867fb24d604614c17282f43d99f542ebedf6644b9ffec865656761555a1c4aab756fcef75bfbf9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173231, "uuid": "9eeaa0f7-3c22-4169-a5e4-c98ab57d6977", "value": "T1A3352313F2F59172D8F523B028F612C31E32BC6249A0576B335A691A4DB2AD4B973737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173231, "uuid": "81e764eb-e06e-4f2d-a68f-4abc679e7180", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173231, "uuid": "08241da6-d7e6-4fa0-92e3-d5ea14e24e1c", "value": "24576:myvkDEKP54LnzkgpaBIANi8oAqsguMgpLBNz1i1xnNVAC:1vkIKP52zlaLNmNAjI1xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173231, "uuid": "cea603c9-eb1d-4bb9-bdf3-3719e34c7fba", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173231, "uuid": "47f5370a-3794-4c69-adb6-d4eb6f8bb9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173231, "uuid": "41ca83fc-59d7-4261-aafc-b0f6b9bb74e1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08139e18-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681215107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215107, "uuid": "d4526f8a-fe61-49d0-ac51-0d39e3639c0d", "comment": "Malware payload (Smoke Loader)", "value": "69b2a51fcfa50b92de264466862bbb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215107, "uuid": "346e4ee8-fafd-4a07-868d-29748ff1fd86", "comment": "Malware payload (Smoke Loader)", "value": "da95fd5848206d47eb74bfd966788c68190b6b8c15fe43a8a5d8408133f696ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215107, "uuid": "2edd39fa-faf1-4a3a-818c-bd5ee627ed62", "comment": "Malware payload (Smoke Loader)", "value": "2b4206863fb19330610853fa38a5c3592b4d73e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215107, "uuid": "11fd6b5a-950b-46ef-9f7c-c87490fccdea", "comment": "Malware payload (Smoke Loader)", "value": "75af17de0d6763a510ef2f48f047f1f87f15ae0df873d8661b1c484af8131879a421e3f07f2c130599b770537de8b906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215107, "uuid": "f88eae47-0ab8-4fab-a8ee-5a3ee70126ab", "value": "T19F14D0317EF2C0B3D2AB85705431EA60AABFB8611751868F376853BE1E303A1476B756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215107, "uuid": "1cde7a04-85d3-4151-b216-4f6c3bdea0d0", "value": "62e4c80108c1e602fb1ed5c87f0b3460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215107, "uuid": "4146b830-2b72-4b16-ac92-9fdf627962af", "value": "3072:mhcDpUBO4t8usyWZvPxrB85FbzrKE6Bqza4NfRNLk0eG:a7M4tbTqvPz4bzrEBqO4HN405", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215107, "uuid": "423d25cb-a547-4797-b8be-7ed5756e5453", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215107, "uuid": "3a93572a-2996-4153-8d4d-9cadd77dda87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215107, "uuid": "e40b9277-87ca-4325-a8f0-24a29d65bd46", "value": "69b2a51fcfa50b92de264466862bbb43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc2545d-d847-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681203657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203657, "uuid": "1ce0ad00-3c6b-4e6a-9298-aee472fd7d88", "comment": "Malware payload (SnakeKeylogger)", "value": "e46ceb086c60324d99c907481679c15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203657, "uuid": "b26ce8fe-f8b0-4aa4-bada-a6e5bd2b87da", "comment": "Malware payload (SnakeKeylogger)", "value": "daa3a3e7abf415fb4844ba4fe153f5c51d91b7db76485deda3e7de2a83076578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203657, "uuid": "b18f272a-b8bb-438a-a7cd-a1893e480f91", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a50ed50a7fa3526041a43a6c3fe81f8828e477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681203657, "uuid": "f6d17188-a701-4a16-ba0c-c9166904211d", "comment": "Malware payload (SnakeKeylogger)", "value": "58a2e09ee2539e37e79ee48fa079015e1f4ce384281b3c541c38fbd4008214b80613d1463e01ae7f33f776f6544f4091", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203657, "uuid": "ab866eb3-d892-45af-9577-b75ae3f30288", "value": "T1D0E4D016B964CA61E1583AF1349228F84F317D1E804FD7A989727895363F247DE0F2AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203657, "uuid": "4380221a-f522-46cf-bc9a-6074e683124f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203657, "uuid": "41d7796f-f9b7-4a73-b55f-62f2802887c5", "value": "12288:4iS/9ppCZKdb7ETtEfRORMIF0T7kUBxaB/Vdt17uFpXeT+QKjNTARX1q5ZWD:Id7CuORME0TjaltRuPkzA7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681203657, "uuid": "e9c75275-42f9-4984-880b-ad87d85da402", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681203657, "uuid": "703f113c-e775-498b-9574-4fd97306b0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681203657, "uuid": "f4540f40-bd08-4ab7-a21e-6862aec96871", "value": "CJEU Court Order Anex09756780097876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31961e8-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681238989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238989, "uuid": "cc87e587-6251-4ec7-a1a6-3aa261d9cd68", "comment": "Malware payload", "value": "a564055a7a3be3fa27edbf2dc08f477e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238989, "uuid": "3ab17757-0d97-4039-9be9-34a720d9039b", "comment": "Malware payload", "value": "db66a4fa74ed73b0cb03b98a00039e5326b1881ac5a0462c3a10df1add987a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238989, "uuid": "ab7f7556-5932-40cf-9e52-05b6f4dbfaa8", "comment": "Malware payload", "value": "423744197cd0d77279437993064bc80996fb5cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238989, "uuid": "7b923e13-0fae-4555-8b48-891d8c495c6f", "comment": "Malware payload", "value": "674cf41fb377a7a8ab81dfe55e3218c0ab1ccc0d0adb84849748c01bd57ffdd6a6ac5fcad02eca88204227766fa45c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238989, "uuid": "6f3db1cb-68c6-475b-8adb-5657a4c6057e", "value": "T121E64B47F89191A9C0A9D130CA3692A2BA303C484F3077D73B64F6B92F76BD45B79358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238989, "uuid": "6b48b081-8fb1-419b-a80b-7862446f499f", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238989, "uuid": "e7ee5b08-7c9f-4ba3-9a1a-dfb650e076fd", "value": "98304:7O788MspgH0iog1beoDiqTxE6/4RSudB/g34KwYTA:7hcpe0io6lDMzRSunl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681238989, "uuid": "f00f8676-e133-41c0-be8b-3c4696cfad5f", "value": 14558208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681238989, "uuid": "7b550e21-6554-456c-ba43-68d86dc511e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238989, "uuid": "673bf06b-e833-4553-85cf-83c31a0fcfb3", "value": "a564055a7a3be3fa27edbf2dc08f477e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7fae3f-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681208886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208886, "uuid": "99bf8fc2-16d8-4265-9cd4-dd06e1de44ff", "comment": "Malware payload", "value": "a5e50b631d51eb947f5c8a2892580837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208886, "uuid": "5f129353-e039-4a64-923a-44df9906b08d", "comment": "Malware payload", "value": "dbb5146949de39de5d38abc86ab34503a6f0ca45862cf3056a0ba4391bb59529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208886, "uuid": "35c8909c-4b92-4784-8bbe-f9c72452ce78", "comment": "Malware payload", "value": "e79a0fca7bdb37f3d08195d81822e9a8ed0a6ae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208886, "uuid": "43993493-bf55-4465-9a7a-70f3b2c176b5", "comment": "Malware payload", "value": "38474187327545bf8823092fb2a004424d25a94c32671995831b4b89752c3afebf1acef1d6009bf54efe08c048990cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208886, "uuid": "b5c627e5-d085-4466-b36b-a4903cedee3d", "value": "T1C8C42A5773BA26E1D73696F9192067A14F60A31F08138739EE491CD89B36F27C8D07B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208886, "uuid": "5be19edb-47fe-4ee2-b137-a97d2248008d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208886, "uuid": "31dd74e9-9ed8-4453-a2b2-c1fd19024867", "value": "12288:lu06D2W2ICzjuSKAnAeIp7f7xMZ0pWzK62dNY:DQvkj9KAA9FMNzK6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208886, "uuid": "0b260399-c09c-4dba-bf4e-da89563ac8c1", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208886, "uuid": "aea80ff1-9f5d-4182-9754-d490670f9084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208886, "uuid": "4c7bffa1-5ab6-4010-92b9-20f89f466057", "value": "PAYMENT MT103 SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe55870c-d823-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681188462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188462, "uuid": "99b22424-dd0d-4927-9c05-d0ec422b13e5", "comment": "Malware payload (Amadey)", "value": "6bfc18d8d459bc92c86890308bfc6264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188462, "uuid": "7c8cc790-18d1-4df6-ba63-56d944295ea0", "comment": "Malware payload (Amadey)", "value": "dc68027f7f3bf947aa5a20ecd5f2c73db5fbed43836552cf300837732c07a93e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188462, "uuid": "7c841092-0cc5-40eb-9dff-4d0088ad67c8", "comment": "Malware payload (Amadey)", "value": "1effefd9e807ad5b5c24767207ba2e5f44f19da9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681188462, "uuid": "6ae09ee0-21b5-4376-83cc-3e9f5b022cb9", "comment": "Malware payload (Amadey)", "value": "80743603774c8945c1d8f980bd10feca142a54a5f0c15ca74585dd74fc9dca8b0907fd4b8c5829eff904b0938cbc8ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188462, "uuid": "e720abe4-bd56-4ec8-8c46-6f23c2f1c03b", "value": "T14A26CD4863BF4F86F2C5D532503A4851D2FAB0CA56FD37C486E7966E29B63D0A4D028F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188462, "uuid": "ab4c7de4-c97f-42e8-8786-b55cc1c25260", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188462, "uuid": "a9c53865-dc5d-4c93-b801-8c45bf4c0296", "value": "98304:d+d/EmKHy3b/qSZlUXt107zApBrqOET1pg:d4KH+b/5lUg78pBp81p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681188462, "uuid": "12799940-c565-404a-89a8-499f9cc766ea", "value": 4614144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681188462, "uuid": "289c7849-2f93-49f8-9515-a2b9eb1b25e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681188462, "uuid": "ff7bc193-729f-4429-8d55-07066bd3b778", "value": "6bfc18d8d459bc92c86890308bfc6264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c10b27e-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218764, "uuid": "49a40918-ec0c-4260-8cfa-63037c3213f9", "comment": "Malware payload (SnakeKeylogger)", "value": "6906fb326e0fa1a2f52a1b88687f2f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218764, "uuid": "ffda9709-0c06-4262-a10a-035e8f828984", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc357f405281d1550c0cb13a0a1358c9df3da64389c3e8f008073c5c2ad6005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218764, "uuid": "00580d96-1027-4014-aaf0-b71827aae1b7", "comment": "Malware payload (SnakeKeylogger)", "value": "f65779d14d36dc58e9f244825df6dc1ad417b6f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218764, "uuid": "5db2ad80-4399-4464-8b48-ee6633f50c6d", "comment": "Malware payload (SnakeKeylogger)", "value": "c31e2146473371214669ec6c31f30e82df585127715848efe681cd98907c0b0e91db28ad9c4aa82cb25cd435c974c91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218764, "uuid": "26520f84-92d1-4607-94c3-eeda1521ca6f", "value": "T159B4F09D6271EF92E56C0FF45445244223B8F248E2B4FAA94DA713F78A73F6211183E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218764, "uuid": "742884bb-5d9a-48eb-82c0-4070a00f3ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218764, "uuid": "55ba268f-6f5d-407f-bf05-d4fb6dd74a4e", "value": "12288:KpJPdDNdEZ+xsWSe7U0ATZwiluOCK1qoJWYHFq5:2hd5dE4EeI0AZwk1qooJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218764, "uuid": "01ff84bd-124e-4c92-aa6e-d9b9e57edbfa", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218764, "uuid": "8bacc10e-de79-4c29-b261-84209a4d6ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218764, "uuid": "93f4276a-ccd5-4acf-85f3-53bad812525b", "value": "Caixa_04_11_2023_Recibo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859b53db-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681208875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208875, "uuid": "fbaf4fed-7d36-4f7e-ad76-6ba9f1d6ad9f", "comment": "Malware payload (Formbook)", "value": "1fb08d03c89e54739534bdb13b3b4bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208875, "uuid": "8dbeca96-2ebc-47fe-8946-5fb40feb2ba7", "comment": "Malware payload (Formbook)", "value": "de4d5fe6b3744b36652a30941937268460a66533be8cdc57051e9b3b64a746b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208875, "uuid": "8b2fcd71-46fc-4c80-a0e8-98f50c7e671d", "comment": "Malware payload (Formbook)", "value": "d81a4d4d695aac7292ffdfc40ea73b460f36f69b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208875, "uuid": "fbbbde16-d005-4cdd-ab1b-85e2e7c6d21e", "comment": "Malware payload (Formbook)", "value": "355e2e78888e8614f9935abdc5881ec5beee1b7916bd90a853895dae3d70aa4298f1979af71dcbe3232e6a8b77b2fef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208875, "uuid": "b65138f5-3184-481f-9907-d4819ebfe305", "value": "T1CC45392439FA501AB173EFAA8BE475E6DA6FB7733B07645D1050038A4723A41DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208875, "uuid": "e8237e9a-3bce-4753-b314-fd3a5dca2a9e", "value": "12288:eLDIv51o7LKvFdmEL9FVQZxkpHCr7OXLm9cIgDFqBjYxpGoinImLt8DNPWaRtFuq:eLGbi8FrDGhOk+7gEjzrJji7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208875, "uuid": "62bf3e93-4d74-4b6b-a662-9d9d016fdc44", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208875, "uuid": "e7c9be81-243f-4d3c-becf-de677e50dc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208875, "uuid": "387e0407-c6ce-4fc9-b0fd-35a3cc38cc65", "value": "20231104_1C23TTS_00000246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd0c9b6-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1681214041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214041, "uuid": "7d02a438-8c5c-4500-883b-cba6c7c30264", "comment": "Malware payload (Socelars)", "value": "988b262d2e2ac000b368646fe7de1a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214041, "uuid": "58e807e5-b124-44b5-ac8e-ebf7294f3e39", "comment": "Malware payload (Socelars)", "value": "de9d367b9e27f1bb4aea0010b370719e7b5147ba4a733a956180ec8142210c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214041, "uuid": "9d2bab26-24d6-40f5-ab24-13221402617e", "comment": "Malware payload (Socelars)", "value": "750f1a3ff587474b76023831de3db6420daaa954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214041, "uuid": "500ccd63-186a-4ac4-a3e9-b07fe548ff1d", "comment": "Malware payload (Socelars)", "value": "5b3933de23a75082ee76c3453e4acb84415169c8312d67bc38180f53a85235ff476e4a08a3ac3a9824270b53a5f3773c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214041, "uuid": "4ef1ead5-4d02-4b88-8210-ab9e4f9d24bd", "value": "T1A5658D21F7C26032E8E310B745FF66BE9D3C6A21470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214041, "uuid": "d85a5b1f-2a4d-4b5e-b911-502e67993ecf", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214041, "uuid": "eec83e2f-f986-44f3-ad67-09eba170965d", "value": "24576:0GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRHA5hESq:/pEUIvU0N9jkpjweXt77g5OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214041, "uuid": "eb9dbaa9-3f83-4782-b568-2f476bf0a66d", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214041, "uuid": "6aa68b62-3bac-4d0b-8ea0-c14ec44ab3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214041, "uuid": "36e80816-4be4-40d3-995e-fa0da0384ae3", "value": "988b262d2e2ac000b368646fe7de1a42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdeacf52-d825-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681189213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189213, "uuid": "afba113c-94e0-4c6e-b5a2-460b9d1a2fce", "comment": "Malware payload (RedLineStealer)", "value": "53e29a5c6c173c8385d1e5e8787ec414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189213, "uuid": "23f0cb9a-8d9c-4a9a-9fd2-b4e1d584e5f3", "comment": "Malware payload (RedLineStealer)", "value": "dfc9a309f976738e47c2a7b753f84323d2986cfd55ecb5f1a3c56caac15c13e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189213, "uuid": "e8a401ae-75f1-4a0e-b1b9-d6915cc3d4d4", "comment": "Malware payload (RedLineStealer)", "value": "6a0d199c944dadfde1e98fc951de74cf5213f50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189213, "uuid": "1dd6d254-d00e-49ca-9861-0846da94844f", "comment": "Malware payload (RedLineStealer)", "value": "78f59c41b8e8e32ef2d72a3e1cde5604c63282c79fe2f3938a0ffaadc2c73a69abb7f406a6d4ac9b4d7c5d0c0b5a15c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189213, "uuid": "460b96db-c5b2-48ea-8483-c4c67b4dc48a", "value": "T17914D022B7E3D0B2DC5BC5708860D7A8AF7DBD615365824B236427AF5E307D08B6A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189213, "uuid": "ed4c2f08-8992-4909-b4aa-08467b7ea8c3", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189213, "uuid": "7cc618a1-e23b-4d4a-bcbf-a8e94be09eda", "value": "3072:xL28PzsrNcSq61QbgykM/wZwtYfVQLn+jWZ47m2hKr:h28Q5W618gyR/Mw2c+jW+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681189213, "uuid": "e830a104-b73f-4d95-bad4-9bf14918b145", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681189213, "uuid": "d700de46-353a-44e8-9e34-2cce2bbe1f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189213, "uuid": "0336617b-5f89-4415-970b-055bf5d79dbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30663214-d82c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681191982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191982, "uuid": "5ca750de-562f-4920-8357-bd5375d9fb49", "comment": "Malware payload (AgentTesla)", "value": "bee1766fdf0c5df1b851a1cd25e874ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191982, "uuid": "5102637f-5454-4874-8b69-b94bf937095f", "comment": "Malware payload (AgentTesla)", "value": "e11a2b4f0f577c815b35edef22375445c9dac07075ccee826a1ee20b02aee2f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191982, "uuid": "f8f7b39e-1af6-42e4-8872-3f1f9c19e269", "comment": "Malware payload (AgentTesla)", "value": "2f2f0893137bfdaf61933b9ef0d9c3f45f38c046", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681191982, "uuid": "a0785c13-c7e7-4dac-92ba-bcee2e09c137", "comment": "Malware payload (AgentTesla)", "value": "7342c2d7f8405dac7cb93ef84cfd83ffcacb6e2df82e2931d84087d52744a2ed5efd766c9eb58bcbe21dbcd026c79efa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191982, "uuid": "fa617de0-d656-412b-8539-d80668aa8ba6", "value": "T142F4E1ECBA716922D82DA7F924431E8372BB9C452157C27B4941F3EA1C77A03A9153CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191982, "uuid": "481b25ac-ecb2-43b6-887b-2e890f0a3388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191982, "uuid": "82490be1-9ab5-4c7c-a486-7c345580bd1c", "value": "12288:nHX6w0JxmukRONBqC+HB4ou3YKQRjrrpGXSQPLXWHej6fOQqH72w:nKwqxLpBqC+2ogzQF6Ja+j6W1Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681191982, "uuid": "6ee30f62-909d-4fc7-9973-4f58eec0243d", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681191982, "uuid": "4fc13ee5-fea2-4b9e-88fe-3573e96ce3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681191982, "uuid": "c49ce9fb-c90e-4509-996b-7694b52d8c5d", "value": "QUOTATIO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaabe821-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681218815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218815, "uuid": "ca177b34-9b7b-45d8-a8ff-95bd55dee4ee", "comment": "Malware payload (SnakeKeylogger)", "value": "d0881312b0b38101fbf04514a90604a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218815, "uuid": "17c3d730-cce4-488a-896f-7e7cdf43587d", "comment": "Malware payload (SnakeKeylogger)", "value": "e2c40dfbb54a5fe183a97cb7be58ee20969e9f0f7744df829f2b02619fc529e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218815, "uuid": "84d30fbd-d704-446f-a9c2-a855c236236f", "comment": "Malware payload (SnakeKeylogger)", "value": "40c2ccf3d3479746bfd25ca3fba531d0ebcf3471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218815, "uuid": "62cb3604-6214-47f5-9178-1731ec07e72c", "comment": "Malware payload (SnakeKeylogger)", "value": "27732bb9c72382ec6c3190420de7561fb3a11dba6cd4aab8e6ae7ce850eba221fcfa090692b5ee80f8e871e645515daf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218815, "uuid": "de28d078-54e2-498d-bbf2-149f98310959", "value": "T178B4F16E52B1EFA1F49D0FB414802846277CF205B561EA99ACE613F786B3F92104D3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218815, "uuid": "c3a8dea5-747e-47ea-8338-54664caace4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218815, "uuid": "6917e0b8-acb7-4dce-a5e6-9b608bae2e91", "value": "12288:ItLYUUIQkwxnTGte+xiSfw0BxQ4l34dQIyHM:ItTUIdwlTGFiSfNBxQ4l34dQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218815, "uuid": "aab1bb17-4853-42ba-8de9-d8510478a93c", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218815, "uuid": "a44ad223-2652-4e6c-a834-df2c1cded383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218815, "uuid": "da64528f-f4fb-4cf3-80de-7422cf522e04", "value": "7Gdx3LYNmb1ezOz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82f8f2d-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215456, "uuid": "84661bc4-3707-4006-9dbb-c8874239f9b0", "comment": "Malware payload", "value": "0f60c2e7bf82951fefea4e41e73b653f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215456, "uuid": "3184dd0d-3017-45d6-b116-a9633ece43d3", "comment": "Malware payload", "value": "e303af07c31da855c6dade631a3002a7d5b907f7c4287fde0e4d90a583aec229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215456, "uuid": "a9ed6d07-b216-4242-a61f-1db8961343aa", "comment": "Malware payload", "value": "47dd4125b8cf9e101dc5c880dc4e28f6a87937cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215456, "uuid": "836d3219-41e5-4418-91e4-52f4875b3828", "comment": "Malware payload", "value": "06f6362e98f15edbac29fcf0b26b94d9279691b2e4ce577e2c25efdf449d9d96420a12290ba337a22e05cdb38c98450c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215456, "uuid": "f9e76d59-f1de-4e4a-93a9-c74eb585cf59", "value": "T152E5C023FAB1507DD51312729EDD6319A3AABEF40736021721947F3E2AF38825E39572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215456, "uuid": "a542fc78-f796-40ca-b35c-05f45c024413", "value": "8745df7883a801a0067a7a9eb683d9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215456, "uuid": "104d4fc5-cb52-481d-9e11-cf373345b58a", "value": "98304:Wbjsyw3BKLujJ5iV0hH1bRWydCOHoFN6WtljaEy9/FLOAkGkzdnEVomFHKnP6:We3YY1bRWybHmN6WtljaEylFLOyomFHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215456, "uuid": "f32d2bcf-0688-4cfd-98d6-04d1cc349d68", "value": 3170793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215456, "uuid": "0f764c2c-fa8c-4e92-a1bc-85cfb8021530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215456, "uuid": "5d4296b9-f017-48ac-80f0-0943c4bc506f", "value": "0f60c2e7bf82951fefea4e41e73b653f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb650d8-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681218847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218847, "uuid": "ca074933-1c74-47f8-9957-0cb335263ebd", "comment": "Malware payload", "value": "b49e17afa43c884a15dcc90f453611ec", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218847, "uuid": "455cae1e-a5bc-4941-b6fa-d3f62936a51d", "comment": "Malware payload", "value": "e3a40941dddaa82e73a94ea6a42650594ae6f3de836fd43688ebcee4c78a5f83", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218847, "uuid": "fd941bc9-881c-4ae4-a663-d541340e2adc", "comment": "Malware payload", "value": "00b78d3febc1f8863486063e81412b03c11a6f8f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218847, "uuid": "ef870112-2843-4abe-bfd4-25780de2b7b7", "comment": "Malware payload", "value": "f9932b2e006d797fe6152bc0f94b91268f882ede6717a50d4324087ee7c8960b3220b7b4ed76634876429c509e587512", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218847, "uuid": "518df6d1-8ca5-44ed-9b92-89ea66798fe1", "value": "T1ABE2945AE79F02B48B510272231E0AC9A77DB23E735591B1745C837433ADC2D46BA6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218847, "uuid": "bb05e914-4ea2-4047-abf4-3956a2aa3472", "value": "768:aFx0XaIsnPRIa4fwJMf/ywWunE8b1IggsEMG1kbOC4hdLau+:af0Xvx3EMFWWIxM+kbh4V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218847, "uuid": "758995fe-d20c-4dc1-a01e-e91bba66f853", "value": 31706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218847, "uuid": "2498d747-ff56-4dc1-8feb-6b2016aa4564", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218847, "uuid": "709ed49e-7483-4726-89eb-d4d78051359a", "value": "Nuevo Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb17315-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681208966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208966, "uuid": "a4cf6b21-9f8a-4842-a967-51dd4d08a52e", "comment": "Malware payload (AgentTesla)", "value": "f451282429f29f9e239e092d3a33bc89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208966, "uuid": "78c6f962-9f09-4dec-aa63-e54e91fe5fbe", "comment": "Malware payload (AgentTesla)", "value": "e45b8a554f3c9a7ba9b7bcb1d614f0f846e79ce76b4434ece2fb84df677583ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208966, "uuid": "73502ad3-da0e-4263-b73c-3e891535aa48", "comment": "Malware payload (AgentTesla)", "value": "eae9293bcf31d457aa558e069666486f7d14692d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208966, "uuid": "9ad0a99c-ab4e-4b62-8acf-4821dc9149cd", "comment": "Malware payload (AgentTesla)", "value": "0304253387975465886fc3022678a31e12cc5287b531c9bf893879aecc8fd0e25f10bc0df3d7f5de697c416e87c73b3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208966, "uuid": "b0643d0f-c174-485e-83e1-2a4316667c52", "value": "T1EA546ADD726076DFC817C876DAA81C68EA6074BB971BD203A01311ED9E0DA9BDF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208966, "uuid": "77957f3f-08a0-44fa-aaae-d51355dfcfbd", "value": "6144:gnMV2776pu5y74Rm/QeoQJRdBXTQus0ROTznYbDRjAI:2MVW76cyUHeoEjQZTznYbDRjAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208966, "uuid": "835bbf68-63cc-4043-b48c-53a6ff5a62fe", "value": 287464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208966, "uuid": "22131e8c-3bb4-448d-bc4f-dd7be420db30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208966, "uuid": "feaf5497-7314-4d40-9810-113582697096", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdcdeac-d866-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681216918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216918, "uuid": "4417e9ac-9d58-44aa-b32d-5ed7a031b4ca", "comment": "Malware payload", "value": "b38e48a621a2ead54e44bcb52184a5a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216918, "uuid": "7b0eaeaf-4467-4787-9518-d8ed7fdd8d96", "comment": "Malware