{ "Event": { "published": true, "date": "2021-06-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-03", "timestamp": 1622764981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "420464ef-d51f-4b1e-881f-bf3fdee017c3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd869288-c452-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622714547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714547, "uuid": "27e04438-c84a-4388-b756-d7935bb6caa8", "comment": "Malware payload", "value": "2eb7adb48baacee947dd75d01e686f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714547, "uuid": "b2972f9d-c2e4-4547-aab2-c7a1c11a20d8", "comment": "Malware payload", "value": "00a7740f9a5e8b3d55865bad1c390d2990322c5927f566ee9dec620b7fcd8f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714547, "uuid": "c4692ccc-41d1-48a7-9056-ca966d2fe7b2", "comment": "Malware payload", "value": "b9ad1f73ef303e58970841efbe6e26a683ee91a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714547, "uuid": "ae6b64d1-7979-40c5-b332-f6aba03c7ed1", "comment": "Malware payload", "value": "c999c4d88864ed804dfa375c98ffb2678897b9d0ced30eb22d0642f3fb39c5fd31dd99e24e708ef4ef789da6bdc1354e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714547, "uuid": "3bb0fcc6-81a3-4b4f-bf9c-2921171212d1", "value": "0955E7907E54C7B8ED09D732AA5C5C794BB0B2AD10023F3C9F9D85A82E77B45AADC413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714547, "uuid": "901e6c0c-4b26-47ac-931a-b9f69be0f35d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714547, "uuid": "e8e7f31f-6e83-409f-b6d7-5377376f167d", "value": "24576:SooUB3Cs3PZyqTDiyiUyuf4u+b3tWVtNk0qoy8z/WZ:fPCbCiVUfL+hWZqoyK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714547, "uuid": "13e985c8-9fae-4fd4-ab12-b68815278802", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714547, "uuid": "937a9cb9-822c-4ad5-acd1-2ce6fbfe6e57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714547, "uuid": "add86932-4c42-4f7b-826a-0b7abd6012ef", "value": "2eb7adb48baacee947dd75d01e686f1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0e2b3d-c447-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622709847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709847, "uuid": "146ef17f-c683-4363-aad3-caa3f03292e4", "comment": "Malware payload", "value": "4fe65bc2ea3beb0761c9237b01bcc5e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709847, "uuid": "9200663d-fcae-4ac9-895e-dbadc11e2522", "comment": "Malware payload", "value": "04745022109b280c8c102e89bdf2e147b5c4022cd550702b5d7572647375bb11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709847, "uuid": "b90cb07c-df73-4253-9c1a-c0fdfa726586", "comment": "Malware payload", "value": "e431c66333bfd44834e5594b7ec4538562adcc08", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709847, "uuid": "0478cc7f-5986-4f72-9f60-1e759a8a06d5", "comment": "Malware payload", "value": "0d0ff3299e87fec8a282f50c87738111d72bebc0060fb4161d9c5ea703aac7b32b95dd879a6d3e562fbff67e62e1e72c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709847, "uuid": "aa30d655-f74b-4220-bf28-4bec8e6d21f2", "value": "83A13504DDB908699637732587AFA405F89536634288968E7A9DE5C00F7602098FFDB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709847, "uuid": "83974726-e6be-4e8b-b816-2c6425e81b7d", "value": "48:m1Ic5dVme+z5/tRmnYhF8+D1CTgYQ4S9aezPsbnliAXoGed536n0QTDZgu5ji5b:m1ddVMl2YTrhagYZezPSldXv7007Zi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709847, "uuid": "908abf4a-4662-40d3-8ade-77ba9a8a0170", "value": 4633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709847, "uuid": "c17c0dba-5020-411f-8d39-89df09f46e1f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709847, "uuid": "48041d33-e373-4f3b-beae-1a0a34541a81", "value": "PO_rocky_mountain_accessories_254.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbf9652-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622700049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700049, "uuid": "765e575b-8d2c-4928-88f3-42623be23451", "comment": "Malware payload (AgentTesla)", "value": "e4b67965a00485562baf05c1a22cbf49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700049, "uuid": "20867d25-8b83-48eb-82c2-f407a1cd111d", "comment": "Malware payload (AgentTesla)", "value": "04826eeb4d21104190dfb002657c616a669577a5a5a16da88ff50402faafa25e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700049, "uuid": "19d52d6b-d7f5-45b4-be5a-5264d2d737cf", "comment": "Malware payload (AgentTesla)", "value": "b2de803d37e80e13d15fb0699ed5fc0e0f86494e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700049, "uuid": "17019dad-7fd3-43d0-943f-36a88ecc6812", "comment": "Malware payload (AgentTesla)", "value": "708f1e6aa42b70ca502b626a16d3c80b9f5e8545366329f128da4efd0b4589f274201445f7259c661f3f9dee075dc82b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700049, "uuid": "20022816-6cd8-4547-897e-c31700b24342", "value": "8385945EF645C9A4F3499672CDDBA9F842AC4CBA96022F370B72FDC43E32352851D846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700049, "uuid": "c332f2f2-2e8d-4d9b-acd8-088d29ae35a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700049, "uuid": "2fea5a6a-0902-4387-aaf1-d1485001ad22", "value": "24576:aDjtlhwCtJkm4qgUUcwGO4dWUM1aCPgaD9IdGUx1cyM3ziyn1OhXIxgQvrLyzj6b:avu+fqOyxjvrL86+W2ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700049, "uuid": "5d34448e-9c61-4a67-b3c9-db5a64e2b755", "value": 1866752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700049, "uuid": "df3f3543-09be-40ab-ba31-6eac73987897", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700049, "uuid": "536fba1c-a285-4f5d-b983-c137a0d9d527", "value": "tB15iC3ImLK3MFX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3369d212-c433-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622700974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700974, "uuid": "90d2b1cc-1d0e-4aaa-8d7c-b3e179b1986d", "comment": "Malware payload (SnakeKeylogger)", "value": "701c50d25a1671a8f8be89dd0576e14a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700974, "uuid": "a42fd018-4d5d-41c6-98fb-8c1376a7ae14", "comment": "Malware payload (SnakeKeylogger)", "value": "05901a31da4889fd6b10cfdf7a27f560bd169776848f48bba9e53f19afa7830b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700974, "uuid": "61ef3350-97ab-49d9-ae1b-ab925a3e81db", "comment": "Malware payload (SnakeKeylogger)", "value": "71cef07891d686834ec654825c65af9400293efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700974, "uuid": "e8266b94-3733-4af1-baba-ecafdf4c05f7", "comment": "Malware payload (SnakeKeylogger)", "value": "46fd0835867f120513b3c2be9a5da64c8b3a9bc57b93ad4bfbbf98bf4d5a781e0fb1cbc85bdc7c451ae0832a4f151023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700974, "uuid": "1ea3fa6f-1819-4b44-9be1-daa6f99500f9", "value": "D475D55EF5A68EA8F3498673ADDF682C42BC41F526012F388FB3C5C8AF523528558C57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700974, "uuid": "e8ed654e-7d21-4f8b-bcd4-1f3d707b9cd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700974, "uuid": "3c916500-e7ea-4139-ab9e-df72db0308d2", "value": "24576:+kLUoYzYaFBF2HiEVKhCdQ+BxZsmyW5xnaI/S5Hq:+kLUoO+Hsm1l8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700974, "uuid": "a8a61e1a-be82-4d48-ab3a-84869d6140e3", "value": 1594368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700974, "uuid": "deac5013-6ff8-4ee0-a9f9-fa33153a27fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700974, "uuid": "2c4cf68b-3c96-4e63-8e36-a716c8a71f07", "value": "7T2P3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3344f5b1-c476-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729751, "uuid": "57ecbf9d-9f44-4fa1-a386-5824089b6db2", "comment": "Malware payload (Quakbot)", "value": "343fcc9641043b8546446937e3576610", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729751, "uuid": "62d05968-0219-4840-8438-4d947b0cfbe8", "comment": "Malware payload (Quakbot)", "value": "05cf8e6cb6e2bccd213ed810d8f9d042d7d6fbb08060614f8503255b374e6c41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729751, "uuid": "d396d760-78d5-4d78-9f9d-e94525b7356f", "comment": "Malware payload (Quakbot)", "value": "4c7df28a3d48d7e3bc8199b78dc485427b2abda1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729751, "uuid": "fe537900-a25e-4c94-8735-b04937f46944", "comment": "Malware payload (Quakbot)", "value": "31173241b558b1d63b89538ba80954fe43a4773ab9977afd8615be4cb9b4d0be61b59d59c68a975e3584dfdcaaa7282a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729751, "uuid": "416f7c79-766f-4798-acd2-77aa48d18a60", "value": "CF454B01B694E435F5B60AB96AAEF0E8562D7DA00F5D50CB73C02FDF5629AD19C3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729751, "uuid": "189aec83-6d27-4ea8-acc8-b17b673a0c34", "value": "6e31f7ef3a3092fdc488764688222205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729751, "uuid": "77772e87-7081-4bb4-9964-ea14d5bc8522", "value": "12288:nmNDiDQ21Elifgbhc5ZbqWDyALUvNi8KaEIgeteiDqd+Ci6T1l84A79hbi:Mek2CBhcbL8vEnEnZC1Tz8r79hbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729751, "uuid": "889ca78e-5e33-4238-9294-e92e3b302a51", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729751, "uuid": "8e2b59aa-3b76-467d-96d9-6e98eaa4308f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729751, "uuid": "c6cf54a0-d237-40cf-9cf6-6cf10bb94688", "value": "343fcc9641043b8546446937e3576610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ab33f6-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724393, "uuid": "3addcd5c-ba50-47db-ade8-4aaf5c62fe50", "comment": "Malware payload (AgentTesla)", "value": "884dbc27a793e0e380b7582ea98c178f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724393, "uuid": "5850844a-902c-43f7-b5f5-1db21529451a", "comment": "Malware payload (AgentTesla)", "value": "06a8281107b05c63126092693b8d60ce670eac28f3ea41a7a2ca4b338093dc45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724393, "uuid": "d0fab21e-2fd9-47ad-aec7-abedb9f3ec8b", "comment": "Malware payload (AgentTesla)", "value": "4824cb9a9409608463e497fe8e734440abfc6833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724393, "uuid": "e2eb7f8e-36fa-4961-ba5b-6dd164021a86", "comment": "Malware payload (AgentTesla)", "value": "cc0c13d97184cbf128f59e9ceffca0089551fbd916515e08fbfef2f3d9aae90b3467843801b9b611bbfe78613db04a05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724393, "uuid": "ba10ce8e-8ec0-4ec2-bf3e-d403aedfdf7a", "value": "68257BF4F59898B1C54EC732C691ECBEEB211DFE5203092D05B9FA8D2A3378A9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724393, "uuid": "59e0c89d-3c5d-444a-aa67-bd507168ec91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724393, "uuid": "f99579bb-ac59-4643-827a-59e4e214ece4", "value": "12288:Eh8vTbt3HRKa8ZI6dKd+Wc60WpEK6rHIait7szRYvtPTvpgd:ltsawjbWP3t7savNxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724393, "uuid": "dd3922cb-7021-4c0a-bf92-be1173b26465", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724393, "uuid": "a9981237-f653-485c-a4da-b9ab4813c81a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724393, "uuid": "5f6b4521-e549-48ee-a291-6d1b74bf0a6e", "value": "884dbc27a793e0e380b7582ea98c178f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffffdec-c483-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622735463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735463, "uuid": "0814a6b4-f14b-4bc5-a3d5-3798e8671fcc", "comment": "Malware payload (Formbook)", "value": "d627b1707bb0081d326d8e57ff894013", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735463, "uuid": "1eb5eb3e-bb18-467c-ab18-e2847356377a", "comment": "Malware payload (Formbook)", "value": "06ee38b6f580cfff67a8d24d827e98155091a83991cd7ae941d347fd4d60d431", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735463, "uuid": "f8eb63a5-3543-4a33-8964-bd24d2ec738c", "comment": "Malware payload (Formbook)", "value": "2b347da280c64f674a69b655e4039976211da95c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735463, "uuid": "a7ecc328-a566-4e4f-ab54-1860368685b2", "comment": "Malware payload (Formbook)", "value": "2b16b968cc805642ff55a348d68c90aab5fd0452922d31bf1e62559c04668b973db0100f3ba86a2d346faecf732e2967", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735463, "uuid": "a299e415-77be-43b2-be03-5130d31f1d47", "value": "4CF423E5D81A5B9E5E7DB35F1E30C38D2B320612F413662D9208F64970AF5A3FA8B0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735463, "uuid": "b4decfac-eb94-4dd3-87d3-bd23c7cc98b4", "value": "12288:KLcvUY0vJ0XcUwgvgK7D6J0Lqcr+P1R+YGafmoeWc9EBcCz/A/smh:r0h0RwOgAOoqdwznoQuBcCzxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622735463, "uuid": "e7e6b135-1ee3-4fda-8675-22ba7176d829", "value": 778162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622735463, "uuid": "66c31773-5a3b-4658-9208-b663c1797abe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735463, "uuid": "941dc6af-591a-4239-b47d-055f923526c7", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824ce186-c487-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622737185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737185, "uuid": "45fc7f83-b2e5-49ca-a5d4-d0abf65071b4", "comment": "Malware payload", "value": "741042113bbdc2ec732d0a98fb8618d5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737185, "uuid": "2563ca75-9a6f-4eda-9524-c29ea8b7592a", "comment": "Malware payload", "value": "094212a0051057e5693d826215a3dbd6ffc5722b78dc1decd2b91c7608f710c6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737185, "uuid": "f4cbb249-02e5-40a7-8508-0c6ab10d8c06", "comment": "Malware payload", "value": "888fdbfd943962a81fbcb84d7f3dd0ea61110b61", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737185, "uuid": "632253b8-b1c9-4c76-af52-eddc089fab69", "comment": "Malware payload", "value": "b388cd990f98f7df59c55def99bdc872dc6f01a77dddf09894da9df8cadb1fbeec16649e72202ed368807dd7a075e104", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737185, "uuid": "75659273-1a2f-4b0a-8a99-3759e77cf08b", "value": "BD8119BA14781C68CF2E44E3D6F2FAE101F3714642E66884B14EABD5032A7326821CA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737185, "uuid": "8b8593f7-76a8-45d0-b2ca-8703017096b8", "value": "96:4gQ1c4eYISR9mKobWduMGVTyee+/R+Mpsyym4:4gQ1cgubWI2eeCCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737185, "uuid": "cd7a0001-a199-458d-8a22-fc6e68b7bbaa", "value": 4006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737185, "uuid": "5f2db8ca-a2fa-46ee-be18-d1c766585613", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737185, "uuid": "adf239e1-6e5e-47f0-84a0-81ef8750f5fa", "value": "PO202135SG.