payload", "value": "e4ce22fb2d10fdb26dfa9fde5b35278b9f0a7cf98d90fc30415fa8456dc7385f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216918, "uuid": "86da7c5e-2840-487d-afaf-e9880141cd59", "comment": "Malware payload", "value": "ec9f9f2d587b6cb58fd08844d1a985c23a9cd43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681216918, "uuid": "b1192d26-3679-45d6-832a-38558633d3f3", "comment": "Malware payload", "value": "f9c07ad9b608a7844f948071b805733152cc59c72fc3bf98fbc528786126be18cd562788ef8d525084cadfb9fb48939b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216918, "uuid": "6346d925-5c90-4cd4-aa9b-be7d47bafa2b", "value": "T15F830179F2A0D28BD1107AB79A62D3A6CFFC9407720426C3798F45725F14B042E9B66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216918, "uuid": "240c512c-ce75-47f3-a7d4-0cc6787dd373", "value": "5515fd465ea6fdb666e2f98e22b57517", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216918, "uuid": "c342230e-b132-496a-bcdf-c86f69c40162", "value": "1536:hN3vZJaqcx/55jPb3UDBD8iNX185Dii1i/EJTMsPA0TsLoMb1JqCzLbqZf:hNqTNb3UDBDVSJ1GsYo9MRvbqZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681216918, "uuid": "0492629b-4ed0-482f-bbff-e48c7fd340b9", "value": 86599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681216918, "uuid": "507c9d06-7a5a-4bbb-9c10-c0e1be16222e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681216918, "uuid": "de3ad555-87da-438a-9953-4f4955cec8bc", "value": "SecuriteInfo.com.HEUR.4090.31013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e54b777-d80d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681178637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178637, "uuid": "130dba15-a6ba-464f-b3b6-e2f53e7c953d", "comment": "Malware payload", "value": "5fb84888c906279760c0761e4553d565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178637, "uuid": "17efb12f-dfe4-4668-91b9-ea86c2299493", "comment": "Malware payload", "value": "e4d278ad9266105011537bcaabf234c676c01930e0ee29bd05f6e3f9dcc926ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178637, "uuid": "c026306a-d6ed-4196-8af1-198a1e7108a3", "comment": "Malware payload", "value": "0797d2ee0ff38ef4a62433427771664e5f6eaa65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681178637, "uuid": "54267cf4-5f58-45ca-8ff5-5c12a1abb487", "comment": "Malware payload", "value": "ac8cb2e677cd551a79dd7cf6a4b257115cf65d8fdd5ba5947499fc9ec1a91732cee00fc5f40e9f3bf4108c54319e487c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178637, "uuid": "ebbd7612-edd8-4d9a-859c-dfc96d357441", "value": "T114374943FA844AEAC6A59535C9AB03953370FC441F27ABD72A44B63C7CB37D9AE64340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178637, "uuid": "e26b8c57-bccb-4b46-93f4-415af8200a38", "value": "c40bc5dd6b58b4f881ffb6504bd7ce60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178637, "uuid": "39413454-0bc6-4243-b422-0a1b9f905efe", "value": "196608:ANAJkvptjm8/mZFUVuebI/0EkkSq6aGgIo:OxtjCWHbI2gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681178637, "uuid": "188f6375-b356-4221-b5a6-6591f2065a13", "value": 22878776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681178637, "uuid": "85c195f6-c722-4292-9e30-eaa0f56ec921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681178637, "uuid": "f07b5f2b-4c47-48b6-a040-02e4d3daff00", "value": "Sandeep_Lamichhane__videoMaguindanao_video_from_CCTV_LEAKS_FROM_CAMERA_HOUS_-_SECRECT_FROM_911leaks_CAMERA (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d353c09-d82e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681192862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192862, "uuid": "533d4813-f3cf-4d90-8df4-004a161e10f4", "comment": "Malware payload (AgentTesla)", "value": "ebd71946b89a2a007862c8cda7ff5576", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192862, "uuid": "62f5b3bb-fb99-49ab-8048-fbe1f1dcc185", "comment": "Malware payload (AgentTesla)", "value": "e50aac43539c9d6b7d620763799593c4b2b2cee944e9f35fd70d491c7f461baf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192862, "uuid": "f24bc7ac-6113-4f87-b9a4-62becccaa1c0", "comment": "Malware payload (AgentTesla)", "value": "d709491ff45f65016a18925984e88cee2194520b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681192862, "uuid": "1f3b04e1-4d9d-4778-b636-fc36bf863beb", "comment": "Malware payload (AgentTesla)", "value": "bd3825f8d154078418758d25cd9077587439e78a190d81c99951487079675ddd1acbbeb58c953976360a45d768ec98c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192862, "uuid": "08118d45-8d9c-4ae1-88af-d6a8841f9c68", "value": "T1C7E433AC20C909A5DB5A627ABAF7BC7FDF3145421D80BF28209C473C9922B971CD1D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192862, "uuid": "6ffb68a8-e300-4a16-b846-dbe0d0d56c7b", "value": "12288:mZx2GLEfRoqdjQPIRFk91LRujABOprfIg5SzT5tq0ddCK7+8XGmP:mGAEfaqdqILkXGYkrwF1VdTyIzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681192862, "uuid": "b6e3e9ef-a65f-453b-ba84-59a87ceed212", "value": 702225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681192862, "uuid": "fb532d97-28fb-4535-9dff-b9c68c0271a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681192862, "uuid": "d8c091ef-8462-4349-a302-4833bd4682cf", "value": "S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef61c63d-d831-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681194449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194449, "uuid": "cee36a7f-336e-4806-a92d-6cbe659aaae2", "comment": "Malware payload", "value": "5658b3a6cf75308ef3dc3842ef7ed50f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194449, "uuid": "ed2a606c-cb92-4a45-9a33-52ab1961d510", "comment": "Malware payload", "value": "e669735ce3ff936d3c25f16b7b635eb87d8df589fd8d29624fa9c0d75832b945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194449, "uuid": "f68ca6ca-6363-454e-9d0f-c0dd6b8c1dca", "comment": "Malware payload", "value": "a8f1afde717f641b07dadaceb7533437de948b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681194449, "uuid": "7baa732e-29b4-4331-9352-3b26df769b34", "comment": "Malware payload", "value": "1093ee1dd0154f5260ab16f374e2f76781a92bd7d83dbe149f0fd3d1bb6fdf55e8086e2ed58ab6b809615757e8bac995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194449, "uuid": "c0742398-f035-49fd-8e8b-5a0c8f164f62", "value": "T130268D56B3A800E8D477C138CA964227E7F1F86613709BDB46A4977A0F33AD16E3E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194449, "uuid": "a5fa1b3a-b518-4337-bf46-9c4ba7bada72", "value": "1290d333596693105906a9b219d52c40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194449, "uuid": "3007ae62-c3ac-47d2-9aa5-02a249a26f2c", "value": "49152:xGtlqDfIU6ivVwASOwFBin5sefu8IIIi5TaxekrdRXHZgvkY9WUZ4qbYPN7QJFQk:Y+YFBi3m4WpT+kgWU2QJF7KCgOXCST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681194449, "uuid": "75e96cbd-c7f6-4b26-99bd-1c9b7103945a", "value": 4811264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681194449, "uuid": "c6f2a884-a14e-4e29-aceb-b737b73efe31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681194449, "uuid": "be35ae73-0f99-4a13-9416-bc351b352bda", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af56d1e-d82f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681193207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193207, "uuid": "94ec66ba-d1e5-4ffb-8ca2-3130f1ae846c", "comment": "Malware payload (AgentTesla)", "value": "e23e35a659e64c4fe008ecb6a3ade3dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193207, "uuid": "14dd14d5-c3fd-49dc-a7b2-f676eef9a0f6", "comment": "Malware payload (AgentTesla)", "value": "e6c086a770af7e1c74d1288f080947ea69c65a379ba366f9c6e4b6bd93104cd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193207, "uuid": "a7e4a41b-8c10-4851-82e0-e2bc90220762", "comment": "Malware payload (AgentTesla)", "value": "be9a3351146dcdd35682c788d26eb659691fdcbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193207, "uuid": "2a0ff83d-5a63-479f-8832-ab595052d792", "comment": "Malware payload (AgentTesla)", "value": "0389d4564ecc4a68d81bdc46037b72ee385d2ebbe16ad207499c1a11aa7bb9bfebb1aaf3b17c84301018e79b8a5df264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193207, "uuid": "7410567b-c9ea-4337-9512-8dbd5f949c39", "value": "T114D433E374147F50C8A82DD41C6402C7A55433D0FA0E9E097C915AA364EE9E27F7BAFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193207, "uuid": "cea7586f-e556-4de6-932d-49435e96d887", "value": "12288:2ZeXrgKdiXdlYenky+1uwbRsYyQxI/9q3Ts9HlxrcwZoA2Llgb3xBXex:nVyj+HbROQwys9HDwwZ2Y3Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193207, "uuid": "24bab990-96d6-42a5-8f39-77d6754b5ff2", "value": 629122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193207, "uuid": "17570179-fc23-432d-bc13-429ab0489b6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193207, "uuid": "05cd1b41-ceeb-49d3-980a-4e753250f97c", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6589b597-d86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681220417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220417, "uuid": "7c3d1efe-4d6b-4e03-a8ca-ff262c8660af", "comment": "Malware payload (Amadey)", "value": "3502a953ad22a784992d9820c1ce2770", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220417, "uuid": "8f3f4bb0-3f44-4b00-97f2-b5667662cb39", "comment": "Malware payload (Amadey)", "value": "e78ddcabbbbe95deb04f0029c2239b62d04159291bca08d41b5134fa72964ab0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220417, "uuid": "34e4e7f1-8d96-47f6-a66c-2fc7e89ff12e", "comment": "Malware payload (Amadey)", "value": "f785d618ac04a066a52ec8aaa9066ef675302740", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681220417, "uuid": "eaad4b00-f822-4bad-9ce0-d464069d1a4f", "comment": "Malware payload (Amadey)", "value": "c882c0bcc904aeb8fe193f8246185113a8fc54eb2d2ea93cf37adb596f228b894a155e1ad353eee17a9f8bbe18b680c8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220417, "uuid": "cb0aab73-9912-41ea-b6fe-5d481ff3f7da", "value": "T12B352342A7C88531F4321BB118F642871371BDE6997466AF275AD4DE0CB39C8A93372F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220417, "uuid": "dc3125cd-9640-4a96-86f9-7d83ffc3d72e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220417, "uuid": "c095d35d-a86b-457e-8c08-da7c084ed22d", "value": "24576:Oyc3gLTpJBT6YgsZ/fn3Rt6Gb8LJSWUVgZMgWxF4kE:dSkTzBOsh/mGb8oWUV/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681220417, "uuid": "195266a0-f834-4329-bead-cb64dd785cb0", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681220417, "uuid": "7621451b-b5d1-46ad-8140-cc10b48e666f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681220417, "uuid": "983a31d2-ada6-445a-b593-cddde11bde04", "value": "3502a953ad22a784992d9820c1ce2770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b1715e-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242589, "uuid": "a8678205-6563-44fa-bf4d-efb867d3c1f9", "comment": "Malware payload", "value": "a16cbcb233d4ea7df17a30b799674aa6", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242589, "uuid": "e8fc34be-8708-4064-9c2c-765f6432e38f", "comment": "Malware payload", "value": "e7f423479b2a49c5665bbbcbfa240443d0633e56b65cb3c0171fe889eb316ed3", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242589, "uuid": "5926cff7-d902-4c3c-b2af-2641f5083d4c", "comment": "Malware payload", "value": "66b872c996fbb2311b3c841ff0ff2433e0c2d7c9", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242589, "uuid": "51f99469-9fda-4d72-8e88-2cb7974541a9", "comment": "Malware payload", "value": "148790bc2aebacda184320dbe8b15bb2f96d907962a2a12859b84263c537df3845c05f392786a05f28e5c74663a64ea9", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242589, "uuid": "a459934d-0fdf-44b2-8060-d19a6291c9a6", "value": "T1915301AAC9D94D8DDCC3D7796E24368F19ECF023CBEC61A170781E8199054856E31BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242589, "uuid": "143a8012-54c8-4d1f-9f03-3963aab01cf0", "value": "1536:DiQ3QcgpPgVCW/ylpSbxhap6y7aCstSWxp8jrQa:GQgfpPqCWapSLA7aptpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242589, "uuid": "a336eb57-69d9-4735-a7cc-8ab7877508e5", "value": 64815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242589, "uuid": "9669ffa0-d8bb-40a2-a789-ac9bb6a60b78", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242589, "uuid": "1216a741-667b-48ff-946d-a8ad96b6051f", "value": "KK-August.11(5).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0903960e-d836-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681196210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196210, "uuid": "b7f30a66-eadf-4d55-b089-52cced61cf9f", "comment": "Malware payload (RemcosRAT)", "value": "f45d525a45fe1e804006977663306c54", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196210, "uuid": "ae33a9b7-3d1e-40f6-a334-1baf9e97e6a2", "comment": "Malware payload (RemcosRAT)", "value": "e85c65358336efbd6ca75604ee0c4b1bb4e09e9dded8653c9ea054e457b84590", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196210, "uuid": "1ac84cf5-8c18-4505-af47-f9d4c3a8b67f", "comment": "Malware payload (RemcosRAT)", "value": "8cabf2844a2c0aa7d178537e92fa452df4bf577d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196210, "uuid": "07f2efee-3c7c-4f03-9c56-704f46afaf38", "comment": "Malware payload (RemcosRAT)", "value": "f6b88188871635e71cd52e33ff957b66ce4dcdb2d0d5e3150374fd3e365a3f0df561347a26968c94785b6a4144744e69", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196210, "uuid": "3b33268a-eb35-4f05-b178-2e71d0bb33ea", "value": "T1EA7423713688857D9218A24514F2464F7FF3DFA7C4716AB04B3E177EA2786A9C3630D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196210, "uuid": "eaab6efb-d956-4b74-9c2a-2e57deb9d81a", "value": "6144:dtySvJeF9Mt2vfLLmz/uMtkrQT0JX+Kq2cNIwGJdbmmV7rvvdT5zTjRCA:qSs0Q7LmzDqoaO+0I7JkkTlTt3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196210, "uuid": "a438c518-d5dc-40d1-b065-4a900b2af82b", "value": 341742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196210, "uuid": "8d0e97a0-fe0c-4564-ad44-77cec4821e25", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196210, "uuid": "6466f8a8-fff4-4ac4-8430-03e03f213023", "value": "91489557012035DraftBLFmKNNBRecd07Apr23CFM.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a9df89-d857-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681210385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210385, "uuid": "7b75d47d-ac78-42e0-9ddd-40a14e90ea02", "comment": "Malware payload", "value": "2fc2480e320185ef983263deac897951", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210385, "uuid": "45617107-747f-4586-8ff4-ba15e273c434", "comment": "Malware payload", "value": "e85c696a1e55cc322a08ddeba57b415f688f29b1542378feaabe985dde382f83", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210385, "uuid": "4542238e-486a-4139-84f7-556583550eb4", "comment": "Malware payload", "value": "4d832dbb346c3f4f0a09c65434a6c2cb14a3f365", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681210385, "uuid": "a3e34652-41a4-422e-99f8-88d1bfdbe32f", "comment": "Malware payload", "value": "0f8d53f57fd7b6f8bc0bb6a1723b497d3d1a1aacfccae66698540e7a3c93512e336f4d6becbcda74773d207301f47d66", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210385, "uuid": "a36dc693-8219-4771-ad71-1913a1bee034", "value": "T17AC26056E79E13B48F911272171E0AC9AABDB23EB3609561345C833433EDC2E46766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210385, "uuid": "aae59136-a0e1-46c8-baf7-316ae52318de", "value": "768:fFx0XaIsnPRIa4fwJMCFN4Cu90hyMCP9gsi:ff0Xvx3EMdCk0vYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681210385, "uuid": "c5d0f8b0-1d37-4f62-8341-45493629a91d", "value": 28009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681210385, "uuid": "6033f1e3-25d0-4ddb-adfa-7ec6cd1c1bf7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681210385, "uuid": "46028a0d-2e01-4150-a869-ccda398ac780", "value": "0031032023002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02388214-d89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (jRAT)", "timestamp": 1681239149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239149, "uuid": "e8a0e64f-8332-4e11-827f-ce39d2baaa27", "comment": "Malware payload (jRAT)", "value": "79ad96c55fdb7ae4613aa70eca8f3b04", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239149, "uuid": "380f7086-7da0-4fe9-a81a-376ef5ac08d2", "comment": "Malware payload (jRAT)", "value": "e9e7dc6af2033986527d6409502c582ece86c630fba798161d2dae8724bc9db6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239149, "uuid": "48e5666d-3cd7-40ce-bb7e-79de7be26bbe", "comment": "Malware payload (jRAT)", "value": "1db57a7d2f584c7fbd43e785b187b74102b1277c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239149, "uuid": "7f745d85-fdcd-4f9e-834e-d6b75c2f944b", "comment": "Malware payload (jRAT)", "value": "de7f0536ef0004066b7f92de7ac53840ed1203b34631abd3999960d77d2aba0622e0924f8c6b2c42a2eb4786456b27a2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239149, "uuid": "96edfb73-9e45-4d7c-9705-b94704a2d369", "value": "T1EBF4021FFDC0D47FE3034170127A8522E84C115DAA97E36B9A50AA985C74CB607ABBFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239149, "uuid": "5065bd20-7e5b-4b09-8502-273708c19733", "value": "12288:uRvrLJvZLl+YBVeUYz4rVSmp/7ga8RwaZi7yex52UjxJXUIXMKR4R8hZIHBCUSwe:qLJvZHBVelc9d0ROOidzjTkIx4RM4bRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239149, "uuid": "aa1a8e73-9b46-4158-b67c-b33fc275ead1", "value": 760955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239149, "uuid": "fef7738b-03a8-43c0-b2fa-8edfd9a07909", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239149, "uuid": "4e9c8090-455a-4006-bbb3-0382610c4e57", "value": "factura000000000000.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6063b0af-d89c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681240166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240166, "uuid": "e8b7143f-77ae-4449-a38d-faa8ac28a1ee", "comment": "Malware payload", "value": "e06485fe9f47e2259b6409877f728c20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240166, "uuid": "ac40205b-d9f9-4dbd-9141-67cc9d9b1981", "comment": "Malware payload", "value": "eb67d6f1a04d595bd09eee35ff5504d44910f7ec4904958e2d9d6766f67c591f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240166, "uuid": "7c8744d7-35ed-4334-a7f5-b9b3fe435c5c", "comment": "Malware payload", "value": "e25f0b9e98b5f8127a0b66dd58ebeb60e34c6a87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681240166, "uuid": "94bef278-0545-47e8-9239-779c1eb11753", "comment": "Malware payload", "value": "137c7e211cd530dd6e834cdf7a018080c00def9815371ff70f693406c8b0b89b9aee50ed8ec51a9e9b46a5c5c5ba80cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240166, "uuid": "ed194fb9-02b6-429a-9d91-86d5e37d20de", "value": "T1D5452311F6DC8023E9640BB1D8FB13831A367CDA9EB0235B3766EE8E49B3546513176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240166, "uuid": "6a7f4881-89e5-4a1c-afa3-19271f6dba4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240166, "uuid": "4dfc5276-def9-4489-a124-2c4b434cf124", "value": "24576:4yO/s50Y2rQoXkCUltcWYNuoKWpS2JS8evhfR0C14Fi99iR:/OQ0YoGtkQ3GcphSCWY99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681240166, "uuid": "4e1eb229-e1c9-4bab-b5f6-f80857d818a7", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681240166, "uuid": "c60f5175-e6fa-40cd-bd55-16f3452caf31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681240166, "uuid": "a22d5456-ff2e-4e00-86d4-295bc5a6b80d", "value": "e06485fe9f47e2259b6409877f728c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a675bdc9-d888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681231693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231693, "uuid": "818f6132-c9e5-4e85-92e6-0fc4161a4cf8", "comment": "Malware payload (Mirai)", "value": "a8389e3a37a488e3cb6013276f600301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231693, "uuid": "9906e9e6-c64b-4ae7-8485-f6d4aa1f01b6", "comment": "Malware payload (Mirai)", "value": "ec40cbf4c1a3bc3e9474e768e4bfc447bd01cbecc9a267e38e73e21ab1e4ca71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231693, "uuid": "6fba9ed7-1b43-4c90-8bf5-c8ff4f63792a", "comment": "Malware payload (Mirai)", "value": "7d5135552ae8047d577537f5d4b98fc91ad942b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681231693, "uuid": "36e220be-b60c-4279-aaa8-61be6b4a5370", "comment": "Malware payload (Mirai)", "value": "78ffe5345bc1035b62ed64defa04b63e3ba2f26792649d505a58889fc5d9cc1c7d1cec83398de4e59b4e87c220c4f365", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231693, "uuid": "223c60c3-a085-468e-8cd6-7ee9dea93953", "value": "T106732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231693, "uuid": "f9c5c8d2-293a-4374-9996-65228670b7a2", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9W5:927jqCt8v3GI/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681231693, "uuid": "57ab8991-bf98-4f57-91ba-c60d14644e41", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681231693, "uuid": "3f9bba0d-963e-4cf5-b591-5c8b1279d9ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681231693, "uuid": "92b59c09-5428-4609-bad9-6fc53ac59764", "value": "a8389e3a37a488e3cb6013276f600301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fdb7d8-d830-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681193793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193793, "uuid": "926ca758-67af-44d1-862c-2df33a7b0a24", "comment": "Malware payload (AgentTesla)", "value": "31e6773d15eda580670dc443d5d8f08c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193793, "uuid": "ed378be5-72e9-4150-b2de-b24719137d59", "comment": "Malware payload (AgentTesla)", "value": "ec972c728bfffe859f0e3b4eab2e08964b275c4efbc86aa05d4bc5a3f429b6d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193793, "uuid": "050078e0-8fe0-4b8f-85fc-0537c0a3fa2c", "comment": "Malware payload (AgentTesla)", "value": "90b7d1033310dc806d929d03dfd6f67a0b0514bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681193793, "uuid": "cbfa7081-35ce-471f-8c0d-c85b1def979a", "comment": "Malware payload (AgentTesla)", "value": "72d84e174b44e07b0dc6aa0d97f93e842e01a00047b3c2f73c58b76facd8519abc5c9e97fc8ffaa5ed17fb658143f3ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193793, "uuid": "85506129-edce-4b84-b106-95ed225f9d78", "value": "T1C9453304C0717CEED7AB20FC40CA851396DDFA29085B9A8A17F3A7D3359B109F25AD93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193793, "uuid": "06dcb36c-2229-4be8-a919-90ea27617359", "value": "24576:x8/9/G45fHQZFodMvO5b1B9QepIToA7y3+b9W+rXgxLII:u/G45P+vm5rDonhnlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681193793, "uuid": "2c07eb5e-8896-4dc2-9f87-1017f3a767c3", "value": 1181042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681193793, "uuid": "a68a51b8-09f4-4234-81c7-cde7efcc4519", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681193793, "uuid": "f4f4f392-ac0e-467e-aec9-aeac7eb41ae5", "value": "QUOTE.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b6be89-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681218777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218777, "uuid": "297c83be-49bc-4e5b-80ef-9b2435bdad91", "comment": "Malware payload (RemcosRAT)", "value": "edff6c6eae09ab2747f5b457f434acb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218777, "uuid": "d7d91ffb-88ad-4d3c-832d-ea7a554d311c", "comment": "Malware payload (RemcosRAT)", "value": "ecfd8eaed01a5714355b6b8a09f47e35c1a81691ecd1d9f3e757010ed09d2d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218777, "uuid": "4aa39528-1bc2-4d50-a1ab-f8cb9c862c56", "comment": "Malware payload (RemcosRAT)", "value": "b2a9ca8a235a6dc9a27a8b69a27d4e9fd8512748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218777, "uuid": "a029cdde-2e5d-4563-9c1c-7d8711f768e1", "comment": "Malware payload (RemcosRAT)", "value": "e754da94f34330fdbe2728c66f4a4f451999282af504ad8620a3860e96b296c52998472ad3849e47b506447f3089fe96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218777, "uuid": "5b86d023-3124-4bf2-94f9-ab8dce98ce0d", "value": "T1BB74E0D0B711926BD863D677CAF64E1959BA2C32F1C0194A466837F83423EF1A51B38F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218777, "uuid": "3f775900-5bcd-4147-9cdd-a32c35e18f61", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218777, "uuid": "1acdb732-2981-4d7b-b442-f5dee464755b", "value": "6144:2RlWoKEPgXCiSs0sndk13ZWNeG9XKdalJKT8aQ7J/04muXFsh:G5SSv0S14NBVlJePQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218777, "uuid": "2408e3ad-239a-4648-a1a3-c957d0c5bac1", "value": 364784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218777, "uuid": "7c6ebd3f-3d02-42d5-8c8e-789856d56577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218777, "uuid": "f4fbb806-61fc-457d-8b89-9b46735fb459", "value": "Tribeswoman.