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3ac1af-c49d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622746566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746566, "uuid": "b6b57679-934f-4c6e-a588-af2a41d539e6", "comment": "Malware payload", "value": "f1dbb43cf9f7409787142ff2606f5443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746566, "uuid": "244bfe16-1c28-45fd-ad9b-4180e48d442d", "comment": "Malware payload", "value": "094d68a9aeb12348f01c5110814af938ac67c880166652fd5b471f9ac4c93429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746566, "uuid": "8ada40c1-d46c-42a5-9aa2-b2702276713f", "comment": "Malware payload", "value": "30bef5c65abf9ee8030732eaa31de3271c68f101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746566, "uuid": "12402172-f953-4430-acdb-13b7f83baf2b", "comment": "Malware payload", "value": "d4d60fa0620bad44f958a7eda19e06524fe7c78b711171335438b23ed5d91b0db9b666b6225091f335aa5b045d547273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746566, "uuid": "1ccade39-d636-47b9-be9d-6b49b3f766b1", "value": "F835392439FA501AB173EFAA8BE4B9DADA6FB7733B07645D105003864723A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746566, "uuid": "c0449483-ad5e-4a7f-ad30-5ff1051e4506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746566, "uuid": "14506e06-48ef-4218-830c-90a6d8736cbd", "value": "12288:V650F0V1IDXcnx7GiGZjcij9d9IgkH2w1z7PV13XMV8c8b9RYgyIOUS7kgRRvpKp:Z00YAcHrDZTYgnCPMNWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622746566, "uuid": "a25ff17e-18d7-4019-8962-a5283fe560b5", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622746566, "uuid": "4a316a92-e5ac-4bdd-a30b-551025d191d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746566, "uuid": "be0bad2e-749c-4df8-90d0-67e37f8ef18a", "value": "scan-copy059950059pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455fcb26-c471-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622727633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727633, "uuid": "d5b2b883-92ab-48d4-b38f-ff11b0f22f3b", "comment": "Malware payload", "value": "bb6083080504227cfd11967ccddadb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727633, "uuid": "a0538ba9-f16d-4949-90ef-7d35c45ee7c2", "comment": "Malware payload", "value": "0b023d7405d41bc29a95c2acf1796c3a1b9fa70279d9402903ed98dc6d2f3b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727633, "uuid": "bd006801-dba0-4cb4-8c29-6883284a74df", "comment": "Malware payload", "value": "54045c3437624f25abb5cce2b5f5fdf7b8f19816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727633, "uuid": "3f9ded6e-740f-47f8-8867-c6cfac1a0bdf", "comment": "Malware payload", "value": "6f638a91cbee4b69d5cbec15e8e103e6fc58cc6260e5de22e123c068fd0c874ca58c20de2553697f4af3ba2986370bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727633, "uuid": "cb16d7de-3f3d-4f7c-86c7-3dea22aaa0f7", "value": "329622DB5D4546B3C7AEF47220A3373C022F987E6BDB4E6DC51B3E0153721AE64A211A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727633, "uuid": "ef1b9a75-cdc7-4b3c-bce6-94e2c558c32f", "value": "196608:nNtAebb/9UeAFe0+B1eY6YI1vgYVeeYB/KPwMLvo33N0tPpgAyCi:Nd/OHFe0+CMCgYV0NgU39IGAyCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727633, "uuid": "2e63dfb0-7b56-4b0d-99ae-b9568d42f9ec", "value": 8772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727633, "uuid": "de69c20e-a57a-4321-b066-f132a47e5e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727633, "uuid": "47f6e966-8480-4347-b328-41978ecdcf04", "value": "SecuriteInfo.com.Variant.Bulz.498529.31996.4100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3a5500-c4a0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622748105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748105, "uuid": "ba7c69c9-50f1-4025-883a-ceb09a60c5c0", "comment": "Malware payload (Formbook)", "value": "5ed95b2716f9707e431a71871658a426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748105, "uuid": "14e6cba7-1038-4a13-9dc2-84cbce297888", "comment": "Malware payload (Formbook)", "value": "0c3d534f9d39f802e50ec5d61b2256192f5f3b8bb1e6908a6dcd2a3626582a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748105, "uuid": "90e9abc1-cbd7-4632-8992-a100bfd4d83e", "comment": "Malware payload (Formbook)", "value": "1ed6f29e947a9325ddcb25b9400f9679d5e98558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748105, "uuid": "cde26d30-633a-4478-98ef-cd3b740e0e8d", "comment": "Malware payload (Formbook)", "value": "684a599f8f9dca85024ee1efd5c52d649469de7350243c84a9ac01612e27bdd040778974322d0972dbe23292c9a64a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748105, "uuid": "674bc44d-de22-4003-85a5-dea43368cff2", "value": "B5159DF8F5A899B0C15DC776D7909CADE7A211FE5303892C0AB9DA8C1F0378A8F5D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748105, "uuid": "3fd0616a-6d69-4376-8d25-3daeb54e6e1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748105, "uuid": "1163a51a-6415-4cf1-961a-2f81ac02bcf9", "value": "24576:cf8WpWtc4ozpehz1/Tl2f+gB1wUIy0QD0N:KBIz17Mf+gB1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622748105, "uuid": "25f39ca2-6b70-4d52-977f-3a03bc78f027", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622748105, "uuid": "53ac9414-2e67-40e8-ab3e-bb590e8f1555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748105, "uuid": "eb67b4f3-e208-45fb-8015-27a1c20aa9c6", "value": "SOA #093732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c853f0f-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622700158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700158, "uuid": "bf946550-1bae-47f5-9d85-60a13098ce47", "comment": "Malware payload (Mirai)", "value": "9b8fa13a357cff4d37e36c4e29bee24d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700158, "uuid": "c17b252e-a755-48c0-b6ce-f816af255160", "comment": "Malware payload (Mirai)", "value": "0cb79e7dbe4e41f64c150047bad2b9c07ed9941de2ff938908ace345a2862f16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700158, "uuid": "3af7327b-f412-477b-b952-7a5912926269", "comment": "Malware payload (Mirai)", "value": "16fb82e48f6c1978a8930ed401cfde172df2147a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700158, "uuid": "5106391f-6bb8-4057-ab4e-eda77cc501b0", "comment": "Malware payload (Mirai)", "value": "3a81669861c34fec30662acae6e3c708732feda52ca2f0500fb4028d868a28c31982bb3448c1cb3211a80955161677cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700158, "uuid": "87317faa-2217-42f8-8ec2-487171cf529a", "value": "442302432093BA03E43058FA45228CCDB55EA6BDB1BF7BA725480E154C35DA3ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700158, "uuid": "fc5a9031-822b-4f04-8895-40b1bc26ad45", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF39q3UELWt/iw+kvBGg6+fYtrBHK:P12O1LCNguovDPH7TcrELWhiw+kvBGgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700158, "uuid": "4894ed76-0029-4340-83ad-af310e1ae81e", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700158, "uuid": "20e90931-6859-480c-9276-bc964982f893", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700158, "uuid": "dbedc218-c87a-4573-9a90-7db625066616", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ce11d8-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622738137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738137, "uuid": "940c9f71-71da-4a25-8059-d59163d4dca9", "comment": "Malware payload (RaccoonStealer)", "value": "9d8c7ac5f187791b701c916c35911821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738137, "uuid": "f15650cf-e469-42f3-95d9-59e43ef9ce37", "comment": "Malware payload (RaccoonStealer)", "value": "0d6e106e13ca046d0f19c9d0e9542f9142c5a9172b2cf9e2e764519f72514d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738137, "uuid": "61c88855-520f-4e91-a3f5-e859b6beb6cc", "comment": "Malware payload (RaccoonStealer)", "value": "aeaad2abdb996190fe24e6af8a8eac355572dcf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738137, "uuid": "52a76f82-c9e9-4cd3-b163-3b3eee6e9e40", "comment": "Malware payload (RaccoonStealer)", "value": "ffd39a1a37180a328ed3039906ae1f7017f5667ee0f7feb4697650e08361c78bff9e738bc65c75e279aa7e3799355aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738137, "uuid": "549db2da-be6f-4676-8b75-0f0f22eff2f7", "value": "6DC4D010A790C035F5F732B489BA82BDA5397DB16B2460CF62D52AEE16746F0ED31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738137, "uuid": "6865035b-e106-4a85-a0d8-d2879636fe50", "value": "cbeae8361a19a91fa1242808c9b08b0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738137, "uuid": "9761647a-ad49-4cdd-8e3b-9eda1dbd3c7d", "value": "12288:IAvCH9RwiZkuz11lpwMjkqmkCCJ2vi7FLDr+3eyBWfZGC:IAmOiZt1y4C/q7RDrlUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738137, "uuid": "db9e7814-47d7-4251-ad08-8401d863580a", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738137, "uuid": "729a46bd-8308-4c62-b0f7-a8ee3b5225c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738137, "uuid": "5af23398-63f2-4567-9199-6f65dc34eb73", "value": "9d8c7ac5f187791b701c916c35911821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673dc127-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1622700202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700202, "uuid": "e81c63ef-e507-429c-ba38-95e6a227c51a", "comment": "Malware payload (Heodo)", "value": "529620cdfb580d07f0ff18f610b55d1b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700202, "uuid": "e68c6d78-376f-423f-88ac-192a468bf3e6", "comment": "Malware payload (Heodo)", "value": "0d79850b4670c318bfc7181b937c1a828eed27fd2b7892c33887cb356c6b359e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700202, "uuid": "25e64e48-2805-4317-83fc-7d6b73dcc349", "comment": "Malware payload (Heodo)", "value": "643bcd7b7604597f4e5dc379ca495f5cc2be2bf1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700202, "uuid": "5f7d75a1-5c22-430a-bdd4-6daef23cb874", "comment": "Malware payload (Heodo)", "value": "8e59ca952f9771940d9090823123d02685df02b3cf84a629aa9c11d32b2acb5a1ea80d1d77fddaa8209a9ce2a7d950e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700202, "uuid": "54b0d243-f190-4a4b-9a5c-ff5276ef403e", "value": "F3158DF8F1A898B1C54DC772C691DCBDEB210DFE5203092D06B9FA8D2A3378A9F59445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700202, "uuid": "9f041a62-e8d6-4c8f-bfd4-d8735f68fc39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700202, "uuid": "f4d9f98c-6ad9-46d2-b893-8ca8af10fac7", "value": "12288:ea9qmvTJeV74m2FTaA1C0AA/6VoVCcTT9QI7NbGQ22z1q9MPmyM2nvLV:xqxazTaA1C0AGEoVCQmWGFq1qOmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700202, "uuid": "e3bc09a6-fd2e-4b22-9e10-60d23df9f5a2", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700202, "uuid": "8a4e7b5e-00ea-4571-99df-1abe6392a5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700202, "uuid": "275e3b5e-21b6-4e4d-ba87-8a7394c0d4fa", "value": "Scan_Doc_007007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88303c69-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1622703264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703264, "uuid": "51bea41e-f3c2-4482-8072-57d7392d174d", "comment": "Malware payload (NetWire)", "value": "eddc29896f0f6dc74fb9746d22be40cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703264, "uuid": "ac1a7924-f140-40bb-89bb-af3bf57b477f", "comment": "Malware payload (NetWire)", "value": "0fda1a21ab1ba27664e58228ab32452ed711d4ae1713deadbe20aac8cf193041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703264, "uuid": "eb3ddfbd-8b0d-4174-9906-66a82c4e6090", "comment": "Malware payload (NetWire)", "value": "9a94123aaa7c0aa998d2eb09a74e20cf9f1d9715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703264, "uuid": "6ae227c3-4349-452d-ae90-0e3dde904a24", "comment": "Malware payload (NetWire)", "value": "b91dd7762c1aa180a20c41ee9461be04171d222871ff23e8261466304b11eb73e7b2053691fe55bbcf00b12178e5cd9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703264, "uuid": "5877f008-2aa8-4391-ad36-6d2f3a568293", "value": "0F158DF8F59898B1C54DC772C7919CBEEB2109FE5603092C06B8FA8D6F2378A9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703264, "uuid": "a60b3bbf-607e-4288-98b0-59768bc4f315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703264, "uuid": "170b4c52-f869-4524-8a86-23cbdd2834ad", "value": "12288:PpZOvTGwLCePFmBmVIjeIGPXbkwwwDOSW5JO3iocAe25vOWFla595PC9gaLKOV:jl1e07eXIUOSW5Jhoc725G159Q9xLKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703264, "uuid": "d413dd66-695a-4e62-aac6-a4ef8f181e71", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703264, "uuid": "88eba45a-32b0-4d38-9b4f-3088376cf6bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703264, "uuid": "d68a99fa-724b-49db-98d3-692bd531a79d", "value": "SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c611345-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622717874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717874, "uuid": "faa2e80d-4f60-4644-88ef-b96404b05336", "comment": "Malware payload (AgentTesla)", "value": "9de7dac414eb27813a810892a854d547", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717874, "uuid": "f9648a22-e3dd-406a-a0eb-82e31b64f44f", "comment": "Malware payload (AgentTesla)", "value": "109a7e1b2430a3f0e069181d0353fff1e7ca1bb4673ab59bbaabcb63a40abbe0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717874, "uuid": "f96c227c-f0c4-4238-8bef-9ca9517072b7", "comment": "Malware payload (AgentTesla)", "value": "62ec7eab4beafeb4a8bc956298795a9fefa49809", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717874, "uuid": "3bc3502c-96f8-4963-8e5a-1df7e0aba44a", "comment": "Malware payload (AgentTesla)", "value": "886eccc5582aeec85245d641344e907f3504f792dd8c1ae93e772e8e87634dae0655a393279bd5e58434ef41977f4af9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717874, "uuid": "90b70501-fd14-44cd-976a-32df2a79e317", "value": "C6157DF8F198A8B4D15EC772C2909CA9E7625EFE53438A2C05A5F68C1F3378ACF49445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717874, "uuid": "552c919f-22e4-477f-9986-2a50bea26ea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717874, "uuid": "721b571d-42b0-42e8-9020-927d88606661", "value": "12288:CG4wptx1bF7xhZhO4PW/07E4eKGOrJ/nSPXL6Gz5rSX2k0vT:AwZ1h7PxpQKVrJ/nSPXL5VOXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717874, "uuid": "c4c3b8af-bc05-45e9-95aa-4dee46b3df73", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717874, "uuid": "5161bd8b-371b-4d49-9ff4-8ed35685b831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717874, "uuid": "41501938-dea5-4baa-98f0-cecd3bf4b61b", "value": "SecuriteInfo.com.Trojan.PackedNET.796.15879.17383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4e3eaf-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622714307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714307, "uuid": "c6afb0e5-53a3-4985-add0-2e317ed07335", "comment": "Malware payload (AgentTesla)", "value": "9e80303d54e5b42c33ad1f092c0a1d0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714307, "uuid": "9996a056-37a6-414a-80f1-3890affbbb1f", "comment": "Malware payload (AgentTesla)", "value": "123f349fcba6342f4485ac4fde03c22eb47cf70cce0bae103ac4e2ac4e82d02c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714307, "uuid": "ef034736-70eb-46dd-be86-03215b74e6eb", "comment": "Malware payload (AgentTesla)", "value": "cbb5287dd8e897607aba1bf70344c1be3c0fbbab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714307, "uuid": "60ad3c14-01ec-443e-9d9e-e3b67c291bd3", "comment": "Malware payload (AgentTesla)", "value": "c14c707eebe7f97d764d997afc1362d032aafa3798051e4b7f8ac95392664e00034b4bba9603c950e5c7dfb7ce378d81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714307, "uuid": "6d0a84f0-5be0-4a11-8bf5-23c4d83b4da9", "value": "305508907F54C7B8EC09D733A9185C7983B0A6A950013F3C9FDDA5A92E37745AACC42B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714307, "uuid": "d765c466-3fa8-40be-81ef-45baffe48d5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714307, "uuid": "3171eb25-702b-4e48-9645-d3c68b1cdd0c", "value": "24576:kCsZ49DhZyqTDiOiUx/FtWXYDoPAFnar0j5GN5+Tkadj:HEkGCiJUtFtW8OAtj5Y0Tka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714307, "uuid": "1e5d4ca8-1436-4ab7-8d49-0df37286a483", "value": 1370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714307, "uuid": "bb814e2c-07e0-4d6b-8635-860494ab1621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714307, "uuid": "d4b46c7e-56b6-4015-9c9e-dcc6d3e530a4", "value": "9e80303d54e5b42c33ad1f092c0a1d0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eaadf3-c4bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622759583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759583, "uuid": "2f9a279d-3627-44cf-a939-3e43e9c3630d", "comment": "Malware payload", "value": "99d6419691c67dbd38e8275f356dc2b4", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759583, "uuid": "0c59c2cb-e6f0-42e1-891b-55e9cb07982e", "comment": "Malware payload", "value": "13d84ea026c9819d804a10b2d512498d14005091ad14abb45b9b18ad55f6c959", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759583, "uuid": "29ed6b3b-529b-40dd-9b76-120113da0ea6", "comment": "Malware payload", "value": "cf3121dbd95f8b4d8ae074e951eb62b122d5f501", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759583, "uuid": "4b11d040-2f18-4ef7-b26a-3bd2c24d1abe", "comment": "Malware payload", "value": "af9e03e166b8575ff629580882540634aba78c5cd2a3aedcc5dfe22e2201e2d663f3e3b7fa305de1ddfa38a089f06b24", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759583, "uuid": "283813c9-d661-4ae1-8cba-d189f7476953", "value": "4D754AF8B1A414A7C11DC771DA80AEE8976198FD6702C61C3D94FDCD2F333DA8A6A091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759583, "uuid": "e67bf920-f52c-4b0e-b500-0e3b4e308ec9", "value": "12288:V/4/gFMAh6fqTvT6njU4v33XQVohZ8bTz2h90+nb6lWJp1XZ7:V/4/gFMAh6hjF3nQVohCz2h978WjdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622759583, "uuid": "7d347649-13a5-4523-8e19-aca83a7d01a4", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622759583, "uuid": "02883f88-1343-4255-a9f8-be26eded5321", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759583, "uuid": "a55823f4-409a-4290-bad9-461a4306970d", "value": "FUND DOCPDF.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac097b-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622724183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724183, "uuid": "499567eb-52ee-472c-99da-18e8d1700055", "comment": "Malware payload (RaccoonStealer)", "value": "66ee84542266e55c0215ca60869f1347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724183, "uuid": "7f51692b-5591-42fd-8058-c5047dd4561c", "comment": "Malware payload (RaccoonStealer)", "value": "143cf1724057f9b6a6630656e8735857d6146ff6dd0c2afc736545b46194437c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724183, "uuid": "3503d8d8-5b67-4c5d-aa65-3f8dd2b4299a", "comment": "Malware payload (RaccoonStealer)", "value": "147b6dd6bd7b0c5060ded97b844bb1494cf1ddb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724183, "uuid": "944e30a1-d7a1-41cd-bc1a-13645ed9ab28", "comment": "Malware payload (RaccoonStealer)", "value": "cc6422fdb6170e3b86c1f613bb999a15f22a502e6a720b91d930e2fd994aadefbb5ef76035c00c319d3a1e0dd1371cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724183, "uuid": "f8efd127-fa47-4c1b-88f1-360be9027039", "value": "05C4D000B6D0C035F5F736F48ABA82ADA5397DA16B6450CF62C52AEE16746F0ED31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724183, "uuid": "c8d85b85-515e-42e8-908e-877a77a13981", "value": "1736d54edbb0bc75969c6531257cd3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724183, "uuid": "0410e218-7a7e-48d4-90f2-c25bdafa1a47", "value": "12288:7C/CXtxg4J0ukuEU/OljjTqECqjcjMVhmtypQv:7C2e4JVE9jT1bZVhipv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724183, "uuid": "5cd72929-7de4-40b9-879e-ad26d0c2e256", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724183, "uuid": "ae17ce0c-6830-4ec0-bffd-7e7d1480c6cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724183, "uuid": "a342beb9-2174-4449-96ab-ac828f857563", "value": "66ee84542266e55c0215ca60869f1347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bec1c9-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622713736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713736, "uuid": "4027f5ab-6a73-4787-babe-c72b0a44f731", "comment": "Malware payload (Formbook)", "value": "98aab50a7231a73505e968658a8775a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713736, "uuid": "2fdddb16-a60e-438b-9b22-4e6554fcfad8", "comment": "Malware payload (Formbook)", "value": "161ce90a5dbcb52a305aec3d3372c4a35880a7626d0b4e4c927558d4ebae010a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713736, "uuid": "528f79c4-2e9a-407d-a063-2473c14c84b6", "comment": "Malware payload (Formbook)", "value": "de521e9109ca36e53f702c1f57648f9b13fb96ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713736, "uuid": "5abdc878-77ca-41d7-b3e3-650f136bc246", "comment": "Malware payload (Formbook)", "value": "b10c7971e9963e5d41bd1e63d2d7723c462b49a9a2d6d40c78c3e9150ee2f530587902703e4c2ff2a73b3bbd2b1217f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713736, "uuid": "d6702920-a72c-4fda-b042-228b69319d17", "value": "80456CF4B798D960D02DC731C6604CF993F13CFA5A96A90C1AE4BACD1E13F86CB59981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713736, "uuid": "a502fded-16fe-4f21-9c45-8267ada95b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713736, "uuid": "6cd426e0-0749-4b85-948d-138c83ac8ccb", "value": "24576:456tY7bFOBJrQOEF5jQ4AcCPnNk1f0m4IjVloN8KNHnKDjBTp/Ji:+qnNk68o3NH6jhZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713736, "uuid": "9570f2f0-f58d-4f09-9e90-57c120012ebc", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713736, "uuid": "de5e0bde-4eb6-4508-af6d-85220ac3ccd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713736, "uuid": "43236d3b-b856-4299-9b99-2e23d1851a7e", "value": "98aab50a7231a73505e968658a8775a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a54e3c-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622714499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714499, "uuid": "fc872173-d45f-4eee-b43f-d6514047fd3a", "comment": "Malware payload (RedLineStealer)", "value": "92e2e1a5d3076e1d1b29522c908b4e78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714499, "uuid": "91499878-2804-47f9-9431-64955c5cd79d", "comment": "Malware payload (RedLineStealer)", "value": "163dae89612fd1f3887488daaee0ba0997ad6f848713c4bacac96203a1ae5311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714499, "uuid": "4dce6b55-ac7d-49eb-82f8-de2e1f5cb8ff", "comment": "Malware payload (RedLineStealer)", "value": "328eb280dcd012c71af5974b60aad17f0a216b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714499, "uuid": "6cd4a599-bb73-4d00-9e63-5a3801a5e215", "comment": "Malware payload (RedLineStealer)", "value": "55905d796f65709f66f47b8998b53a02de4d74697ce1714097cd6695ac4830f6258080fb881dab70a7bccec19cbe8a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714499, "uuid": "13e5e190-0800-4f87-aff9-857e50e9d851", "value": "6C84AE10A7B0E034F5F312F45ABA92B9A53D79E17B2450CB62D62BDA1674EE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714499, "uuid": "aae05054-f0a8-45b8-b504-0ab2ea054848", "value": "54bdb0f44e9d5628a234fe66c31a1617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714499, "uuid": "ad072983-38c2-416e-b3f4-e33ebe4b03c9", "value": "6144:ZC/OImoWq1joBKDwMjslPknAwxZ8QEDuH9A60n6eHYES6uwvjla:ZC/fmt2joBBMj7jU6H9j0n6e/rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714499, "uuid": "4d5e0559-25d2-4440-9113-748fd4540dfe", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714499, "uuid": "738e1593-d6c9-4263-8057-70d61726b86d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714499, "uuid": "e9cceecb-95fe-4a1f-ba82-52154a5dc800", "value": "92e2e1a5d3076e1d1b29522c908b4e78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c0aeab-c47d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622733031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733031, "uuid": "f199c6d7-3722-458c-8a51-56f4afcf0af0", "comment": "Malware payload (Loki)", "value": "b59632652724734202aae264fb6d4b4e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733031, "uuid": "445a3f8d-2ada-40ad-8a02-cff9f2a7b653", "comment": "Malware payload (Loki)", "value": "17392f784da160b2e0a8d24937b6d126afecb4b7fd582954c76ca59385d3f940", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733031, "uuid": "ce875349-5030-401e-b4f4-295765396ada", "comment": "Malware payload (Loki)", "value": "ec547f322abb979054f9536d015e09758d5c514b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733031, "uuid": "264eab40-ff06-4455-81ad-26e3f7b202e2", "comment": "Malware payload (Loki)", "value": "04ef1d4d84e36f39489c6fb16c538c6cf84a921fe99413e511a656bb7a7f217af6ac161a663001ab80d70c8af34d8968", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622733031, "uuid": "de3ef7c2-8ff4-4cfc-9b8d-8d51b8ac41af", "value": "21E4236726A40CFDF21703B641C0B1686D0D9C8B21C5D54EA5BADFB53923D9FCA8389B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622733031, "uuid": "58da87e4-0773-44c9-bafc-2fbb79244f80", "value": "12288:ecNxQRGoLJzj5amBWZ4Nwezc/Zx0hGOwwARtBOkKl0YBYqa2WMZhZ:BQRXtuq9zC0vwROCFFyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622733031, "uuid": "b37b05ad-457b-466c-a56f-98ae1a328f38", "value": 665737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622733031, "uuid": "a05f7b47-34fe-4947-8b57-6c8346e75a3d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622733031, "uuid": "d6318486-a362-491a-8c5d-3d43cddddd89", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2cdcda-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734253, "uuid": "4d133501-adee-47ef-8ff9-2b6e339a4201", "comment": "Malware payload (Gozi)", "value": "fa4bdf818b09900830fe0cae5e37bbad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734253, "uuid": "a9144f02-d2f1-426b-a7a3-28d4f1abac01", "comment": "Malware payload (Gozi)", "value": "177a8e61d95fbe4a7a1636f378eb0103e2c5e718895127d2b7d8fff59d0dd617", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734253, "uuid": "5aa0d770-57ca-422e-8589-3272b2921368", "comment": "Malware payload (Gozi)", "value": "9438c10a49f4089e5ff5669a6b208b6eddf8bc8f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734253, "uuid": "62be9912-ff96-4f4b-837f-685ae005283c", "comment": "Malware payload (Gozi)", "value": "cdc1a5588fd8718fbd6d7d09b4b1ee0fbf4f1e1d97208cef6736f6ce6d3fd7250a1300d2c91ce49414b26780d8c8293f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734253, "uuid": "14bf5f42-0aaf-4f3d-ba16-6e97cd97b5da", "value": "D8B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734253, "uuid": "25429552-0b24-4cc5-921b-c86559dd1c8a", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734253, "uuid": "1821d2eb-3785-4fcc-8ec6-3a33cae4e086", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvAqW6mZuzuJPjX7R75:vz75tzST8A4q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734253, "uuid": "f4832d0d-3e16-4877-a935-6d32b63fb5d2", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734253, "uuid": "8c43de50-bd57-48fb-baee-667f7feae807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734253, "uuid": "328584ab-c065-4454-8660-08d6b878b57f", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bca2c8-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622717865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717865, "uuid": "53990bd6-c40a-4cbe-805c-239e72872d5f", "comment": "Malware