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe20de3-d83a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681198101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198101, "uuid": "50db975a-19da-46f4-a9ae-276f581fbcbc", "comment": "Malware payload", "value": "843c2296d647bebf69bd927f1dd03eca", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198101, "uuid": "15897be4-d099-4bda-b60e-ac173a718ce4", "comment": "Malware payload", "value": "ed08359142ccdf63f49fefb8bea8bfa4e7bb6505661a626abcc3e152c37eb460", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198101, "uuid": "38ba98a5-4e85-4375-a278-b6a3ff1346d4", "comment": "Malware payload", "value": "50c443ad7d181f6b78f9cb27855aacfc46cc5858", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681198101, "uuid": "082a4910-dccd-4e62-a350-f2d673fae7ee", "comment": "Malware payload", "value": "b186c9bedb80f517a5a08049de4f1b20e57ab40fc4f8e986dc56f6653fbd2bc7c905e2eb290b87edbe167b8f41cecb6b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198101, "uuid": "170e0ef4-1a35-40f1-849a-10392945b3cf", "value": "T1273633EAF1A58E4F5F1560BDEB169B67012A01C3883BE365C046D3CC7167499F6AB3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198101, "uuid": "b13acfab-4a56-4c97-8cfe-34d1501a18a8", "value": "98304:UERBFJZA7+ibvJvTk+YcKLz62YX1fCcayt4LoxQKEFr:LRBHI+ibvwcKzYdCcaDLoDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681198101, "uuid": "fe7a0ee6-9a41-456b-9aaf-4b1d0c1bf868", "value": 4879333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681198101, "uuid": "52215066-c503-4a11-9959-3d9922a70e18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681198101, "uuid": "457a476b-0477-4229-b041-df9e28c4c648", "value": "Coba.apk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bb081c-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681208982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208982, "uuid": "207f7325-e863-40c9-b6b8-8cc8813883f8", "comment": "Malware payload (RemcosRAT)", "value": "2e9f33ce69fb52130586f58dcb59b7cf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208982, "uuid": "6ec938b0-5838-4aa3-a5e3-08a61091e8a3", "comment": "Malware payload (RemcosRAT)", "value": "ed6e2f3fdad9004e984881db746a5188169933d73c1b8f3cc5a3cf87c1263149", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208982, "uuid": "81ecbecd-a25f-4db0-88dc-ca433e2a4083", "comment": "Malware payload (RemcosRAT)", "value": "037cd3187a31cbd8f9f786e7463959077fb46d83", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208982, "uuid": "bc8f6414-df1b-4cdd-948b-e1ec045ccbc2", "comment": "Malware payload (RemcosRAT)", "value": "c2addaa6858ace6210dc7464f09c09c66fc31eb41c1d02f5957bdd59386ed89c2745cb3867efb2783dcf0066ea53bf21", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208982, "uuid": "832317e5-cbec-49c5-b850-075aed443dff", "value": "T16205128857B84223F828F67EE760B4006FEF52724F12D297BD51BAB5705AB844DD0DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208982, "uuid": "76cdf01e-48b3-468b-af72-338326c3f249", "value": "12288:3k1PLQlSGnjEhYy4ZmXJju43sSNjMWrwA9zKb:3k1PLQ7jmcqsKjPwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208982, "uuid": "c16cc2ca-51df-4586-8dc0-3614b943ef37", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208982, "uuid": "cd2f69ac-1668-42be-a470-344d92340ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208982, "uuid": "23654adc-2202-4460-ba2f-047665777000", "value": "DHL_SKMBT #KV19RE001-A5471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6303eee3-d875-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681223420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223420, "uuid": "a7ea3be6-04fe-4d24-b25b-2f2527deeab2", "comment": "Malware payload (Amadey)", "value": "60910edad1306e12fb166ce703a5a590", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223420, "uuid": "2f2a8930-c99c-41a7-94cb-5cdbc09ae9ee", "comment": "Malware payload (Amadey)", "value": "ed88e9717088f7a958604adc8a4d6ef4931181d8a82a73ab3e3c26187126bad1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223420, "uuid": "a1fb2aec-6f3a-4068-9f89-7267f013998c", "comment": "Malware payload (Amadey)", "value": "49eb5fcd6ccb588df25bbd7c11f286b3a9576973", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681223420, "uuid": "cb0a4b82-a06b-410a-b0c4-6f91e1285674", "comment": "Malware payload (Amadey)", "value": "9c08cd394517c9692e522b7c78ee43a0e302d292199d0dd092c25cc276fb67d9ef1e1465e205ee6698180f711ab2ada7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223420, "uuid": "dfb978e9-d74a-4acb-8365-9d864928aae2", "value": "T1D6052317F3D18533F875A77058FB16C71B35BCA46834926B3B4AA89A0C725C8697233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223420, "uuid": "c45de521-3de4-4275-a7a1-1b4b7b5228df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223420, "uuid": "ef87dc86-5330-4d98-844b-86060e0b031d", "value": "24576:6y8Vj1muACcJL7Pb5LAJFMpHd9BB3ER0:B87AlPb5uFMpHd9Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681223420, "uuid": "dd1dab2f-b579-41db-a626-9b1ac3cc77c3", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681223420, "uuid": "d606d656-fe95-49c3-9a77-512e10619318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681223420, "uuid": "4dc5faab-df2d-426d-98ea-de9cbe14cbb5", "value": "60910edad1306e12fb166ce703a5a590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ae547e-d85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681211777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211777, "uuid": "7721192c-f0e6-4acc-bebe-366ed8de349e", "comment": "Malware payload (Quakbot)", "value": "b319877fd7197191294d810bc5df4731", "object_relation": "md5", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "pw-R89", "colour": "#BA6515", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211777, "uuid": "1703603a-6bf0-495c-b278-6de5d46fa36c", "comment": "Malware payload (Quakbot)", "value": "eda21db9913898a5490d219bfb4ce63afb114b8fb2ba0bc2586205e926b609f4", "object_relation": "sha256", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "pw-R89", "colour": "#BA6515", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211777, "uuid": "c7c7bd95-a2cf-47ae-b71c-5e128fdb7855", "comment": "Malware payload (Quakbot)", "value": "0e987a897ae24576700b6eac5a465351d0997024", "object_relation": "sha1", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "pw-R89", "colour": "#BA6515", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681211777, "uuid": "ca90431e-31b7-49e0-a550-3c42da050738", "comment": "Malware payload (Quakbot)", "value": "85af3c076e4fc4b31c0e8c9c17e67d9dc405b066b3eb742d51f0abbf53ea705bde2344961bf4a58729ff97cbaa3933f9", "object_relation": "sha3-384", "Tag": [ { "name": "1681201433", "colour": "#27F127", "exportable": true, "hide_tag": false }, { "name": "pw-R89", "colour": "#BA6515", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211777, "uuid": "54eb4436-dc73-4c29-8dd9-755e55d0737d", "value": "T18E7312B160716A7EC9FA1CE68F9067ABE4371D14E3D00A1DB5039AB9055C9BD2BD31B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211777, "uuid": "ec9cdda0-fdba-4759-a73d-2e875164906c", "value": "1536:8PI9WGSQr/SqhdJX08ljvupZmDBjrxSHsGguFy4SkYhofmMZ+qMT:ApGSQbhd908du8BjW/jc4SYmJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681211777, "uuid": "46c716fb-2cd7-470b-a3b8-a694abf5eac3", "value": 76287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681211777, "uuid": "92c3db58-4f53-4c8e-8ab3-72e56d1c2e57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681211777, "uuid": "545a17cd-7188-4cde-ae98-63b334779b59", "value": "My.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb02a20b-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681208991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208991, "uuid": "59223eb2-f966-43ee-b3fb-1e8158aa869d", "comment": "Malware payload (AgentTesla)", "value": "4ee74cf90f4068431ae3ce0251075ece", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208991, "uuid": "3230200c-46e1-4cf4-a7bb-b55bb89b153a", "comment": "Malware payload (AgentTesla)", "value": "ef43e76f7c68c4be46fd63dc1258efaa572b9119c4ae4ef1f3111cb9e5a6d25f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208991, "uuid": "d093bac6-ba06-42c8-b130-40444d8f5a38", "comment": "Malware payload (AgentTesla)", "value": "79f8214390b5ea2e91dbb5fc1158b51414584093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208991, "uuid": "fcaa7ea5-3a89-4ddb-885d-c4046cf7fc41", "comment": "Malware payload (AgentTesla)", "value": "1f960df109e52b5fc70ad63dcf57e67e4783a99af00e968a9222f1134cf8c9b62f33914b00aca4bc6e475f785315c66d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208991, "uuid": "19e7930e-3454-489a-98f4-f9eeecd765bb", "value": "T14DF4121ABB830774C1288BB5C77BD55017B7BA4F9BB7D3803E8401482DC1369EA59BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208991, "uuid": "7fdf5595-00fd-46d5-af3e-20fff13e6a70", "value": "12288:28Xt2NpS30orZXOqy3zzLicrRB5OjNzRHz+g1iX:2lpSDFOqy3zzLiclB8NT+LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208991, "uuid": "f66d8d28-2873-4146-81c7-106a3e4a668d", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208991, "uuid": "a01ac8f4-d810-4253-ab92-d0113370aa78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208991, "uuid": "3b5d335a-bbe7-495f-a568-dc4e05ba94c4", "value": "Yeni siparis listesi11042023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3588a6bc-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1681218619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218619, "uuid": "541d74a3-bc2f-46b7-a9e5-33fc8e6e2396", "comment": "Malware payload (WSHRAT)", "value": "ea0abd3283c83ea38f1c2aad7946bc93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218619, "uuid": "90c239ea-9c7a-42e3-b7f6-e56083871d1e", "comment": "Malware payload (WSHRAT)", "value": "efccf4f22b72889b0b4ecba893a50e92faf48b3cdf1eee9680929b7ee4445305", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218619, "uuid": "1b722ae6-a3ae-40e0-8efb-2ee8bb3578ec", "comment": "Malware payload (WSHRAT)", "value": "78996225f4275c638e3ef885a9093e0cc87b36a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218619, "uuid": "882f44fb-db0a-4e00-b1e2-ccf95f4e1ce8", "comment": "Malware payload (WSHRAT)", "value": "89c2835922a8b3243188544c68e59ced4389fd75cc89ceb4b28cd1ea044859d4708ee5834d5fd4af70090fe056ae3061", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218619, "uuid": "a2d25dd4-1a92-494d-a117-8bb1c2b3ae67", "value": "T18125F9C628F8191457A7E6F4C732F232ED65FB123D9221C279D83A4ABD36C047979E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218619, "uuid": "e3923806-2042-41c8-b3d4-746982f67a2b", "value": "6144:MQGNU8Hyom1ly4GmCSJ3VuxTl/LpDC72aKdLrDu1A65F0yUMtcTK8ekCAaDm+tfq:Xees", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218619, "uuid": "b126bea9-145f-4c00-a2c1-b8112a4336d9", "value": 979168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218619, "uuid": "5cd63b18-ff77-412e-8d9e-b79ae4ecde75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218619, "uuid": "7041df60-33c0-4a04-b571-bd3751ccb88d", "value": "proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c220eb5c-d85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1681214130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214130, "uuid": "cebfa0be-4ee8-464c-b55b-b781c360236d", "comment": "Malware payload (AZORult)", "value": "c1b98fffdc47e435eb6b6d09decfdabe", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214130, "uuid": "d8abb9ea-ac54-4513-bd78-9bc0523bb8ca", "comment": "Malware payload (AZORult)", "value": "f00cdfd984eccedd6447987cc68bb5f308954f393e855440a69ff6d565e74794", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214130, "uuid": "74aa95e8-72ff-40bd-ad7c-cc7d432c6662", "comment": "Malware payload (AZORult)", "value": "bac0baf876b9d0b3c5bfa16c26b58ba0dc66cd84", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681214130, "uuid": "6adb53f0-69b9-470b-a52b-4360d2e76e72", "comment": "Malware payload (AZORult)", "value": "5cb904a81f83d29a324f4f4564c0078b314f52f740c4c968e08182f1b147d815c32313d11f4e4571ca94a7456487e46b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214130, "uuid": "85f6a3fd-6d11-48b5-a2f8-c404e7117e96", "value": "T18CC5BE724383BED6C3FA497AD4932B044F94EC676318839774C6386E39F96749C4A8B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214130, "uuid": "bd3698d8-4ed4-4ae2-8c85-f96f9081343a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214130, "uuid": "f8c46eef-48ac-4ef1-a9fb-2dda9e09f2eb", "value": "49152:jQC6dby5XQNmz4ZM/GFNuc0geCmNX1bt:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681214130, "uuid": "9feb8fdf-bf39-4a4f-a66b-36e8b9480b24", "value": 2532864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681214130, "uuid": "ec3e199b-6bc5-445e-bc95-38a3262eb0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681214130, "uuid": "5a9e37a1-ac66-4717-8425-31f3a5deb6db", "value": "c1b98fffdc47e435eb6b6d09decfdabe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7709665-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1681205549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205549, "uuid": "73d1792d-0f06-4a3b-9312-83aa28f22ec7", "comment": "Malware payload (Fabookie)", "value": "0d0b7eaef798e705fe89a27c5ad7350d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205549, "uuid": "d0fe46f3-1da3-4afb-b1dc-1dcb041f5af9", "comment": "Malware payload (Fabookie)", "value": "f090f83873271fbbc0b7426de0051f76463c16e1a1d5f63f57af630704873778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205549, "uuid": "416fbae1-9c46-45ef-a3ea-545aec9c0283", "comment": "Malware payload (Fabookie)", "value": "f0e9f4dd1070b1b6a2e6963f61c3e315c68fc430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205549, "uuid": "dddd9b32-2543-4a1c-81db-2946ee598ad0", "comment": "Malware payload (Fabookie)", "value": "d4e06a661421979ff6410b63233d42f94503be88a109df76d0771e4f9662b22a3f39d3917a9c3d354812a8d92dd5cf45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205549, "uuid": "a6bd9c24-e8e4-47b7-9f62-0a9bdbd757ed", "value": "T1C8A49C59FB5018F4F52B8139C9A5854AE3B37C581B71878F13A8735A3F337909E2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205549, "uuid": "6ec2b644-6607-4ce1-a2e1-f677a3726c1a", "value": "693a6ebe3623e39a6750f0e1b476cfe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205549, "uuid": "e4227e8a-ac2e-49eb-aa6f-a07543f97be8", "value": "6144:IwCOBKAoxlvhDhuGrN5BD7LFYvbUexibj6UDQgVJAiAhYl:dPGx51FYjUeMnEhYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205549, "uuid": "ff75ba06-1b09-4f24-9705-8db4a66b8f71", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205549, "uuid": "870fa374-ce02-4c7e-8a42-a4a592b292f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205549, "uuid": "e8257bac-d28b-4525-96a9-875f22da4ef4", "value": "0d0b7eaef798e705fe89a27c5ad7350d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad6745b-d8a8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681245176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245176, "uuid": "1bf1251c-35cb-4874-b221-80bf0b04d861", "comment": "Malware payload", "value": "a82b900ee2a9b68e80dab9d2ebe153c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245176, "uuid": "c0666ca5-5dd6-4995-ada8-a63b47820fe7", "comment": "Malware