payload (GuLoader)", "value": "07cd104f37748ac4f703a7baca9cb238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717865, "uuid": "d0bc5be5-bb3f-4682-bf5d-0deb7bceb29c", "comment": "Malware payload (GuLoader)", "value": "17e0bc9190c267c8116486597a2cfe0a20928ad2ff1c1bf3e7d599f398c0403a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717865, "uuid": "5e67d7fb-9c78-4ddf-b849-dd170f1eb2b9", "comment": "Malware payload (GuLoader)", "value": "0361c52597b6c3a4006d24d3ad435e17f0e65c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717865, "uuid": "57bbe975-7007-4621-9671-fdb59be674bc", "comment": "Malware payload (GuLoader)", "value": "4dd77a22f1d78e978d028ce1dc16a402f7db0e4b039c82a7f77455cf05102a263d7cb28871e28ec8da042ede67162bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717865, "uuid": "59f4ffe3-3945-4bf0-8db4-2f4c1060ff92", "value": "AEE32A7233428993EB0A40728CD34A5D1654BF6595170AEBE27EBE0F24727C3E5FA352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717865, "uuid": "32058837-eedf-4e76-9577-261f82c66669", "value": "588b8638d1d2759c296cd4c26b27444b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717865, "uuid": "e4633c6b-2b0b-4a98-9331-84d94e927bb7", "value": "1536:esdZx7EX6xOz0zldkjZFD2ZlZtUPx2B/PLR:esdZ5EX68gMj2lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717865, "uuid": "55776e0c-3c87-47ce-b342-0722492dde65", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717865, "uuid": "b0d4cd4e-6c74-4dfc-8916-5b7f62802783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717865, "uuid": "8a5e962e-a6d4-4525-aea3-f7622ea77f4a", "value": "SecuriteInfo.com.W32.AIDetect.malware2.26129.26143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f924412-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (adw)", "timestamp": 1622724698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724698, "uuid": "03f579dd-7890-4196-b538-97c5ddd78d59", "comment": "Malware payload (adw)", "value": "d47ea4289b6c61c01be750959b7bb277", "object_relation": "md5", "Tag": [ { "name": "adw", "colour": "#B0AE62", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724698, "uuid": "b81afa76-cea7-4d1f-8d99-98bf46ae13bd", "comment": "Malware payload (adw)", "value": "17f08cd68e5752d7c16daee644232c4c752c069d710cf5e496b3d7dd85053446", "object_relation": "sha256", "Tag": [ { "name": "adw", "colour": "#B0AE62", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724698, "uuid": "5d1d141d-585f-4d34-af1b-e80efca6a908", "comment": "Malware payload (adw)", "value": "489c033a1a3e4e9d12fb9a31c3ea98221d2368d5", "object_relation": "sha1", "Tag": [ { "name": "adw", "colour": "#B0AE62", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724698, "uuid": "d05288c4-0bc4-4411-8931-7c18c7353cfe", "comment": "Malware payload (adw)", "value": "6408ec08d133acdc0528914bba00d134c19f8417fa20e393565356d1b085ab990b06043b205dd6ed0bb89424798c6566", "object_relation": "sha3-384", "Tag": [ { "name": "adw", "colour": "#B0AE62", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724698, "uuid": "c8c061a0-ad2f-40b4-9eaf-285f53302570", "value": "F2642324D7C411AEF6789089E09E9A84713BE430FFA8DD8C694F85597FE5467CC9803E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724698, "uuid": "7956e338-8fd4-437e-886f-d122f3825d50", "value": "6144:1I0th/xu1ogICU0JGxNFRT3x8C7gBsN9aQFv5/cxevr++xDoq/MhgD/f6psg0MZB:1IubLCU0JSZgBVQFvBAWjoq/MhgLi8ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724698, "uuid": "fd8d293b-3a3c-469f-9a8f-bed70155ac8f", "value": 323480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724698, "uuid": "8736174a-8ea7-44e7-baff-033dbd89a63f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724698, "uuid": "6023c434-8f3d-43c9-8a38-33e9bffcbf40", "value": "sRU8EclZA675r19Ryw.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db68f48e-c49f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622747642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747642, "uuid": "d595892d-3454-4ac9-96f4-f6742a60a247", "comment": "Malware payload", "value": "c6aeaf2c5459e2e3ad643ce70bd8c4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747642, "uuid": "22cdbe38-b74b-428d-933e-7afa9fc5c6d5", "comment": "Malware payload", "value": "192b90e8f787b820b8e8f6e40d8b61ef88cd6bfafe089afde388878c9ec5be63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747642, "uuid": "ed0d9718-b6b7-443b-b113-dc3efe797e18", "comment": "Malware payload", "value": "7e3761801435c29d16498836deb933ee42e75a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747642, "uuid": "00cb3e03-4f27-447c-8620-07874eed25c7", "comment": "Malware payload", "value": "53f7520e6eeb8fcc3ed840346afbb4034842d37ab7c4a26f66c37f21238bbf53fccd30ca897e883402d42b832f1a0a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747642, "uuid": "8f6bd387-d709-4887-aef5-a2d7e6601219", "value": "6A157CF8F5A898B2C14EC772C7909CADEBA142FD1243891D19B9DACC1E0379E9F5D448", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747642, "uuid": "78dbda4e-e324-45d4-8443-71ed48abca01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747642, "uuid": "34eedac5-4cec-48a6-82c4-6bed4bdda1e0", "value": "12288:UExGvTp9vrYm1aZ2F7pC7DD7zZojcABa/FOpZLgmi78GdN9G6MpZX:EfkZ2P2DnzZOcABa/FOpZS9GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622747642, "uuid": "a6e09826-873b-4307-b6e4-839acae96ddb", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622747642, "uuid": "cefdd3f5-5414-4a92-9ee4-734c4a3c801c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747642, "uuid": "2398ff8e-d41d-4af3-b906-d0ee0e8fc28b", "value": "INVOICE FOR PAYMENT_pdf____________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa86a50-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734568, "uuid": "6a312baa-b764-46a2-9016-c3f3d46c44ab", "comment": "Malware payload (Gozi)", "value": "c7bf06db097c752b00826afb65402278", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734568, "uuid": "de06ebd8-471c-4910-9b52-4e1837b74b2e", "comment": "Malware payload (Gozi)", "value": "193ef37f54910bc1ca5561aaf15a81d69d53eaf225fa2cafa48323f14e6436ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734568, "uuid": "5aedd7a4-9b1e-4a87-911d-2e9cb3f68daf", "comment": "Malware payload (Gozi)", "value": "6a8f4f0428b01bf9eb2fa946875f0dee7041f2cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734568, "uuid": "429cd27a-23df-40b2-b078-e73956ab2ded", "comment": "Malware payload (Gozi)", "value": "72b649469934aa839fe184120e21b5c1ce1c7964adef6b023bead51a0218f2f5742e10f4ae428614a5feb33a1a476e95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734568, "uuid": "7d8b373f-87ff-4eb9-8519-f7b378f1992e", "value": "58B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734568, "uuid": "1c88f0a7-b08b-4b37-b972-663c90213a03", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734568, "uuid": "ef576a07-b9fd-42d8-b155-ff0ada655dcb", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvIqW6mZuzuJPjX7R75:vz75tzST8AAq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734568, "uuid": "900d1092-7f8d-454f-9dee-aaabdc9e13ce", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734568, "uuid": "cb22a2a6-4c87-4343-b786-99dde58d8772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734568, "uuid": "0fe30e50-010d-4645-93ef-984e57a48fb6", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0359d352-c48d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622739549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739549, "uuid": "8dc89643-22b9-4ffa-85f5-84c3a609e91b", "comment": "Malware payload", "value": "5be750773da1a0ea525579f2d501ae71", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739549, "uuid": "821587fe-ae0f-4a4a-98ab-2d38707ce0aa", "comment": "Malware payload", "value": "19616c3c057655c088a9b8ec41003f866e4aa4badc54a2220cbeb80cb7865b9e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739549, "uuid": "a8b214de-f31c-46b1-94bd-2357ec2860ca", "comment": "Malware payload", "value": "cc53d9b94ca34f12c0e0a00e763a6ef40bda13db", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739549, "uuid": "af3b57f2-5b99-492d-8a04-6597f7fee0a5", "comment": "Malware payload", "value": "86730cc54ae3cef088d5294f1574a92702bebd607259054040d02f06ada34cf80aebc8060e7330a9e8165139ef7c604d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739549, "uuid": "e799141f-7be0-4971-98e5-aa5be5c1b298", "value": "F372C0533FD5546BF15B0ABA2004FD7ABEB91B8C886FC23381C0A2944434C864E52F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739549, "uuid": "bfcb2a84-86ae-4cb6-88c8-587b22b9b9ce", "value": "384:Q9rfcXpIzaL2ZLBYLGgTxuAW8dog1oC21bg4AtN43HDCEjq:kzFZiqgT5fog1/21c4A/6j52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622739549, "uuid": "84c672f1-44ae-4b73-ab5f-b8d40f7365f4", "value": 17059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622739549, "uuid": "015e0b97-2cda-4ef7-8de7-43ee628aa274", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739549, "uuid": "c94dc9b2-7a84-433a-96be-44e4c6f963e7", "value": "Bonus_Ditta2302.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0508907-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622703305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703305, "uuid": "b7d4f627-e12f-4e2e-9c23-cedbcff73a05", "comment": "Malware payload (Formbook)", "value": "140563696e04678dfabe06f171c7f1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703305, "uuid": "36598bc7-87ab-431e-a2ce-46a8d1e0e81c", "comment": "Malware payload (Formbook)", "value": "1a91deb8d42e066f792fed5e4feb0dbaacdec1a052f516e1287cf9625a8c9684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703305, "uuid": "ff2c8b8f-86c4-4505-b60b-45e4f90b3e22", "comment": "Malware payload (Formbook)", "value": "4fefe830026f2ac67a79d2dd883f15dcf7b96d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703305, "uuid": "c8684c0f-d305-45b1-b6cd-032611775548", "comment": "Malware payload (Formbook)", "value": "d31246fc014e04b7254b339e1d5488394df4c3227d262bc25ac39d35cf42e4e9e4dd109a46dac406ff05c66a2f113064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703305, "uuid": "e806856d-34ad-4c04-a1b2-14967724f5bb", "value": "252412C935C5D0B9CC914FB45233633AE77B9707272D6A6F2BB01FA765A16E2CA04183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703305, "uuid": "6bd04894-abd5-4819-ad51-f0eb1bfda80f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703305, "uuid": "b4c7451b-5b22-4207-856f-8e16c46481dd", "value": "6144:8Qq+XrlqRqj7AHE9qh0xHyABc5pGO4DYOp:T7A30NyABSH4jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703305, "uuid": "a6f625f5-2e36-49bb-b87f-5ade821ab4b8", "value": 218933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703305, "uuid": "6877049d-00a8-470b-b306-2f4372358ebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703305, "uuid": "e8da1923-886b-4e65-9539-f67e1305d488", "value": "SKMBT_C224307532DL23457845_Product Order doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffda935-c47c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732510, "uuid": "6afcc158-4cb8-447d-9e0f-b3e0d57c1610", "comment": "Malware payload (AgentTesla)", "value": "8e2ba26163f471f18cab5ad50bbcd866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732510, "uuid": "b286c945-cc21-43ef-a1b2-177a07e00870", "comment": "Malware payload (AgentTesla)", "value": "1b1559e38c450f75c981a22052632f1773e78f5b3444660a68a0a7723cc06b48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732510, "uuid": "1a857314-6e8c-4d97-9f55-19cfa52ac525", "comment": "Malware payload (AgentTesla)", "value": "059590e83e1fb27016d153fd1e12171763989111", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732510, "uuid": "592469cf-32dc-424c-8a23-dbf05a9d3c5c", "comment": "Malware payload (AgentTesla)", "value": "53c19dade7a35800aebe25863acf029b031ec865a712761671e16935ab56f9515ff904e83038b2fcd5f2b526ab533075", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732510, "uuid": "c22d7c9e-06e7-4509-8bdb-b550afeaa8bc", "value": "5D542240E2BCE1DA83B5ED2F683C7D99AE79B2384DD8746D049B46FF53335E10960606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732510, "uuid": "33f8fda9-c69f-4c0d-83c2-8208fc328490", "value": "6144:F4Zev6duesx1UKY6scSLhEeFf/yX3fyZ4jHy66v6IDxd:acvJTx1U88EeFf/yX3fvL5iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732510, "uuid": "3f472514-dffe-44fa-b0b3-fcd099e28aa9", "value": 298767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732510, "uuid": "7844a207-51ce-4f63-b821-0b4abce5cea0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732510, "uuid": "6dad7018-fd45-411b-a8e7-7e0a96b3986a", "value": "RFL_058_13_72_06.R01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f48cd1-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757744, "uuid": "93aa5929-034b-4976-88be-ab097b22068d", "comment": "Malware payload", "value": "ba7001fccdbc560c25924b0b93ea549c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757744, "uuid": "f747ee00-16c7-41bb-8cfc-2f20669856e2", "comment": "Malware payload", "value": "1b72710bdee7517912601a714c7b206369c2d4e4b2a13b3e1cd6a76eab31fdcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757744, "uuid": "073faf67-b6bd-48c5-96a9-d1854b27681f", "comment": "Malware payload", "value": "0e1992267b00a0c981c42b3682ab14e2946f0050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757744, "uuid": "f746e39e-63c1-4db8-a1b7-d8c8ae1258d0", "comment": "Malware