payload", "value": "f0ce4eb1e9eaf4012c7f76b0d4c8abfba6c56eb70127fad6151d2b0396d8e7c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245176, "uuid": "a4c487ee-f105-446b-8b09-2d670ddcf62f", "comment": "Malware payload", "value": "0e61b2de1975df344067cf2d95fcfa88a61650c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681245176, "uuid": "d3ee8dfb-e5f1-4294-b303-65aa2aaddedd", "comment": "Malware payload", "value": "9a27ed56b14c80700814d95de3ce883c4b8b82a3c023c5846deafa38638c8358b80a39860cbbd086b50a86aec4fec9b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245176, "uuid": "0e77b143-9d2d-4e72-8bf8-1d068bd79ec5", "value": "T196252392A7E88073EDF82BB458F113C30E39BC919D78872E2385958D89B25E1D532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245176, "uuid": "4010c7ce-916f-4112-a8f6-17368c18540f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245176, "uuid": "5810d798-e1a8-4a22-9d9e-5028fa1ec0a1", "value": "24576:nyNM7bQeUa15XmfOEIafKbmtVq3csq9g8x7glpX8AbJfcB:yqbrfS2GfDy3cV9d1glZ8AFfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681245176, "uuid": "8513e742-0281-4a73-b45d-dd0c9c498342", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681245176, "uuid": "4cc7f0b3-093c-415c-b55f-0c225a485387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681245176, "uuid": "3552f88a-dbf7-4e7f-8a80-89e6a5fb94a6", "value": "a82b900ee2a9b68e80dab9d2ebe153c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45077cd-d84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681205490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205490, "uuid": "13ff7751-0cbc-44a6-bfec-ed48781af162", "comment": "Malware payload (Rhadamanthys)", "value": "3ebaef779873c7eac11c21461e6f9105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205490, "uuid": "499a15d8-5eb2-4d3e-96cb-167cf647133b", "comment": "Malware payload (Rhadamanthys)", "value": "f31a6e441197f51326a179e1e4e64f679a057515fcd7c3dd3958638329e51b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205490, "uuid": "68ff995a-ca1d-42e9-a90c-a647c8573e28", "comment": "Malware payload (Rhadamanthys)", "value": "a9b85babed0297e392196477c9ac6bb615d4ad48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681205490, "uuid": "2472ef47-1ddf-4578-a9ab-28f22d9408b6", "comment": "Malware payload (Rhadamanthys)", "value": "d949873555830907f637d3617acc7f18c26dedddad9d73be53103633b970293d4c33c18004aeaae6619428a8dc542089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205490, "uuid": "acaf663b-5f07-4e46-bb99-fff29d014582", "value": "T1AC36AEE23A0BD1EFE2528474E842D903962E53E18724DA11FD5B3CBCCB13D5B66C6B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205490, "uuid": "240f6566-8928-4580-aa24-a39532571d61", "value": "5502dbdd579c1fb27fd18a21a20af6e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205490, "uuid": "6b1ad62f-008d-4e80-9e9c-0c3d9c06b3b3", "value": "98304:3Wd+O8EdFvBCK1PX4C8jchf3VlGKRZq3zBmZEwwXoXnBD:3WoLwFBHX4C8j4qQupwAoXBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681205490, "uuid": "dcd9d50e-0bc1-4247-81a2-f632c98adc77", "value": 5263248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681205490, "uuid": "bddb0759-2d17-4fbe-b9dd-86d18bb4eff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681205490, "uuid": "add39bf1-120e-4439-9236-87bf87247d0a", "value": "3ebaef779873c7eac11c21461e6f9105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f065f2-d871-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681221816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221816, "uuid": "822c1627-1165-4e7d-af28-d2bdcf85a70b", "comment": "Malware payload (RedLineStealer)", "value": "a71b3aaee7b25f9c2f0060ef71c2bbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221816, "uuid": "c19ae2cf-830c-4bc6-b126-fc01f69d8ba1", "comment": "Malware payload (RedLineStealer)", "value": "f3925f6dc4f8d53a51bd3127557903c46048842649c717ea1d0aa779870c57e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221816, "uuid": "7dd72da6-bde7-4afc-a315-110ec853d528", "comment": "Malware payload (RedLineStealer)", "value": "5743ba259d526c198dabfc4833d5083e59f266c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681221816, "uuid": "d5f32fb7-3255-4f93-9b97-b5f5d6e032bf", "comment": "Malware payload (RedLineStealer)", "value": "2254f85cf027b4bcdf2a724b622b4541baadcf30d6202a4fd50e5f70c5709b48dfc6681a636c8d2cb4659f7ce16856ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221816, "uuid": "a4b84247-349f-4d52-b9f5-ae692eb7fdb5", "value": "T11A2537466AB23DFEF5194D3B6734C7486EADA711323341EAE50237DA8D160F0D71EA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221816, "uuid": "e98310c0-1996-4731-982c-1c0ccad2825e", "value": "ccbc6e933399fed0dbcbc126444168b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221816, "uuid": "5dd269d4-3747-4e29-86aa-cff45cc397da", "value": "3072:KtrloMMzLMg5gLmDhLZR7amNsj/VFEvcljwmuxKq0mmzD0+dBqz7MtUDPgsfoMA1:ebiZ5gykLMIjwmuumm/JA4UrgSADZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681221816, "uuid": "89614ee7-17d4-4a43-a74b-7909c398de04", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681221816, "uuid": "f81cd43b-2dab-4495-bea6-3734477d6a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681221816, "uuid": "d17f3342-32fc-44cd-9c48-2722034e55f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed5341e-d853-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681208890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208890, "uuid": "2daf7262-6541-4b5a-b7e4-8c76e4163e4b", "comment": "Malware payload (SnakeKeylogger)", "value": "256dd2321993259eaabbd0cb17d5cc88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208890, "uuid": "d34a8931-5ccf-4e2a-b537-6f030903065f", "comment": "Malware payload (SnakeKeylogger)", "value": "f40be72c7955897463c26c4c33332fe8c24b4937962b1b85e840d132e74a4c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208890, "uuid": "4f5b6f2e-9381-4a48-9b9e-71c134be028e", "comment": "Malware payload (SnakeKeylogger)", "value": "c3f7a85d0f483b01dfe1699bdad8252295343a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681208890, "uuid": "337cc8db-e4e3-4c9c-a5e2-b8974990f40f", "comment": "Malware payload (SnakeKeylogger)", "value": "591d5b254afc8b21cac92a495e485dd5a0dfa5588123f3e99b1493454afaa587e587763d006487d811a8cf8bc0eb8bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208890, "uuid": "a3dcda6e-58e5-4f1d-9b4c-a4e589927006", "value": "T118E46A102258C3E9F5E1B16E7534491713F1780E9F7CDAB1CA62B9E379967CB90C2A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208890, "uuid": "f82b9440-63ed-4319-ac8e-131aa47fa763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208890, "uuid": "36cf1c43-eb99-4e30-9d8f-9c69207cff6e", "value": "12288:o9k00EQ3eLCvH+3UEi6b8nU9S4hYG+qScOtPlzmZzK:oy0TkecH+Epk8nCS4aJcoUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681208890, "uuid": "626aea31-195e-4da6-bae5-d01acdd97b4b", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681208890, "uuid": "6c2508bc-0a77-459c-9cdd-6e59a9e6b7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681208890, "uuid": "f1bfa005-d0b4-4ace-9520-e673188c5c99", "value": "Catalogue Profile - Qingdao Wisdom International Supply Management Co., Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29df533d-d802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681173932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173932, "uuid": "51510d2c-e82c-4949-be1a-54b6d269895b", "comment": "Malware payload (Amadey)", "value": "7e06278d43d39ed525a81654ea2d7b3b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173932, "uuid": "04bcd830-26db-40a2-b67b-faa2a948a414", "comment": "Malware payload (Amadey)", "value": "f42af60c9dc9d5ef4139ce2dc2c2ddca0e211dc6ce0e19fa104d2c5887cf95d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173932, "uuid": "01adbfab-5a5b-4b2b-ad4f-b62413d85583", "comment": "Malware payload (Amadey)", "value": "203ecdb6868360e1a79c52226c40a5a53682a461", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173932, "uuid": "fba37110-7f0f-4f2e-964f-c9a55b3cb991", "comment": "Malware payload (Amadey)", "value": "ab2d1c9ee0fb67d9c3ef4743f3adb03ffcc75708f3e64b68a2df1e81ab2dae0351f123a417f3b6f10d78fa1d93032330", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173932, "uuid": "5dcbcd73-1655-4945-8e44-ecd568e70bff", "value": "T180152392D6D88475D8B553B068F713C32E327DA18D78C3A12784AD5E0CB29D8A471B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173932, "uuid": "15373dad-92ba-47c1-9dc2-94a1b89e2955", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173932, "uuid": "d8498129-2011-448f-bc6f-0c60e9577cd0", "value": "12288:kMr8y90WLe/zIU3khlRorT2Fu05jVZvx1+ifymlOqC009LF7uBZsIg7ARp:gy90IW2lRptjVZvHxySy7unNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173932, "uuid": "8fb71bde-05d1-4948-8376-5f436ac4ef24", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173932, "uuid": "1d1353d7-cae9-442a-a799-97e9180cd698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173932, "uuid": "19eb04d1-759e-456e-a90c-6e339cffd4b0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f4f318-d802-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681174031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174031, "uuid": "29649e7a-3d38-4d58-bbb0-761ca06baf7c", "comment": "Malware payload (Smoke Loader)", "value": "1e2f21247ca7a062cafdc57ecf5f63db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174031, "uuid": "4aab9aaf-03c0-408d-8290-30402f1553fb", "comment": "Malware payload (Smoke Loader)", "value": "f53c4a372085256073c111d18915b826f87c0ee281c01d6544be55a61ee364d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174031, "uuid": "07e929bc-f006-409f-9654-ae11d63c7dbb", "comment": "Malware payload (Smoke Loader)", "value": "031926e9af4d68916882192e6dd76b022cb17af2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174031, "uuid": "ebf26f5f-0b68-4fd7-a4fb-79bd116dcfec", "comment": "Malware payload (Smoke Loader)", "value": "2f726359120e5a3073ece52734d5d5e53b1045956d4181f5115f8e94dad8936cf6599582423161bfdb466df267c224bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174031, "uuid": "5040130d-70b4-48a0-b3b8-8ff742b06452", "value": "T14514D021BAF1D0B7C45B46740831D993BA7E7C616365815B337817AB7E30BC08AAAF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174031, "uuid": "008cd19c-3a08-47cc-b69f-a1ca215f0bf3", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174031, "uuid": "3691d424-4781-42ed-bbda-a71ad35cdd0d", "value": "3072:QQ28cUJrWF1q42W8qrnY9MBz39f3oIKfi4nLZ4112hdG6:/28lqWSjiU3aIK6yLq1qdG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174031, "uuid": "665ea0af-986c-4193-a558-a19d46f0adb7", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174031, "uuid": "4fd18b6a-900f-4c15-a198-f6e1c1d6791f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174031, "uuid": "d9c45613-3ea5-4e07-9f73-24010bff7bc3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5504da87-d8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681242724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242724, "uuid": "8e55e417-08d5-4646-8096-f1a43b3fd919", "comment": "Malware payload", "value": "3d7ab1c80bfaa80597583cab7f7bd93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242724, "uuid": "b30f876b-86fa-4440-b894-88adb9e54ee5", "comment": "Malware payload", "value": "f5851b57e9662d765ef24b112f370554d51e93fe7065050cc20925c7165212b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242724, "uuid": "271ec6d8-f551-44fb-afa9-3e887d313790", "comment": "Malware payload", "value": "573d9fe35d88f1037287a2a88790aa2023c6b80a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681242724, "uuid": "78fdbfaf-5ce6-46b6-a158-56bc9d275c95", "comment": "Malware payload", "value": "d954983f2c247f42b09e5ec623c5ef0438a5c19adc037a034892653dcf3416a79d2451609fefe670c225d6ca4c7820bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242724, "uuid": "e0e9d6a0-13ab-42fe-a29e-e157a7d2b290", "value": "T1AB24CF31F6E1C072C56B4070446DE6E03A7FB9715BB9CE8B73686BBA1E30290576731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242724, "uuid": "8514a447-93df-4afa-ad48-7f70e04b4cfe", "value": "b1fdc126cbffd1158f4f7e2df2177ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242724, "uuid": "f8e14ea5-30be-4b07-95ca-a121c150f450", "value": "3072:532U+q8Ny7ufHZ1hseyj8uTTCHnMT9KaFaA1Y5NcLUfJ:9n+qFufSHTTCspKa4A1QsUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681242724, "uuid": "40e60ff4-9be9-444b-964d-8ea6c5d3f3fb", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681242724, "uuid": "871a64f1-8766-4827-aea0-eb260fa70871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681242724, "uuid": "ad1d24dc-0eb8-4cb1-a205-1cb68d5599c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ba7392-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681238997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238997, "uuid": "cad491bb-c81a-477e-874f-61551b24e104", "comment": "Malware payload", "value": "56da98a60b906b22a756798f409b57c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238997, "uuid": "031fa6b8-5350-4e19-9063-63c12db4e3ed", "comment": "Malware payload", "value": "f62fe6646047d7c5a7b445793ab595c3f747c0daba16b2f6c1942f28067b2247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238997, "uuid": "4fc99bc6-578c-4fb8-9527-c23a0a48b2ae", "comment": "Malware payload", "value": "3ade96a40816aebb558e6f51e2eaba59a5926629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681238997, "uuid": "f0f5b556-6a90-4803-ab36-8b8c0401860f", "comment": "Malware payload", "value": "9ddf985e000a363c94aa9242147b120745cbdcb6c5dabdc2e5399454cf705ed7e0eb3071ed063f3ecadd5ada225390b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238997, "uuid": "fe5dd0ed-74c7-4843-86b8-3fa01562d6c2", "value": "T1EBD5330367A881B1F032DE345E215F25AA2BBFF6117C54DD71AC6A9C9F7B481BA50B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238997, "uuid": "4031ef99-6a58-45ba-b123-e8e82c474750", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238997, "uuid": "b526bcf5-1f98-4cf0-b93e-966551800e98", "value": "49152:zGlJfs+UG6UfiLqT8IscGsQ8/EIh3I5YOrvcDc2AeilbKBRd32WHygU:qlU9UqL48IJdQ8/EIhY5TQgCilb7WSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681238997, "uuid": "1be6c447-550b-4866-9cd9-d5c1d848c993", "value": 2856081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681238997, "uuid": "6c0a7a46-e4f6-4ba1-bd75-b56cf8589a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681238997, "uuid": "60882cb5-a086-4233-8ba1-a55a33c16c7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f232429-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681215172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215172, "uuid": "cd05bec5-dd24-4dd7-8a19-8237857cff75", "comment": "Malware payload", "value": "0479c73227855f30c779c73a419b82fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215172, "uuid": "d249fbdf-b847-4a46-9896-d09f48475d00", "comment": "Malware payload", "value": "f69fe47b45493435767ef633fa0788cfaafca7ce8bea782ca305c5d5627b1660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215172, "uuid": "bf5a6db2-3277-405f-b803-12b3401a2f90", "comment": "Malware payload", "value": "6f91a36c33475097ef1d6f9b65e9fdae12b80735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215172, "uuid": "75f7e70b-4c1f-4f6f-8ddb-be3da1f5ef12", "comment": "Malware payload", "value": "74ca474422d8aa523d53c646e42a7695bb19e8ee561c173888bae0294e84f5a94e7429660f8047472334e30ed0051b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215172, "uuid": "ffa2bc4f-c8c8-41a3-a582-021c323ad854", "value": "T173F5E6CA07229A96C66B3D7790F9771697A8C924CF8FFF135480F4F62C9AB666D01103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215172, "uuid": "6303ea0e-3fb7-4eae-931a-8aa8eb5cd033", "value": "49152:A1H4VI6/UGwPVGv8i5aU0Bc21/K2Xd8nGozc30L:TD8GwVAn29XbozcEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215172, "uuid": "2018be74-fd20-4218-b260-3c4a39513dd3", "value": 3646903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215172, "uuid": "ff1f5138-e4dd-440c-9b8a-0081b54de6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215172, "uuid": "1f79c619-e9eb-4832-a12d-a970770c88e6", "value": "0479c73227855f30c779c73a419b82fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebce9d5-d827-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681189858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189858, "uuid": "562b96c3-aab3-4bd0-a634-3f388f3dddee", "comment": "Malware payload (RedLineStealer)", "value": "19d54dd6e5e92294d5bfd4745c0fa087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189858, "uuid": "5761c11c-adce-40b0-b38b-eacde24e145b", "comment": "Malware payload (RedLineStealer)", "value": "f6efa72d5b949196d3afbf43a6084bcde3815c017afe86c6596d0efb0c50604a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189858, "uuid": "93f32849-445b-4174-90bf-1bffb59556c6", "comment": "Malware payload (RedLineStealer)", "value": "a2b7277bdf04740e59bfd628ac5f124f36ea9d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681189858, "uuid": "ed82dc03-92f5-4211-b4f1-0756d876512d", "comment": "Malware payload (RedLineStealer)", "value": "c214e885fc3fa267b721afe9787f18200992b0e87fb6b69d029262e0c4414736d8f4b88f3d3ad4338651c60d4b244388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189858, "uuid": "4a1be2b4-d612-4a72-9d6b-480614c4de94", "value": "T18264F12176E2D0F2D86B493C4960EEAC6B7DB871A2718147135813FF2E306E35A7E716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189858, "uuid": "4ffa3341-bd4f-4eae-bcd4-f4fba5638ca2", "value": "5776a082f00d7fcb0bbece689ae36b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189858, "uuid": "df6c79d2-7495-4e14-9cd0-b1690e4a86f2", "value": "6144:s28dESUHrzYGyE9MD4hQF//XwlsbinGDK5pu:2LmHi4yArG+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681189858, "uuid": "2c915b5a-4dd0-4689-9b26-bf8b72ceea90", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681189858, "uuid": "2038cc3c-d7e2-4918-97b3-a8a97928aebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681189858, "uuid": "dbab7ab1-e1ba-49c2-af9e-37a1db30e10a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ac879c-d800-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681173178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173178, "uuid": "46911597-17a2-44d2-b482-2aa8660ab7de", "comment": "Malware payload (RedLineStealer)", "value": "8d067dec40a3cd3a879df959b6269808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173178, "uuid": "6f88d746-f258-4a0f-84b1-06edcae83818", "comment": "Malware payload (RedLineStealer)", "value": "f758bbffdc08b6e0af179dd25624ff38dda04b6de1c59cc20721cff93ea4d8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173178, "uuid": "086443fb-b32f-41a1-8e7a-153d79ac16bb", "comment": "Malware payload (RedLineStealer)", "value": "6bad3bae2440d3c886e810de4f7b2fe41f0441f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681173178, "uuid": "ca01b7bc-f354-4d2e-87bc-34e239608ce0", "comment": "Malware payload (RedLineStealer)", "value": "43c2ac8f5023692d973be030c4fb24fb945ed36ade4b173af472d5bcd6cdf3322614eb23971475b504557512b0828d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173178, "uuid": "897e51fa-7883-4863-b547-f7c2791bb0bc", "value": "T103051203ABD84077ECB417B06CFA03871A36BD5259B853A73B86992B0E755C0A87537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173178, "uuid": "ddf3757a-18cf-4f01-9ec7-e17514497dcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173178, "uuid": "705b5ecf-7077-4955-b586-d1aeac2b9ddc", "value": "12288:TMrjy90LWv1VwNQ43wx6slOVpCakdR8Moqt+iQXmQPp3M4FfDrOWyQRhFqv3qY:gy0306s8Hlk0qtuXzx3pFfnOGRh8vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681173178, "uuid": "ea654028-d647-4b2d-857e-4aee2afa4694", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681173178, "uuid": "59b3fa5b-4aec-4982-8f3d-bb725d532427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681173178, "uuid": "1070bc1c-282d-4ed6-aa81-fa2c0ec61a72", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1a4f9b-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681215139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215139, "uuid": "1f7a0cbe-b5ea-4a14-a1a0-8bb71f139ba9", "comment": "Malware payload (AgentTesla)", "value": "cde4729c6a3b855fe819e30cfbd4c4d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215139, "uuid": "2091c671-5e5a-4c09-b624-6b650d4ba900", "comment": "Malware payload (AgentTesla)", "value": "f7c258efa0898ba87a2828799a80359633961a62e639f08ef3498167fb2dd80d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215139, "uuid": "49565dec-4668-4f1b-9411-89a949c19027", "comment": "Malware payload (AgentTesla)", "value": "93d1f7bbc3a38efc2d0480ac6144d4c90b2c0d40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215139, "uuid": "95c4c9e5-8239-4707-8d95-77c98e7ec8d1", "comment": "Malware payload (AgentTesla)", "value": "633ec137be4bca6116261412cddf50e1d86e2fc78a2c580707520878d3095c66049d2deeb17ab61097df75eec8140310", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215139, "uuid": "4ddbe437-90b0-44eb-9da4-8a0d332748f2", "value": "T11CF47B112194C3E9F5E1B16E7534492712F1780E9BBCDAF1CA72B8D379867CB94C2A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215139, "uuid": "8cdc01e0-acf3-4631-8ae6-2c088372a06f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215139, "uuid": "5a8e33f0-dd4a-41d6-b67b-a8815bfae0ca", "value": "12288:ruK16g/OpZ4Y0N+7lrHtJ7K88dcnDV6gD3K:Sc6gBoNJ7KghND3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215139, "uuid": "e04204f0-66a4-4ab8-9892-805159f55e04", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215139, "uuid": "9f230aef-a680-4c20-9802-15d459172981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215139, "uuid": "4e0d11f1-2c4f-48d1-af93-e616ba479243", "value": "cde4729c6a3b855fe819e30cfbd4c4d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b868d571-d86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681218839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218839, "uuid": "659a470b-e7aa-4352-98c9-0d3c497f692c", "comment": "Malware payload (AsyncRAT)", "value": "cb7929cf1abc35c3360f0c675995a551", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218839, "uuid": "7ed9878a-ce6d-4382-ba26-d06465df53f3", "comment": "Malware payload (AsyncRAT)", "value": "f8569a28afa079072bf1faf79e715dda7513e382dc423fc5ee07ec2f54223d24", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218839, "uuid": "60775dd7-255d-4ea8-bb1e-35db37de340d", "comment": "Malware payload (AsyncRAT)", "value": "fb773340fe210e3693b4b339696d9b849d4ed4e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681218839, "uuid": "769cfcc8-a0bb-4a53-9f21-8076917bfb16", "comment": "Malware payload (AsyncRAT)", "value": "953c1658cbe2af0b5910375e5a7d6bd0c3b7c0fcae66fc866bb61b506f9f499529f792064586963fef241dcb06174a43", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218839, "uuid": "6e93f946-a6c3-4a88-9912-5f621255bc90", "value": "T196E3AEA6B2D1C859C94843764CD6C7AE3727FC615F3B864B3258F76F2E73A808942603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218839, "uuid": "6fcbf0c1-28e7-4f7e-9436-b55fa874d5b9", "value": "3072:FnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAki2PFXSQZb86A4ADAHdVUJgOmCM1y4K:VxEtjPOtioVjDGUU1qfDlavx+W2QnAkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681218839, "uuid": "19be7187-6ddc-47c0-b761-0aff51ea19fc", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681218839, "uuid": "bc59c9a9-ba2f-4467-91cf-bed7de576876", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681218839, "uuid": "e2aede62-5423-4094-a313-08e691556052", "value": "Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171c7e5-d843-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681201862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201862, "uuid": "6cd56171-2f1e-4358-b261-c826cf6bc19b", "comment": "Malware payload (Formbook)", "value": "ef484876fb2a05ee2775f3a402bd2db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201862, "uuid": "291d1f75-9f5a-4e5a-8015-ccfbd6f4d0e5", "comment": "Malware payload (Formbook)", "value": "f96d103be6f5190c2e3299c0f49d88003f84abb0a20a90220c6e5376635eb617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201862, "uuid": "51b0284d-87c6-42dc-aebc-19bf9d4159bd", "comment": "Malware payload (Formbook)", "value": "d7f22708549f5b9707fe1e3cad865880912b657c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681201862, "uuid": "fe74a29e-59f9-4eae-83b0-d7a602ced43f", "comment": "Malware payload (Formbook)", "value": "53845b91818814dad93fc8e5fc813e1a38d10e1e026eb05b611d70674ae61a8b788f6ee6bd8df0819f095e491e1c99ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201862, "uuid": "d5079d43-6dbf-45cd-a2d0-ffe0dfde1963", "value": "T13BD4F10A7C10554FDD659A3388639BE22EB36D3D89F4161113FABE5F883338679AD183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201862, "uuid": "a12a86a1-a837-46fd-9748-898661b0cf29", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201862, "uuid": "59d197d3-859a-4d99-86e8-92c22203c25d", "value": "12288:Gh+G1bV46sgMPf12pTLjLueg/HXGB2IHFO/kwfRChEa+CeKd6:Gh+G1bV4VXn12pjL+/HXwHO/6hEjs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681201862, "uuid": "4fc28fa7-8170-4d40-a386-c64575e986d8", "value": 630200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681201862, "uuid": "3cf6b2e7-27a8-4f96-9683-6bf9faff9ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681201862, "uuid": "f5e4cbce-0612-49e4-b7d4-3a38ed17aba6", "value": "Samples.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b73d0f-d848-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681204122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204122, "uuid": "20b44e4f-06c2-4ec0-b48e-77c60bd5dd32", "comment": "Malware payload", "value": "cfe361a242e37ab31265b55615dbad3c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204122, "uuid": "5972ee59-8f20-4e2c-93df-1316f0a80e46", "comment": "Malware payload", "value": "faa58bfb779ce23aee0e28d7bab18e5a35830377b85d6e091ec30fac0aad4096", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204122, "uuid": "fb74db4d-b04a-49fc-9aae-e00157d68a6d", "comment": "Malware payload", "value": "209326c64c4073deacf5f9d934b997b7982be638", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681204122, "uuid": "64b4dd39-76bb-4bba-ad8e-b7194525ac65", "comment": "Malware payload", "value": "cacc859af072d9fc7c40321ae46597cba676c64af11ebda85a3f17be42cd7b2a8cf6f9b2d1fc9df728be395125d663ec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204122, "uuid": "cdd06d00-2b0b-43a0-a00c-4b91a64e9fd8", "value": "T106D5D306FD92CE2BD6A9C9364C96C3FAE7797C429C008613716D731E2EBE724990D742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204122, "uuid": "32894d45-819c-4d28-b98c-b49950f47a10", "value": "24576:+iDfJTbD7fAH2HDMyGw404Njr71NS9Ag5SpNHRhFGJ9GLSSSEEp82ULHNYU/tIU3:+iDBTbXf+E4E4tt1s9Ag5sxhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681204122, "uuid": "8a574e91-4bf9-49a3-9eb6-756b6cb2c062", "value": 3008512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681204122, "uuid": "45ac81dc-81eb-487b-8c91-b7057a805560", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681204122, "uuid": "9b8616e5-63c8-4984-872e-c0c4a8d7a0cc", "value": "Acta 06-23 RCCAN 28-03-23.