payload", "value": "8be7618571051988aa32ff1370ab3b3a81c78393b2cea8eb3b90c0f324a917dd642acfbc9cd0e55e4f527773c71dcfa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757744, "uuid": "1910fed9-d6cf-49f0-b7d5-17d8358225ad", "value": "66D39E3C536D9736DBFF0BF954A2921817B0C2A97623E76A1EC0A0F90E237D56B11253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757744, "uuid": "e6607302-678f-4dec-bfff-24b7ecd8cf13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757744, "uuid": "74118b42-0f63-4f9a-8338-f340f8d80bb9", "value": "3072:+GLsQKiUkTUT5DCfuF9oUnBwTxBocBcmduAZ0h:BsQKEs19oewv3Smd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757744, "uuid": "6a5b8457-4296-47e0-81f0-8878c364528d", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757744, "uuid": "43a8723a-ab08-4f79-b336-5b52bd46f626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757744, "uuid": "3a908b12-0ff5-4174-ac55-7d51f432ca57", "value": "SecuriteInfo.com.Trojan.GenericKD.46313805.4242.3171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2bab58-c476-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729735, "uuid": "e76f4e81-db3a-4e3b-9569-5530305c5413", "comment": "Malware payload (Quakbot)", "value": "83c0ffbf44dd90b1ec33ae4ebd997b21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729735, "uuid": "cef7dba8-cf68-4b17-8900-24f12c686e08", "comment": "Malware payload (Quakbot)", "value": "1bb6025925cc2625cc47299f486fcd967737c6ad3934c845b8348853fc6e1b0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729735, "uuid": "bff5dd54-605c-4892-8146-d9016fa6a519", "comment": "Malware payload (Quakbot)", "value": "893e0212447cf95187f700c12e6fb3e0537a0c3d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729735, "uuid": "91a813c7-7a95-46f0-9eed-1e4006a4b067", "comment": "Malware payload (Quakbot)", "value": "4fa6771cbd27de79f1e517fa85cc9f9996503057ce34ff94e26b78903ad88a3ce72d602d4ca0016bce37cb299cf5b167", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729735, "uuid": "9ea6f671-4abe-4c6a-9bd0-c2e727e64a6f", "value": "D8454B01B694E435F5B60AB96AAEF0E8562D7DA00F5D50CB73C02FDF5629AD19C3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729735, "uuid": "cc6ed071-6026-44f3-bb62-3aec194165cd", "value": "6e31f7ef3a3092fdc488764688222205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729735, "uuid": "2ce954ce-0271-4fc9-9215-b08e8b3b54ba", "value": "12288:nmNDiDQ21Elifgbhc5ZbqWDyALUvNi8KaEIgIteiDqd+Ci6T1l84A79hbi:Mek2CBhcbL8vEnqnZC1Tz8r79hbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729735, "uuid": "6a6a8444-98cf-40d9-9ee2-7a37dafe7f54", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729735, "uuid": "c9ea75d3-01f9-4840-b3ee-3e5ad7c9de65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729735, "uuid": "42b5b9bb-5cd5-44bd-ba90-11cc00fa083a", "value": "83c0ffbf44dd90b1ec33ae4ebd997b21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15ad12-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734540, "uuid": "a792bc28-3106-4d3a-91b9-2c582d95995a", "comment": "Malware payload (Gozi)", "value": "93b0ad344d44befa41b292d0a4609e56", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734540, "uuid": "643da037-1412-4716-a8cb-9b8db2fe0147", "comment": "Malware payload (Gozi)", "value": "1da1183f1cd5f96f113a3b8978359b50380bfbc82e6987e274892edf56fcf3b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734540, "uuid": "a97b0679-4a40-45aa-82c6-7157959d269e", "comment": "Malware payload (Gozi)", "value": "3306d48bd1ff87555d9a8accd30583b6789d4683", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734540, "uuid": "df03f2ff-59b6-485e-b695-8354a7839f79", "comment": "Malware payload (Gozi)", "value": "bfb2ff7fcaadcc2276d2c15aae24946582590191566f49600e3ece2c901638be80446d649980e903d50d3ed901e4024c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734540, "uuid": "6c3c4824-2183-4019-ae00-dd67488c75c7", "value": "F484BD5076C6E031E17241354A69EAE0073DBC629FA10B8F77E41E8F9D7C6C26E35B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734540, "uuid": "afb8cc7e-41d0-4641-85ab-1f83c3f4645b", "value": "f97da13a5df33dbcb72f17527b1d6819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734540, "uuid": "498c5674-9dae-4d85-b342-ed5d3604882e", "value": "6144:hC5FUWwNmY036ua+71w5uJEr+AitTdZh+a6R+/ZQWdB:0FBwNuKu4umqAinZh+7+h1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734540, "uuid": "0f9a284a-ce1a-4bdc-b24b-286285b0e8ed", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734540, "uuid": "431471a6-a7e9-4bdb-ac7e-4e35d71a2623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734540, "uuid": "9a1f7b3a-69e1-4942-84c7-26e3ec14e9ac", "value": "shorefront.eps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8465bb0d-c487-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622737188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737188, "uuid": "7ddb3ca8-bf08-4006-8b65-aa1cf1dbc650", "comment": "Malware payload", "value": "a41853d4d26267269717ea1c9af5097d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737188, "uuid": "0a4b0b9d-3c09-4378-8e31-08f4b5b0cce2", "comment": "Malware payload", "value": "1f21596ea84bcdd5e1fd0d0bd59434d9412da7a3dabc4329be590c0a76892684", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737188, "uuid": "1a2629da-0b4b-4115-8b80-405570f21154", "comment": "Malware payload", "value": "1e52f615407388e209faed2ffc2424df33d76dbe", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737188, "uuid": "2cbff01b-3291-4284-b191-43eb7f9d01e0", "comment": "Malware payload", "value": "9913a1416d5552bc11d23bd17b164cb6ecd5fd20fcc74a5e1b9c5a678ee3b7ed5bed99a5776d180dc96fee657ef346f6", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737188, "uuid": "90d7c9e6-cf13-427b-b3f4-71c3f49be575", "value": "B0152304FC9A4B1BC717DBBA4A8F9A340B2EBE6076B055278745F785A634B7281B74C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737188, "uuid": "c0cdbf01-812b-4a8a-b2a7-da17e7be74be", "value": "24576:TLdFjAivAR3vZWBufeKwcbmQRebN6WBjEhiuEDoS:ThFjdARIBaGcEbNvEhiuuoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737188, "uuid": "6c219a03-c6b0-430f-a4d3-9387f797cbed", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737188, "uuid": "d60a0c9f-5d9c-4e07-baf0-ed16f25bcddb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737188, "uuid": "837b9d4a-cacd-42d8-83b7-812f3bb09a92", "value": "copia de pago.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855e0717-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757806, "uuid": "beba45b3-361f-4401-95cb-19b138c95642", "comment": "Malware payload", "value": "409c0545907e3e7ebf31c6b0c68f321d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757806, "uuid": "57040261-b2ac-4117-9df0-35fa36e1a79e", "comment": "Malware payload", "value": "1f628e7e847300e27bdb444768a45219219ee49b27911d8f3eda2a69792ce716", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757806, "uuid": "c00fe212-bfc0-4086-95e0-32777a4b5401", "comment": "Malware payload", "value": "8c9a88ef1b0df874730a1f60f9456684af330646", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757806, "uuid": "37a9409c-4910-4d9c-9bbc-7abc4b86169e", "comment": "Malware payload", "value": "894b0c919cf37143e510287788dc70f624efe2a248ec09e158ba7edfe98fb073a335ef0f881494829ff2bdcfc5e7a909", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757806, "uuid": "f4a1d250-b2b6-4857-8366-ff1d2a6cf9e3", "value": "7F64125BC8BABD9EFE6A4FF515870D5E0EFDE2D9D1816D94012A00802BF934666C4FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757806, "uuid": "8b49c353-f017-47c0-bf74-e8e71d2a7eb1", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757806, "uuid": "5aa9ca0d-f021-47e3-8c4c-f086bac53af2", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757806, "uuid": "8f3803c3-d070-43ce-b1a0-401f7af7642a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757806, "uuid": "56bb7ae4-4d7f-4c8b-9f33-839acb0ce024", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189d2bcc-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622710378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710378, "uuid": "2722956a-c6e0-47ea-97fd-19395bc9fd8c", "comment": "Malware payload (RemcosRAT)", "value": "4ed8eaa4f75fa266b9edf1f3972a5a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710378, "uuid": "b1d6e74c-0fb8-4886-8443-0b4d0898fc8f", "comment": "Malware payload (RemcosRAT)", "value": "202195f16020372bc4f93a90d23be8579c5da2d2e43ce4e2ed6aa3447dec040f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710378, "uuid": "d2e54144-be88-42a3-ac72-7778559904bb", "comment": "Malware payload (RemcosRAT)", "value": "d529f8d549efff55b6fef0ac8cdd618e4d4ddc27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710378, "uuid": "67740fc3-3179-40d3-89c1-bb806199ff48", "comment": "Malware payload (RemcosRAT)", "value": "1a29df09324edf21e4426a782923633a56ba3996c87bce4f1320589f739e4d3c486e06675ce244c8e933a5cb45b96c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710378, "uuid": "80d9f1fb-18ed-4eb0-8545-e206aaba4a3c", "value": "93B42A243DEA901AF173EF7A4FE4B5D69A6EBE633B03645E2050334A4633A81DD8153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710378, "uuid": "0efdec3f-1c0c-4b6e-bee4-877df239116c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710378, "uuid": "b1b0431f-2980-42aa-bb51-e4a99239acfc", "value": "12288:SyZSk+4ArSjDT+KkVrFjgdEo/8tTEFl9a4CwFY+d5sy2HIj4:SRrGGaM2IIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710378, "uuid": "6f470eef-a28f-4514-bbde-dcf50c8c3903", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710378, "uuid": "cf275d07-a33e-4d6b-985b-06e2f4051275", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710378, "uuid": "3f963364-38c1-4c5f-94a8-09d91a1ed0c8", "value": "0900879000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49787f05-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622700153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700153, "uuid": "08f2b2dd-9b25-4d32-a464-376ea6f3be7d", "comment": "Malware payload (Mirai)", "value": "0d549f0cd1c0e3688b6099dd9961ad3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700153, "uuid": "de7f7872-9f92-458c-8e95-3033c3a26ea4", "comment": "Malware payload (Mirai)", "value": "206f44b870dec43ffc6ab8b47b66ab0b5a8e15645fcdf49427b41bb2c870d27e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700153, "uuid": "95abe005-fab1-42bf-ad17-8ea2a18e53da", "comment": "Malware payload (Mirai)", "value": "99c0b066e3589d96e1365ef5fb402650878fdeb2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700153, "uuid": "d2f8dde1-9320-47f8-9553-f17746d41586", "comment": "Malware payload (Mirai)", "value": "2276d7cde89a31fff18a1c38524c414d14cf358dc6434ba9296ef89e21af1555d0c63f71d511e585cbc621b2c09361e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700153, "uuid": "04bf04ae-5466-4673-8f45-db9d42d7e45b", "value": "EC631849BCD18A6AC6D023FAFA6E128C333263F8C2DF7117DC245B6876C941E5D36A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700153, "uuid": "d9392f3f-4e8d-4e83-bc38-c270c5248791", "value": "1536:Or9kaN8x8fXpdfI7GTCtYGHMxv3LW5Qa7bDqFdXTjbNkrt5laAEi5G1asK5C:Or9ky8ufXzFLW5b+FVjbNCb0biglK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700153, "uuid": "ebd1a528-2c95-4921-8241-2671675c907d", "value": 73048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700153, "uuid": "72c8784f-9e29-4a1f-9543-6326ad2917c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700153, "uuid": "516f7db0-0147-4126-9ea2-b27abba4ee5a", "value": "boss.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ad80d9-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622710729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710729, "uuid": "a6911cb6-c57b-47de-9186-b83d69c847d8", "comment": "Malware payload (Quakbot)", "value": "2cb0b32362140cb9c1414dccaee7b957", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710729, "uuid": "b46d15b4-5402-4c40-bbd7-3ab0cf942938", "comment": "Malware payload (Quakbot)", "value": "20a8cbbfbe7b36c2c7a320197096af1db4e0522acfaf384fd81c38be528ad0e0", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710729, "uuid": "cdf8e438-4ba0-40f3-bacc-bf25aec4ba5b", "comment": "Malware payload (Quakbot)", "value": "64e2e390171def07148378538fe98d43c43ac1fb", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710729, "uuid": "cf440c70-9c4c-49a8-bc8c-ff7c65cf9847", "comment": "Malware payload (Quakbot)", "value": "0646e685597e05ce6efe5152b9439880901a0fcd8c308519c08fee4631f351abae94d79cf758d8a3909cc81b77b8bf83", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710729, "uuid": "67fe5653-bf02-4367-8330-9c255fa006a7", "value": "4574127EE28169F4C3358D3ED244A0D4C295F1E050A7B31D07DD3528A75329FAA9E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710729, "uuid": "d0e2520b-3f1f-4efe-8dc1-07d33cee43b2", "value": "6144:lJMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNl:IRMmEv2Bc/nvm8IKABfsYOmauFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710729, "uuid": "d09c75f5-5c01-42fb-8f95-3c1e20d5feee", "value": 346062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710729, "uuid": "c5220d80-f468-4acd-bbb3-be0d59a19e94", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710729, "uuid": "4c7465c0-5a02-4988-a5f0-dd1518a7f4cc", "value": "Document_06022021_568261087_Copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6111e2a1-c4c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622764187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764187, "uuid": "dca38770-9e3c-473f-ae69-7abf3598605b", "comment": "Malware payload", "value": "c25218fcf7bce8f3b6431d8125e2e898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764187, "uuid": "aa7804ea-f88a-4b03-9c20-23152f1292b7", "comment": "Malware payload", "value": "20e5638ca01e002577718352ea43e153c176e6305010d7a65983112510056041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764187, "uuid": "713c5dc3-8225-4632-83f6-8cf70cf3c6fa", "comment": "Malware payload", "value": "49581eca8c2b321cabfec01e9a7c5fecbf6b2dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764187, "uuid": "9dde3494-9afc-4724-9cb2-c715b9835942", "comment": "Malware payload", "value": "db2c0d25a9c5ab0ad01d3b11afe69034586a2f694539cf0ae0157305c17dc8fd783c736daa76aa93264498255c0a8cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764187, "uuid": "2b0a0a67-76ab-4d1c-ad34-6eb17cb01622", "value": "37C53349F60F42D7DC07BDF94224F08E359A77B64B45CADBFFA05D709829250287BA81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764187, "uuid": "d1d39586-9611-42f0-a083-1a522f410f20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764187, "uuid": "2ffd2a0a-4213-4359-94c4-4f2a7b5ced69", "value": "49152:/HPzLYQ/EoGfeDZCGZAaRNin4X85S3GbloL0lZEbN9LcT6IE8/k+k:/vP3wICGZBHs5S2blowlZEbN9LcT6C/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622764187, "uuid": "6f4f251b-587c-4f3f-a620-c91218f2e0a9", "value": 2514944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622764187, "uuid": "0fcd384f-1514-40a4-80f0-7dd9f9f0adc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764187, "uuid": "c89b97f2-a0ed-40ed-b01c-b43cb055af52", "value": "SecuriteInfo.com.Trojan.GenericKD.46394915.32529.19426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae52b39b-c447-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622709771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709771, "uuid": "7ad0c2fe-cb10-41aa-b3b1-6728ddd47e7a", "comment": "Malware payload (AgentTesla)", "value": "e3dcc7c6811db9df359001ff3d3350f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709771, "uuid": "3446ec45-e013-42b8-a204-e8d240906afc", "comment": "Malware payload (AgentTesla)", "value": "22625eca10f2d11d3ec97c1a77b74a298e82e5c0e6d450a8dd4f0be0a4d7286d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709771, "uuid": "32815a14-94b6-4351-afa2-7df34568665c", "comment": "Malware payload (AgentTesla)", "value": "758062d68598cff25733a78cb9f763f51d68e9f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709771, "uuid": "b26b148c-34de-427c-b97b-1855078f2dd2", "comment": "Malware payload (AgentTesla)", "value": "57c5c0ff16eee560b4f3e538e50370d2dc9c8100740dc5505c8881fb601581e7c7930ab040c3c856eb3ab7446e3863ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709771, "uuid": "847b552a-7aa8-4df7-8f04-2cca4496f4b1", "value": "0CD4E115F2A48B8AE0145F775775D9001F743C53A825C73D28AA32EB49B2BE3166BB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709771, "uuid": "58c15f16-47e5-4376-b19c-906857d949d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709771, "uuid": "cc6dd9b5-fd24-4a49-880c-aa730ffcda68", "value": "12288:O4DmxG0p2i8XM9EBUR953hl2dJPjokQ8szq0Fge:kxGBiYSrFEoq0Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709771, "uuid": "fd8b26f6-c417-4af6-9999-32c301b296bb", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709771, "uuid": "267be52e-f396-4a71-8f46-81d36da8cd8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709771, "uuid": "6cc622a5-0ebd-4437-b194-2ff2477f4a91", "value": "New Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd0771e-c467-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622723326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723326, "uuid": "6a64d33c-854e-4b20-91a6-29c5ae68ff31", "comment": "Malware payload (NanoCore)", "value": "58815ac415d2b2300976b6d8050438fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723326, "uuid": "d825a02f-da9f-4c39-85c7-de1056f84c37", "comment": "Malware payload (NanoCore)", "value": "2267e42f379c490ea6e2ad61632f588f7832f7857edfb62368ad0058f02224a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723326, "uuid": "b0a8eb87-da78-4eea-b5fc-2bded48b198e", "comment": "Malware payload (NanoCore)", "value": "b2455f193dda55633d0ebc53e062f6ccddcc7d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723326, "uuid": "e852b4c2-cbe0-4a53-83a1-09ccdf92f4f1", "comment": "Malware payload (NanoCore)", "value": "35b491bb9427c846b352fe6bf72499139526eb761c8bf8d69bf0b01f8dd2340295f538c4db0bd272c86f436a90650330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723326, "uuid": "420eefd1-7477-41b8-9af9-9e9b9ed9b26c", "value": "9A655B2439EA501AF173EFB68FE4B5D69A6FBE733B03545A1091234A0633A41DDC253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723326, "uuid": "8d693453-ccb4-42f1-bf03-e9567333038a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723326, "uuid": "b4d7d691-35a9-4597-bda7-2f322ff77735", "value": "24576:pdtzQKuC/vMavce/CSOoigR2nksF2oAMU:p3Ihavlcv11AMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622723326, "uuid": "59e7a3b5-1f9b-4d7b-9770-79022c20eb68", "value": 1460224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622723326, "uuid": "db803bc8-3088-4467-9c53-5cc470def18e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723326, "uuid": "75acdff7-4c6d-48cb-8345-e1edeaf51b1e", "value": "REMITTAN.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf130d6c-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734307, "uuid": "e9128146-2e27-4d6e-8ef1-7e817e9b3b5c", "comment": "Malware payload (Gozi)", "value": "33f3358ab669943ab900fd296dc00187", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734307, "uuid": "b3800e90-8848-4bc8-a437-994692329a06", "comment": "Malware payload (Gozi)", "value": "2372f1420d05bc018c6edc7c81600613ce29a46c8cdd3037322391faad31606d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734307, "uuid": "831da77e-6c52-4f59-af65-25c9f50ac5e9", "comment": "Malware payload (Gozi)", "value": "1d591d8bc0125a6f6c3834a9756e6ee4b421eb2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734307, "uuid": "8315e962-c12d-4eeb-9de3-df5bfef3b61d", "comment": "Malware payload (Gozi)", "value": "e36a9313d3c3196c1ca51c59c8c28b85a96870fde043dfd783a6113092dceaf6d0dd9f605380f871cda31c0f46e187e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734307, "uuid": "dc2eead8-9cf8-4d0f-bd4e-64bfc2ed6bc4", "value": "0EB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734307, "uuid": "3576c8bf-135e-46f5-8f6d-6319ba53fac5", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734307, "uuid": "ebdbc788-5188-4e5f-a3d5-73ae8bf184fe", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAv7qW6mZuzuJPjX7R75:vz75tzST8ATq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734307, "uuid": "f09470ad-25e4-4e83-bd73-6b81b32e0413", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734307, "uuid": "e121ad73-d1fa-4cf7-9245-578f16f477db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734307, "uuid": "4ea4d7d9-81f7-497e-b68c-e41107f2395a", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e633269b-c468-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724038, "uuid": "f4b90084-e8bb-4207-acc5-ba53fde65689", "comment": "Malware payload (AgentTesla)", "value": "b4f29828c479e11ef4d7e97e4ca08efc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724038, "uuid": "348c3b7a-06fc-4984-ab1a-afec35ab290b", "comment": "Malware payload (AgentTesla)", "value": "24215399642eb4d2a03d3efffe3e44c906e7142e94a29f246e4c038ca3755b70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724038, "uuid": "b15bb3b2-e91b-4714-a789-301ebf249e30", "comment": "Malware payload (AgentTesla)", "value": "06f1b8dd584ec6490c142b36ec0dc388bf55c825", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724038, "uuid": "e68224a5-1930-434e-890f-380d24f42522", "comment": "Malware payload (AgentTesla)", "value": "9572821e311ee3167661b44bb65b9eb4cd69423053386240da49c0afe93bf53c707fcb0628c1b6a68d47c36213311763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724038, "uuid": "083b70d1-ecf5-4234-af53-4ca5e453f31d", "value": "A075E7A3F5928DA8E24B9A738EDF691C56FCB1F506016F394FB386482F123539D08476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724038, "uuid": "d4958906-4dc2-4c05-b93a-ebee0ec7cc8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724038, "uuid": "2a3647fb-088c-4ee5-9e9d-e017e371bede", "value": "24576:lwd+vyCbA2KaG2VhXVXwvIKKu3wBCi2vDW2/6ZZZZppsB20N1LsBIZZfHXgHQUHl:qgv70OIPWc2cXwAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724038, "uuid": "64743ff6-a4f5-4f32-bd07-e37fe0ed0668", "value": 1594368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724038, "uuid": "4c7e8b4a-9320-4203-abd6-7d3af287b0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724038, "uuid": "bf30e65e-dcf7-4b28-b328-87f7f6825dc3", "value": "Maersk Line Shipment Documents_ML IMP INV 5602585950 BL 608155160.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba73d29-c44c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1622711860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711860, "uuid": "4ae23bed-6675-474c-b765-dc10b4c67bee", "comment": "Malware payload (TrickBot)", "value": "83002f7c4a1a146640493e47038a525e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711860, "uuid": "44778d4d-824a-4c06-b11d-8b509e9a1391", "comment": "Malware payload (TrickBot)", "value": "24dd0b8a2e2faff39ea54abc2654d91fdd7349aad14b0537f4d05a6af0b16ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711860, "uuid": "e842a9bf-22dd-4293-8921-3a0e65497224", "comment": "Malware payload (TrickBot)", "value": "6f458150d952fef8e63713647758e832ef469432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711860, "uuid": "d96f789c-7772-46af-9748-ef348253173f", "comment": "Malware payload (TrickBot)", "value": "58b118cd070cca63d377866979957bfc749d5bb540845095a5cfda7046ad53517db69bfc493535b8ddd345c343798490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711860, "uuid": "f436a47f-b273-465b-84a2-953b6b416e67", "value": "86E4BE02BAB1C032D962C1384BD2E6B7A3B4AF357E66564723D4AE1F3D71D8149363B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711860, "uuid": "67b49458-31ab-402f-b52a-d419ee201934", "value": "10e442297190e1c0f99994fe9a24ffa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711860, "uuid": "e2884f40-bbbb-4457-89a9-30464ff429f9", "value": "12288:qHEx5GHlk5VNB/VidIq7BrKjyKoCObv66ijfqJmoMucaewMvFzLa:2lknNBdimq7BMa9i8ZMzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622711860, "uuid": "6314cf0f-d705-436c-b719-eee6afb23b0d", "value": 700469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622711860, "uuid": "7f92c469-dc36-4072-9558-69fc47594ded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711860, "uuid": "2eb4b043-8ce4-48c6-9258-5aa3e5976a9f", "value": "adb09kmML.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15116f3c-c49e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622746880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746880, "uuid": "621845a9-3dc2-4647-af62-06830c366ac4", "comment": "Malware payload", "value": "dcb0e617ba8b342654625a0d94203e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746880, "uuid": "90704229-6e17-412a-9e5b-56b7e9273a95", "comment": "Malware payload", "value": "266321f3918aa86a1b7915453a294ca5c36bf2072647b549cdd35f526b3375a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746880, "uuid": "0d4702b7-cd3b-4566-aef8-4106011a70da", "comment": "Malware payload", "value": "2941d4f6be287ef7d328faefac68d459dcbe89b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746880, "uuid": "acf9c7a9-fa0f-4ad7-a311-83469cbaa58a", "comment": "Malware payload", "value": "d4258eb9da249919ee0c18a00a069323410e54d834e56f9bae8df3081cfbdc8717690ff2e8ad8ff2dda257f8f0cb4d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746880, "uuid": "51435166-97d8-4aca-b578-1cddb84972f9", "value": "C9059F22A6F1DC33C1B2297F4F4AB2D85C2D7E412DE4B44676D4794CFF3A641B91A08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746880, "uuid": "58f435af-aabe-4f26-aef1-ab41eef3b6a8", "value": "c13589351b888eacb104575a16a88b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746880, "uuid": "05868ef8-c854-4200-b9e6-bfa9af07dd24", "value": "12288:9wZeGjiyhybwk6VAn0+A2NUj4pfIMNFkKOOikhoAOpbAF++n/tx:9sjhyZn4VuIMzOAAbAl/tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622746880, "uuid": "7f0cc15d-e484-4a78-a853-490126f2d08f", "value": 874136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622746880, "uuid": "17bd86c3-6a3b-40cd-92bd-42631ff7dd3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746880, "uuid": "8c1f15ed-9b0c-4b68-9ed6-ad72d4a69a24", "value": "SOA #220953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f43138c-c433-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622701129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701129, "uuid": "61372e89-7991-4b04-a780-9e419749402a", "comment": "Malware payload (AgentTesla)", "value": "9ce6f201ca93fce607c8f95b97e03c99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701129, "uuid": "726308ef-d636-4962-9685-4b6f46d02f3e", "comment": "Malware payload (AgentTesla)", "value": "298580b2b60cd18e7ac66ca75c0105309efc31478451ba1f338ff293af6b7e02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701129, "uuid": "085afa92-cc47-4c58-8a10-e73506a02ecc", "comment": "Malware payload (AgentTesla)", "value": "ae3776b7c305c5d2d8b1d255fb320c2496053921", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701129, "uuid": "ffd68e70-e333-4004-aba0-cae953225259", "comment": "Malware payload (AgentTesla)", "value": "b8f2d721c2e04baff9b1d05a2f8078267d9f5a018860eff4f45b86b6fcd26d087d2e64f0516f2fe0a0f928506d737c82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701129, "uuid": "ebb6ed2c-9508-4744-987c-413e79dcf558", "value": "AA25392439FA501AF173AF794FD4B5969A2FBE733B07641A2091334A4633A81DDC253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701129, "uuid": "4e9a8d5b-ce48-435a-81f5-d5b1cf8f628c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701129, "uuid": "5fbda7d0-877a-46b5-9b15-00e752bd13ac", "value": "12288:E++D+4qwLoP+2x/+9RyyICQSSThuLjlxIFoo3xdQINGdJHRlX++4aw1DkFDMKq8+:Eese7ovM40ksR/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622701129, "uuid": "ebe293fd-70be-4bee-a841-886210ac934e", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622701129, "uuid": "7207c87c-5fd6-4b8d-b256-c97206137585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701129, "uuid": "e699571e-dcee-48e4-8af8-30a73513e2e9", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32781ae-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713752, "uuid": "453e0f19-c115-4f83-8b96-bae4bf186693", "comment": "Malware payload (AgentTesla)", "value": "c84c6557f6cf8e87f9830d5e7c6851f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713752, "uuid": "8ba60c77-388f-447f-a654-d33585fa3f75", "comment": "Malware payload (AgentTesla)", "value": "2bc19d11b2298d3d6ae3b811e05ee6ff91fc3193a36170081f367f5f6371a1a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713752, "uuid": "b6649bc4-4d8d-4776-a9fc-d386469bd8d3", "comment": "Malware payload (AgentTesla)", "value": "71ebd00b8e28c0cda94311991db61fd5157a6e2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713752, "uuid": "5971942d-74e2-48b0-9e5d-1981f2e10591", "comment": "Malware payload (AgentTesla)", "value": "46832e9d51ff6cdadab30030985b5144152db32c0495cbabf4c610b09c8ef3dc707179085368884f4dd0c7baf843f92e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713752, "uuid": "d99f45a0-84e0-43da-b745-2765d57add9c", "value": "26657CE0F394C8A1E42FC771D9255C7063F23DEE9AA5800C16E9BB4E2E73B42955ED09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713752, "uuid": "229bb2a7-252e-435c-a797-5a103b7f3229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713752, "uuid": "5e190e5d-caa8-4835-b6ba-7d682078f10a", "value": "24576:U0Y7bFOBJrQryEF5jlGnNm275dE8NIGkNoNFOGr:FnTdddNyNuFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713752, "uuid": "8e4d92be-e856-434e-a280-8ab327f33ee5", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713752, "uuid": "577351c7-1944-4bb6-b124-f2f46d74f66a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713752, "uuid": "4b114045-8dac-4f48-b884-3718cfa61faa", "value": "c84c6557f6cf8e87f9830d5e7c6851f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7032a4-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622717876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717876, "uuid": "7adb55bf-b5c0-4309-899c-28499ba1cf6b", "comment": "Malware payload (Formbook)", "value": "9e58383115c669f75786d2d1c0dc5b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717876, "uuid": "94a258e8-2836-40eb-87d6-c88679752870", "comment": "Malware payload (Formbook)", "value": "2bc313b25d9cabf26747b98eedc7bf0e2ed264375a5951cd2a16c671b7eb0df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717876, "uuid": "c65320ab-9fcb-4d22-914d-96e5a99f1ee8", "comment": "Malware payload (Formbook)", "value": "1236ae35cd32faa87b1991f122fa3acae40dfeda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717876, "uuid": "da310603-6a42-4b90-b809-53a185c115fe", "comment": "Malware payload (Formbook)", "value": "c1ac74652ef290fb75d6ed0840038e58900d5d18169db466effba47760b038531a6a4156362a0772e40d85bf17dedf1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717876, "uuid": "04ff2942-aa09-43fe-84e6-271e3c54041b", "value": "AAA402903EB4D031D18801B89DB58782FEE72E44026AEDBA3F043B966DF2797615F346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717876, "uuid": "9f83528f-c4cf-4f89-ad5e-c4a6d0082c21", "value": "b840b1c1d0d81f6853fb6cabdba055e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717876, "uuid": "ff603ca1-2db4-4842-8c7c-59a469b341cd", "value": "6144:yF3rrK9+N4O70UuWHsz5kfb0oJEoWJpnzV6TS4L5hgVx4x2XEH3tbMPzSauR5K:yJXK9qnYU1sNZoJEoWQJ3gVGuotIbD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717876, "uuid": "05e1ef19-521c-4ddf-a678-2df2b7fb624d", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717876, "uuid": "ec77e2b0-3f28-4c6b-9fd2-c70fb22b264f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717876, "uuid": "06dd5fa5-7e90-4e3c-b61b-8934029de106", "value": "SecuriteInfo.com.W32.AIDetect.malware1.20356.3998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd4e579-c487-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622737201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737201, "uuid": "30193b4c-7127-4767-a621-17e7ce1c8841", "comment": "Malware payload", "value": "0b3f5b702a86b0d097968656ede654c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737201, "uuid": "e0b45bb8-dd5d-4dc3-95fe-f96b77cde1a3", "comment": "Malware payload", "value": "2bd5941dd83aabe6f2b590afeafeaae5793cf60186bd700f2643f203931cefda", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737201, "uuid": "66c2f722-896d-47c9-935e-646dceb145eb", "comment": "Malware payload", "value": "644b42314d4b88a65087df606d7188dac6ec9561", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737201, "uuid": "b0931d78-6d6a-4e80-a56a-e75e12198234", "comment": "Malware payload", "value": "e727de4e9fd00a67bb3f43dea9235768e093a0367c10b5e8b3636dfda5349566d4f14257784efdbe445a3f36eac94477", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737201, "uuid": "bcacd58e-0957-42cb-b58f-7a0ae433c066", "value": "6DA1B571A35D5853CA42D5B1D9FAFF6207A2F307C3C72B90336EF9E10B5E691A920451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737201, "uuid": "f43e5704-4d63-4203-aa97-3f324203de08", "value": "96:uIe5OrZO4eYVZQN7Rv0xQ16ZM8SKWXq7OAGe2rc9QVDgaF0rQa:uIe5O1OyKCxEAIXxJP+QVSrQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737201, "uuid": "1734cb92-43d8-4948-ae60-2d2aaaf52fd4", "value": 4841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737201, "uuid": "78285edd-7e17-4b0a-a44d-07259e76dea6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737201, "uuid": "4b4cec29-f4fe-4d80-bcc6-a3c3c88e3c89", "value": "RFQ-9010543.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f28c19-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622717883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717883, "uuid": "0ebfd743-fece-4aca-ab83-565f829692a0", "comment": "Malware payload (GuLoader)", "value": "37a1a7a4f9d11930d2d548ff9e0559fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717883, "uuid": "921e6883-1e69-4db4-bdcf-6d7bcb25680b", "comment": "Malware payload (GuLoader)", "value": "2bf17b827e1be1f3a8b305a4e215347d08d32ccac5eb4028d49391b30c6ac4a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717883, "uuid": "de393297-f895-45be-8c3a-66ffa09e2ad9", "comment": "Malware payload (GuLoader)", "value": "ad1472bd30a74e04cfd05f8b240b496e4d3a1fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717883, "uuid": "f36ebbe3-cf6b-4cb2-a0d6-b8b5b549ff38", "comment": "Malware payload (GuLoader)", "value": "74bd599777a67a7d341ffc20e11a590da62cd6a80beb149726e4713cc5391c9fb36f8076e810178407a2625d5bc885cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717883, "uuid": "fe2ce44f-0490-4eee-a0bd-8ce057b2917a", "value": "9BA3A633E3421715F61A4FF03426B21633375F6B44576E12B388AAA9E8F06D7B1D874A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717883, "uuid": "bb6edf4d-9f6b-4fb5-8dec-fe25047f6210", "value": "329714ba87b5b72d54f447a30ad0c5e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717883, "uuid": "780b4b80-76c4-4f74-b864-4a4251bf22f2", "value": "3072:7dIApz7JMTL7BMViWCfga1McntPEuSRU4hJnE:7n0KViWCYSMcPlWU4hJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717883, "uuid": "88feb2c3-e8b9-4d55-b7a2-ce0d8de835de", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717883, "uuid": "1764fd93-8650-43aa-b74e-4154f5ba6db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717883, "uuid": "ca2bc75a-7722-4501-83cf-9ce6b90f3bae", "value": "SecuriteInfo.com.Mal.Gen.27056.24279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409b6ee9-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622699279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699279, "uuid": "12a4e7d5-f4c4-474f-9808-531d44e63ab7", "comment": "Malware payload (Formbook)", "value": "ed18fff39b26307348c7b706bd88cb13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699279, "uuid": "97e89727-9523-4a9c-bb3a-18af12e4ecdb", "comment": "Malware payload (Formbook)", "value": "2c0a9932691bf32df8984001737918766563dfaee3784470307dcd103ac702f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699279, "uuid": "e3ae7a9d-e2cb-4b69-8542-f62c15884100", "comment": "Malware payload (Formbook)", "value": "632e5ce55d2482e2fe9735c771cd5902165e6120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699279, "uuid": "5bf10775-670d-4bbc-94f3-3e0454abe0ea", "comment": "Malware payload (Formbook)", "value": "40e1cbad321063452180406ccbc154340c909ad03446e2bcc854a43a790db19762429247eea2aab57f85823daa54e894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699279, "uuid": "d7b74fbb-7150-4cf7-8602-65582046f9d0", "value": "A2B402123513CCB5FA360E72DC94CE72961EBC719274C86B72C49ED989B28C8BC255BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699279, "uuid": "20e558ec-b55c-4bb7-a580-7fc9fcd06cf5", "value": "6349db18596ebf564d02723a6dfdc378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699279, "uuid": "a1e70c43-e289-40d9-ba63-0ca756ce2b9e", "value": "12288:lbXMSaoxxGRsUWMlagE7Y/Tt3GHsppuoz:iS1x07WMJE4tWHs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699279, "uuid": "574b3008-92f9-41ca-9c62-1dd6685ed933", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699279, "uuid": "8eb0cc3b-e1f7-441f-a11e-a241511c0f47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699279, "uuid": "6ae6702e-8bda-44da-af47-acb5d2bc6772", "value": "ORDER0429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e21fd8e-c497-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622744103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744103, "uuid": "37ab0d62-9e97-4324-acfa-392230ec4bdf", "comment": "Malware payload", "value": "cbf41732f10a8bad76d9fbb80326fa16", "object_relation": "md5", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744103, "uuid": "bf9af41f-765b-4bac-a914-336f9cd404dd", "comment": "Malware payload", "value": "2def8f350b1e7fc9a45669bc5f2c6e0679e901aac233eac63550268034942d9f", "object_relation": "sha256", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744103, "uuid": "d222b36a-a2d2-4a48-9a52-6188692f442e", "comment": "Malware payload", "value": "647198ec6363fbdccb4c4cfe5fd6133ecd87cfb7", "object_relation": "sha1", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744103, "uuid": "d60f2b4a-13bb-4647-87c1-dea83d5c684a", "comment": "Malware payload", "value": "feddd01d959df193fa6a761d9885f89f65016621c398df417b1978f6b40799fe3cde5c8d27bfb76bd6c479381dbe61b4", "object_relation": "sha3-384", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744103, "uuid": "312a661f-8ed5-42ff-bb29-67c6d13416d9", "value": "8E8501820B5557A8F6480EC9BD9E395720F1D467BC350289EFB329DFBC3BA865030A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744103, "uuid": "78e45e49-a59a-4b12-9ecd-5ba20884ba56", "value": "1536:E1aBItUPHpjkSk7gV3YDBUDtKorditKlxg6Z3vtU1forOyPpekIzzMswWIjQnMvj:dH4HMjoyV7DaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622744103, "uuid": "7a423c3a-ddb7-4f8d-8f21-6b7190592167", "value": 1809862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622744103, "uuid": "70bba1bf-daaa-403f-b635-0ec8a8ffa022", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744103, "uuid": "d9c62a3e-810c-4762-ab1b-7ca7178c2351", "value": "presentation_37142.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e5a02-c448-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622709985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709985, "uuid": "abedb9fb-dfb6-40e6-bec3-2d83b9c7cd97", "comment": "Malware payload (Adwind)", "value": "1082797413478de14721445a4bbed1c1", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709985, "uuid": "b9ff752c-96ea-42b4-a90e-a1b9a3abafc5", "comment": "Malware payload (Adwind)", "value": "3122b6c83e00765f07b330e9e50ee5763634490882c780a585c30c21fab0e673", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709985, "uuid": "a9e6ef0c-99e5-4dfc-9617-4cdf397f14d6", "comment": "Malware payload (Adwind)", "value": "42e802427774b4c520049e1f5b2fef97164e5487", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709985, "uuid": "744a9af3-76c5-4b8f-96de-ec623a494efb", "comment": "Malware payload (Adwind)", "value": "48f3a7d663956e9f4be15aab6822fb6ec72a72ec6f7f6a6cc28855d78d8ae31d7733b914737ed8f643b8c51526cf8c45", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709985, "uuid": "e5bf96ef-70ea-42a1-a119-f7469e8a6aae", "value": "B86423484B61FF28D7B7E9B4AC175029CB7282A47C78DDE2C646A59AFD04BAC0F5C04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709985, "uuid": "6945361f-367e-43ec-a978-c6c6f14ed24c", "value": "6144:1pXFWJ+Gwkxz53Z03BOlrQRIBQ8is32MLuWmryWo:1pMEU953Z03B8iQZisG6bqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709985, "uuid": "53ce808a-c022-4a43-b1c8-e5f327d2d152", "value": 324314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709985, "uuid": "d03894be-867f-44ab-b443-b44d3fa1c3ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709985, "uuid": "028786f9-5f6f-4c6c-8e36-fb667f0b158f", "value": "v6sUOPNTB4CmH2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815314c7-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713990, "uuid": "08eae315-388e-444e-b6b2-77899045794f", "comment": "Malware payload (AgentTesla)", "value": "422374731058fa0a7ea0607e368e1e10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713990, "uuid": "e77d40f6-982a-4629-a100-4154abb9e621", "comment": "Malware payload (AgentTesla)", "value": "324d1cad5bb30b0d9d920e5460219eda13153d0a0d8a4ca6f1a7596704093029", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713990, "uuid": "93e395ec-2250-4646-aa4b-f7c756918647", "comment": "Malware payload (AgentTesla)", "value": "cd9bdf2e9e7e46287e8060c696ad59f3335b3757", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713990, "uuid": "2df1cc44-66b8-4b0f-afca-2071aa43ca6b", "comment": "Malware payload (AgentTesla)", "value": "09bb50304bd7d91c8465e926da97980493578d7f7e169166698f5152dccb67b3e1cd71946678dcad1eb927457553a181", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713990, "uuid": "bd60f388-75c0-430e-8f39-232f9fc0d84a", "value": "E9158DF8F1A8A8B4D15EC772C3909CADDBA252FE5303892C16A5CA8D1F1378ADF4D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713990, "uuid": "d5160090-5b90-4512-86f2-21ba40922584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713990, "uuid": "c2d33f62-dfa4-4fa8-bd1b-ea1faa571ae7", "value": "12288:1gyFL6kBqVB9dAcDrDGe5HRVqXji0blDDwdbaOUWTgxdR27iXvT:VEz9dAcCGHLqzi0dDwdbaOPGRYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713990, "uuid": "3d2b923c-cf2f-4a18-91da-25c828ae798f", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713990, "uuid": "53be184c-5b8c-4884-9482-0c14fb27f861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713990, "uuid": "185a55d4-8948-4b1c-82e4-3de8142a24eb", "value": "422374731058fa0a7ea0607e368e1e10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb35928-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622700237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700237, "uuid": "085654c2-227f-4d28-872c-6c616dbb2e62", "comment": "Malware payload (AgentTesla)", "value": "61357bd29f719f4b7f2a237b42eff70d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700237, "uuid": "edc86f65-31d0-4d51-aba7-eec8f6c32941", "comment": "Malware payload (AgentTesla)", "value": "33129214b46df54bc7a37e566e20bcbffc70de1d672a8379c114fb88b6c13c67", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700237, "uuid": "01921fcb-496e-4aa1-8433-5c1651a45221", "comment": "Malware payload (AgentTesla)", "value": "5a696b56b0a590de0ec2fae31bfffd9fbb96e192", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700237, "uuid": "2845410a-ab1e-44ac-aeb6-4be8ea4cb83e", "comment": "Malware payload (AgentTesla)", "value": "a2ff900298678b6d6e999ee3ce15829157a0624736b98695a8af10dda07a0fb9983745634cabe5d3b17f53fd80d897e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700237, "uuid": "958ec9de-2808-410d-91f9-fae2acbfaeed", "value": "DAA423BAE906BF7863FD4035CECC2ED88BD4E58D0973FE2DC5D4986456A1A18892C1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700237, "uuid": "1b5613b0-a09a-479f-8c8a-4ab476a8b071", "value": "12288:43UQRETPzreRZimWQZmUeSf+OXCYCBXr8JO/m1hpfYNk5iIsBAS:yUQ6TMUU3j59cXYJO/ChlYq5iDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700237, "uuid": "07e22077-a4a9-45af-8389-ea934b3ec87f", "value": 484731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700237, "uuid": "9eba1976-b186-4588-950c-c36a60601587", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700237, "uuid": "f9d18b2d-79a6-4dd4-ac34-714e1003b787", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f921566-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622724241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724241, "uuid": "28e2cb2e-2ba6-4eb8-98ec-55da9bc02862", "comment": "Malware payload (ArkeiStealer)", "value": "9243520e8665c620e93c10508bf2c223", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724241, "uuid": "1198aff5-08fd-444d-aa97-16e54a1c4521", "comment": "Malware payload (ArkeiStealer)", "value": "33c2ca1cc03550022c20d672a3d541cb1b1d2009458dd46493bdf950e9ddc411", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724241, "uuid": "02d4dea6-ab27-4896-adb9-e96269f0e92d", "comment": "Malware payload (ArkeiStealer)", "value": "e9d1f0a0b4e6d6e0c5e1510d426cc319fca5526c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724241, "uuid": "039c088a-bf0b-47a7-8389-eb3e0ec9d390", "comment": "Malware payload (ArkeiStealer)", "value": "7c6085ca226ad8ca5204a31bb41ab0ff44b4e8dd8731daa93115d7eda61274c638a9f75d5a2a346e406766d5086c9e2d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724241, "uuid": "9544962a-edb8-44dc-b693-395257ca9efb", "value": "BBD4E111B7D0C035F9F312F49EB592A9A53ABDA16B2840CF52D427EE1778AE0AD31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724241, "uuid": "cc257617-5059-485b-8d15-2095ce079d53", "value": "ad8bd715488c60ebd0287d0239f0c2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724241, "uuid": "95084434-4596-4f44-92c6-c257b42378eb", "value": "12288:LD1tinaY6vnQS+EMtz4ouc9sNiKoak1wpAYEUrxEL1PRxcj6D:LDaaZvnez4ouqYiBa4f62PI6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724241, "uuid": "8792d207-a9d4-4448-982c-ffd11dcfcdd1", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724241, "uuid": "40a77fcc-fa82-4274-8e7f-eba21790f81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724241, "uuid": "1aec7b30-dd64-4f1c-bffe-a11a0341691f", "value": "9243520e8665c620e93c10508bf2c223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709cb11e-c43f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622706231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706231, "uuid": "f33a4b11-e29c-4f84-aae6-415b20cc5b63", "comment": "Malware payload (AgentTesla)", "value": "42ffa1de50be92d60b689aab661df047", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706231, "uuid": "a67696ce-5cbe-4a39-bef5-32b7e3180757", "comment": "Malware payload (AgentTesla)", "value": "34af58f335471b4b04ae50daf64d5e109ce47795dcd3f5b460b10e2ffff0e458", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706231, "uuid": "ab4dc638-e394-4e29-b1d9-8ce8ecf7fd0f", "comment": "Malware payload (AgentTesla)", "value": "d877e81aeec8b2ddc2efec4c5da48a9d405e929e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706231, "uuid": "69fe7cfe-2685-419b-8e83-6f41a5268b82", "comment": "Malware payload (AgentTesla)", "value": "a7a1dbf183bb082833592a4c0c76a3f6134974b5b0c2fde363dcc1398aeed66f73ebe0bc3f6b303d2adae0900189f34f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706231, "uuid": "841d4a6f-32e0-412b-ad7a-fed6f72bf239", "value": "5425238CB9C747A3C1D367766830ED80898DEF19EB14E6F7565D74E5B2342227980C8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706231, "uuid": "7c331ee3-e484-4803-b431-89cdd2aafec8", "value": "12288:BVHT/xE8xbxOzJXKZ6I0yB/JNTKtDp4r4l8AsTO1SrHDyIzOOD8Ave9Iq11Ke:3zxE8FwJK84UlVsTOw36IlGe2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622706231, "uuid": "ecf86f22-0481-4fdf-9564-c3c00d6b6bca", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622706231, "uuid": "2d334802-a2b0-4484-85d7-7b60ff16e865", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706231, "uuid": "39ef127f-7a8b-4ae9-b163-3dcc2792cbee", "value": "item_list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf2b6c4-c464-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622722061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622722061, "uuid": "3a3e847d-179d-4530-a866-337868580ebb", "comment": "Malware payload (Formbook)", "value": "8c505817b84de9e7f5fcf482d8834647", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622722061, "uuid": "81965235-7db2-499d-9218-9134b7de0a0e", "comment": "Malware payload (Formbook)", "value": "355af5bcaf4798d93186e2db6b9aa813b94e5d9dfa13a7d1b2ee9ca547ac2780", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622722061, "uuid": "e085cd7c-6258-4e8f-8c50-de58fd42907f", "comment": "Malware payload (Formbook)", "value": "44f1dcee6ecb8cff98e488e19de8801baf02483e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622722061, "uuid": "29127db6-b6d4-403c-9068-05ed79f60956", "comment": "Malware payload (Formbook)", "value": "607dbf30e553d78e297356a17974a805c7691d3b03d9ae9e2b6de05061d3cf8a41e79f8ddb79ee8443a9b0c8fe7985a8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622722061, "uuid": "a55e7d38-2114-43a5-9bd3-6e83004aa07c", "value": "DE0533424E9A4A85DB9B4B4ABCD31679D79231DB6B7924057A8F31FC4BF0E3B610039C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622722061, "uuid": "3fe3ef78-cef1-4042-b661-89d877a03e1a", "value": "12288:9FH59+Yw87akFKH02MbRwkg8NWuvmPP1m+zO/wA8fn5GxfWlz4B6UkR:D59+Yw8hFKU/wmJcm2A8fn5GJK4oUkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622722061, "uuid": "437db459-cfef-45cd-9a6d-2973f0185192", "value": 847980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622722061, "uuid": "31853649-55cc-4aba-9216-f6dd700257e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622722061, "uuid": "e628073c-5053-4b02-aaf2-64a422b94668", "value": "Revised_Order PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ff8630-c430-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699742, "uuid": "fcf216bf-8e4b-404f-891e-af1998a0d166", "comment": "Malware payload (AgentTesla)", "value": "f035b74d0b0881c56089ea556cec3aea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699742, "uuid": "88509a74-0cbb-460d-8e1b-f50530038a16", "comment": "Malware payload (AgentTesla)", "value": "37211ea70920adce4d2704187d8f45233724e84c2dc18158387da8bf2e94eee0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699742, "uuid": "d9604fef-fe31-4a10-8a61-b9628fbda500", "comment": "Malware payload (AgentTesla)", "value": "37f0228fdb6a876ba7a661a5e9c387c019fa4647", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699742, "uuid": "f8891a98-d118-435a-ac0a-60b63fd8e6aa", "comment": "Malware payload (AgentTesla)", "value": "2eccb512e119cc9620734be077ce4cf8ee876bac7706d5fd2d9db65b84c59da77eeb2cf7b8f81e7be937a80ed6845893", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699742, "uuid": "333526da-835a-43c8-9938-83047fa9c66b", "value": "9675E692F5938E28E299CB778EEFA80C83BE8DF506512F7D4F7355482F52352C509886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699742, "uuid": "6181ac97-3045-447f-95ad-c851f0fbcfb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699742, "uuid": "b679edac-bb64-416b-b0db-a49ffbed2287", "value": "12288:H2t+n4zDNQjeFyOouJU+FxM2gh0GVnL0PebH0mokXfgvWABna8t8HUZvTj:Wt+nUoPZuJ7LruSeblokYvWABVmHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699742, "uuid": "f9fb9ad3-4560-4d5e-9cf5-6bbf63f3eb8e", "value": 1563648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699742, "uuid": "87234be7-2727-4866-984c-744081d54222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699742, "uuid": "896cc6fc-dce7-4e9d-b22b-c73eef586f71", "value": "payment confirmation copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e15401-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734377, "uuid": "ac7928fc-330e-4603-8d94-326826a77e68", "comment": "Malware payload (Gozi)", "value": "81e4f969f47c296d139cc19afc2e4d15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734377, "uuid": "b96b8a75-f751-4ccd-a8d6-3a04e9385f69", "comment": "Malware payload (Gozi)", "value": "381d3822ec532890a3c417e7859717c58420650f5f25444055440a3ccc889d76", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734377, "uuid": "774601e5-0eb2-446f-8a65-fd110877e328", "comment": "Malware payload (Gozi)", "value": "447cc26338b17fa13650a9a7a7fbc94f060daca2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734377, "uuid": "7306ce05-342b-4721-acd8-4c4b1e092c92", "comment": "Malware payload (Gozi)", "value": "bbb0ccf2f23fe6e7f1fbf65201c649b763797bc9dd48b5d0a1be1ce09a898184efb54311cc2e573aaf85a3df2cac0f77", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734377, "uuid": "405f2d2e-85c0-4c56-b2ab-d9cb4d3def5c", "value": "C1B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734377, "uuid": "95a2754f-335f-4d4d-bc9b-15af785df2cb", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734377, "uuid": "fba8e114-c494-4cb3-b985-7b62eef5bb62", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAv0qW6mZuzuJPjX7R75:vz75tzST8Asq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734377, "uuid": "63c0e0e4-ee96-4b91-a132-0344e2480abd", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734377, "uuid": "53d58117-5e5f-4c27-bf35-3749de461be3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734377, "uuid": "9a1e0478-d05a-4c26-aef9-7540edb295ce", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fe2053-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622710532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710532, "uuid": "93c3ee5d-3003-4014-b093-293a4c77ab05", "comment": "Malware payload (AgentTesla)", "value": "5ff36e8a800b5fa67b83c427df480356", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710532, "uuid": "bcc66762-cf20-4fcb-9d0e-2ef2c955698d", "comment": "Malware payload (AgentTesla)", "value": "3a8250e0d2ff4904db22d00a5c18f82bce1b2bcadf1a4d1029ef1c02e5210fbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710532, "uuid": "10997156-0856-4858-ac48-776fd18bdbcd", "comment": "Malware payload (AgentTesla)", "value": "693ac7d68995d30ef3e5871a14f6ff91d1795ea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710532, "uuid": "603a7bc5-c380-43cd-884e-78ad98929805", "comment": "Malware payload (AgentTesla)", "value": "09f425bad14538cb741e4d854d27dd76605338def4b9fd76f978c5fc2d28958f97245a489d70551c93744a5f886b4221", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710532, "uuid": "6d1d44e9-341b-4fa9-b87e-3fd9fce5d256", "value": "6BD4E115F2A48B8AE0185F735765D6005F743C13B429D62D68A533E748B2BA32A6BF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710532, "uuid": "c71b4707-8a8a-4130-93d7-620b83fd3a56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710532, "uuid": "3787d65f-cb36-448d-b058-fae9d8ce4c57", "value": "12288:0bhmpXu1EzAoWbhxEczjRIqcTWdFYvoRsYqipr8pcDOA7FqlF4m02uCpFge:Vlu1Eco27EQRIqcST4oRJr8psOA7/mX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710532, "uuid": "8113dadb-5a5c-4082-a3b9-5d042f404c81", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710532, "uuid": "b79b97de-fbb8-45fb-963b-e0fadd302bc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710532, "uuid": "b2d3c1d6-5c8a-4206-b87a-5a564c767cd2", "value": "urgent po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab63259f-c447-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622709766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709766, "uuid": "a77eaa1d-4370-4536-91c7-a5effc29c896", "comment": "Malware payload (AsyncRAT)", "value": "3dc3f724fd5f4413a6812eff511264d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709766, "uuid": "3f3b8584-8228-45c7-9c5e-a7f4aa4a7309", "comment": "Malware payload (AsyncRAT)", "value": "3ce998c34af1bebfa718a44e70f818b29fa93df17a4d25c6415bb639eb9c37bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709766, "uuid": "394255be-8704-4794-9338-80df08e37f7c", "comment": "Malware payload (AsyncRAT)", "value": "3d77509b4dc810321cd9ba1fee0285519eae8ae6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709766, "uuid": "be138ab9-b4dc-45d3-8772-1e8069ccd4ff", "comment": "Malware payload (AsyncRAT)", "value": "bafbbef4b856fc696f8094a309f9c274