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0cf597-d854-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1681209100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209100, "uuid": "d3e69ecd-974c-4045-bfc8-249cc4f27bad", "comment": "Malware payload (STRRAT)", "value": "593ae8ca133439aa77d4b3bc52428886", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209100, "uuid": "9ca1c131-fb6e-46b0-86f6-b822fc5fb862", "comment": "Malware payload (STRRAT)", "value": "faf661d035eb600b7495d07ab6280a89f24ae576c752dbc9ecbb4b10937eb385", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209100, "uuid": "07af1eb8-e89a-41ea-85df-281cdaf39d2b", "comment": "Malware payload (STRRAT)", "value": "64c26151a10cb6b5283ed0720f28216bb751cf58", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681209100, "uuid": "dac7c354-a616-4afa-ae9a-dd364199cc59", "comment": "Malware payload (STRRAT)", "value": "5acd6b9459eac745267b004f0914b27cfb129fa930e12f2f403231adcefadf74052743758664384f37e7a5907053038f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209100, "uuid": "4510cab3-d691-4b29-8518-8faa6171324f", "value": "T1486302CB76FD9CB8D22BD2706048D52AD94BC0E4819CDA9F396058D82877E422F16FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209100, "uuid": "5cba0937-b592-4341-9592-f59fa2172fcb", "value": "1536:2BAGxmqCEh1dTPXK3AcPb4OaZB2EJv2obAaEQM2YXfUu:nTuh1GzoJJvX5EQ6vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681209100, "uuid": "91fe0492-d672-44f6-96eb-a4580640d155", "value": 71617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681209100, "uuid": "7531c1b7-6c8c-4760-9c99-4ae29aef12c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681209100, "uuid": "1d415a5c-6193-49e9-ba00-4fdbcbc27c99", "value": "Fiyat-Talep-Formu-KRK-STF-230116.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c19eba1-d850-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681207517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207517, "uuid": "c71c1d15-8af9-4a2c-aa7e-8e6f55fb4836", "comment": "Malware payload (AgentTesla)", "value": "68d7251256ce70df4e442b244cc71b97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207517, "uuid": "d9194892-e840-49af-89ae-6dd87225b9d3", "comment": "Malware payload (AgentTesla)", "value": "fba068f26d48585e164c9c1722e359cb307b058684405a03c91d51c7b2a3a859", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207517, "uuid": "0c6be70c-37e7-47c9-80bc-316f0defe672", "comment": "Malware payload (AgentTesla)", "value": "81bdcd91830a3d70c124f7a3c060b1aae642daa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681207517, "uuid": "fd45fe3e-2977-439e-8aeb-6319b290f4e1", "comment": "Malware payload (AgentTesla)", "value": "5c1783483b340e6fe6b88d9bbb5f554c4aa61f20a4917f221a415b9cbe37b3ecbff42bad8fdcc3162afb6167a511e99b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681207517, "uuid": "71e592c5-a4cd-42a6-b23c-f4428cc11cbe", "value": "T1E134F156DF9BD853CA2A8FBAE0D884045770E302AC53CBAB3845C3085F937DA6F62751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681207517, "uuid": "e958dbb3-0f39-409e-bbcb-394a3054c6dc", "value": "3072:E7MVk4y1r31G6GzBaVIl7Sup2pzSePPT5cQ9hrQ9RWNupw1/Qe6sT3zIbpMxYAvs:+b862Mit4/7hYY7/gq3zImYAaRZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681207517, "uuid": "e663f882-848c-480a-9753-a9e9f65cb7ca", "value": 247528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681207517, "uuid": "b0a63635-ceae-4f33-a9fa-06ca27d92896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681207517, "uuid": "609f5805-e1c0-4e75-abbc-cfc3a4d49de9", "value": "Purchase Order_0504023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfbcd5e-d833-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1681195172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195172, "uuid": "f8cf29b2-80d9-4a17-833d-e0f5e86cb610", "comment": "Malware payload (LaplasClipper)", "value": "288a06e42d98f0624269f33259a8d969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195172, "uuid": "32573d8b-ae65-4d78-85bf-a7f5d9c547b0", "comment": "Malware payload (LaplasClipper)", "value": "fba703c00aa3908fd7bea1806af74aefba3f3657bf52d0f1e87cac54dd0230c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195172, "uuid": "83a87ff9-ad83-452b-8fb5-9896091129d1", "comment": "Malware payload (LaplasClipper)", "value": "c7aeda50137ddb61af5e321d3612f1cbaac6490a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681195172, "uuid": "831d3a26-3dcf-408a-b607-aea6988efab3", "comment": "Malware payload (LaplasClipper)", "value": "267449aaa067b34379ae6f60f6af351e6b5127a6006493bf87d17f76a3b15535215ada22054f71a98723da96af8aa577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195172, "uuid": "262cfc88-c900-4653-ade5-e6e71ab16fc8", "value": "T13E9523127ED0D8B2C1631A7619785B12683CBD201F7ACEEF73941B5ED932AC1DA307A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195172, "uuid": "0aeb6b2d-4ff5-4c06-b597-88a989654705", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195172, "uuid": "58a3ccc4-728b-49b9-825c-2575a1176525", "value": "49152:IBJjYbVrAXDZhV4hkxcJmjKpEybB5TUXhrt8:y9YVrAlf4hkWKnBRri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681195172, "uuid": "81121ccd-87ca-4e57-856a-f98d15ee80cb", "value": 1876161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681195172, "uuid": "33b9f3ed-c1cf-4ba9-a72e-f03df6a1e5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681195172, "uuid": "8f6dbd1a-e452-4ddd-8f89-0b0c4cc63323", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cafee8-d899-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681239000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239000, "uuid": "a2daecfe-42f5-45c3-924c-5623984f57e0", "comment": "Malware payload (Smoke Loader)", "value": "1bffebd33b082b8368d149c1b8f38928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239000, "uuid": "ef238a7f-8b8a-420b-b02d-b4f45d545044", "comment": "Malware payload (Smoke Loader)", "value": "fbdc19dbb89bb01c43913a961b6f508726376f3c14678effa22a2056d1e275f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239000, "uuid": "f15c4fbe-8846-4f24-b18c-1fcf9daf274b", "comment": "Malware payload (Smoke Loader)", "value": "cf9ad99a106f99f1bc27a292709f44b26001cb60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681239000, "uuid": "e4d4e974-5543-41aa-851c-6a4eb7b7ee13", "comment": "Malware payload (Smoke Loader)", "value": "c8a5b3ae142814ae9cd09394fd1ba91cc1c6989d51490cbf1ec33301df4c259b9d7b005492d1d859f43fffa150034d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239000, "uuid": "1738d7d9-5f3b-45b6-91c0-11147b3b752e", "value": "T17624C032FBE1C0BFC0AB45B04520DAF06A7EB8755365858B735417BB2E306E1A76A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239000, "uuid": "cf1cb8ed-042b-4be7-be41-26658ab3a43b", "value": "ab082a716c28869a457cab71ba8dd878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239000, "uuid": "f91d6b2c-3b78-4676-94c3-8516d74cf1c4", "value": "3072:+3BpgqWe2kraztXC2R659KX4s4rnBizrvwViOY5Sy1l:aXgQazhSa4swM2iOzyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681239000, "uuid": "f74a5687-7e4c-466f-9c9a-3303f698d144", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681239000, "uuid": "c09eca1e-5dd6-4ec7-85da-5963a02a76d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681239000, "uuid": "3cec901c-053c-4dc5-b4f0-0dbd72849e92", "value": "1bffebd33b082b8368d149c1b8f38928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b210fcd-d862-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681215192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215192, "uuid": "fa83e0c1-ab5f-4813-bd60-b4ee90931dca", "comment": "Malware payload (GCleaner)", "value": "33d4a80974c2ac2966c637de8979624c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215192, "uuid": "076763be-b75d-4ed0-aab1-edd5dc9efa0d", "comment": "Malware payload (GCleaner)", "value": "fc46bc8d84655018b9ca234e564fa2edf3574948084ec4c621ac3793252b5105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215192, "uuid": "edb48c8e-d2e8-4805-9c41-6a960ecfceb8", "comment": "Malware payload (GCleaner)", "value": "b3685b990a615bb4ee900e563060f92c40cf6aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681215192, "uuid": "9f157bdf-a1a5-4ac8-b8ba-88328e498757", "comment": "Malware payload (GCleaner)", "value": "8629f422cc0b86d0da3ff8bc783f9db43a3ebafc955e30da1bc20cfcc64a6c0cd2bb3b8c4187eedeae496fd6bedc0f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215192, "uuid": "0aef08d9-d359-44a8-aad8-55642a064589", "value": "T1B8E5331376EE0832DAC4A0737C8FCF48D57AF561602A8558B2F49E4E2FA7463F946163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215192, "uuid": "2f90a997-00c6-4156-9f19-62e8aef25cf3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215192, "uuid": "fa2e2125-eed0-4576-b18a-a1cebf6dd4c0", "value": "49152:zGlJfsFCxUK+F3tUzFx6mz3WtLALE8+SxWfbZFEewEU9cquu3mBQAAWG6ejY5zbL:qWg+FexImitLsEmxResWZumQPszbtWSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681215192, "uuid": "83bec9ec-0c06-4543-b4b7-1f08c22bf2ef", "value": 3153775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681215192, "uuid": "543869f8-e7b1-444b-bd4a-548c4fdf08f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681215192, "uuid": "1ee3d42d-fc2c-43b3-99ec-4c404e989bc7", "value": "33d4a80974c2ac2966c637de8979624c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e69d372-d803-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681174369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174369, "uuid": "72a794f3-279f-41f1-88fe-9c8ae4ce146d", "comment": "Malware payload (Rhadamanthys)", "value": "1d920ccaef05304ff3ec98c36b939bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174369, "uuid": "4f1eb136-7d29-4c69-9cf1-e703ad2a5556", "comment": "Malware payload (Rhadamanthys)", "value": "fdf13054ce36b970822fce63b773fefee26fdd59ccebb43ac1fce60383ba444d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174369, "uuid": "141d4a26-3396-4944-9c3d-11b2bdada34f", "comment": "Malware payload (Rhadamanthys)", "value": "b96eaf6f020c431faec7d99b6a5bf8e1d2a33c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681174369, "uuid": "614295bf-6f31-471e-bda0-7e7c1857a5e4", "comment": "Malware payload (Rhadamanthys)", "value": "af4cc95b6bcb244857dd8bb010f2786326021815b0246a833f3e826f21316c3de55cb7e10a85def65f863f4d81d7bd0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174369, "uuid": "54f1eab8-09f0-4e76-8cf2-907c850ba636", "value": "T1FB36BFB13A06D1EFC2520874E592DD43E57823E1C714AA26FE68B87C89D7D1A32C67DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174369, "uuid": "8aafff6c-a9e9-4a36-b3ad-5f3977bf08b7", "value": "6b77fb36c366e35e2dee08a56dd39ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174369, "uuid": "dbfbe4fa-ddc9-4209-b1e0-aaaec1a36c25", "value": "98304:Sd0g/dfAHI23IuhXOAu0gRy2nVO/rwUH0WExWm+60vA5kSEGUjBDO6M8Ups:s0qd4Hn3IgMPRy2Wwwst0vkNzYE38Ups", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681174369, "uuid": "f3727d07-202c-481d-9d81-fa3143718c4b", "value": 5165568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681174369, "uuid": "e4b028e1-4f0b-4930-a23b-45ea7a674b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681174369, "uuid": "b9fa6e9d-4166-4fef-8fb8-bdd81b7f1b31", "value": "setup_loaderfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e91103-d836-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681196316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196316, "uuid": "e6741817-d9ce-4f9a-92cf-48b1e58063c2", "comment": "Malware payload (AgentTesla)", "value": "de5d30424fc0bd614e697ca4c13836e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196316, "uuid": "85152fd6-8e41-4020-8bb8-996f901bfa56", "comment": "Malware payload (AgentTesla)", "value": "ff5d9b59e241d651f0b4fbad64ec3977f4ee579af082096b16251c3363ae93fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196316, "uuid": "50f77c9b-59af-4730-a29b-fbd4da46d6f3", "comment": "Malware payload (AgentTesla)", "value": "97e2a538d3b534a82db82598b9276e7a6188e643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681196316, "uuid": "1f9f4e36-5e20-4ad8-a411-a79b3cfb7252", "comment": "Malware payload (AgentTesla)", "value": "1be5ca75c56bee7c36c48d8c2427a9259cbb8c3f01c72370e15ed05f077fe9df9c3af4420aa653696001784dfe4d1d20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196316, "uuid": "44a53795-cf1e-4059-bc90-fab2e107b66b", "value": "T1FA54BFCD765079DFC82BC972AAA91C64FA6074BB531BC243A01711ED9E0DA87DF190F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196316, "uuid": "1c93603f-3866-48a3-a34f-86aa7329ea28", "value": "6144:FKKF23iM4YZg05gTwaYirbgh6GLkdrM7aA23XI:FbwiM4YKa3zLiM7aA23XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681196316, "uuid": "3079c8e9-1fa3-4102-b1bc-07ff09bc3d23", "value": 282856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681196316, "uuid": "eb82d2fc-3952-4e9f-8f7e-a60fbd979b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681196316, "uuid": "74a53870-2374-4806-9f98-4ac8a041f3ac", "value": "Shipping Document_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }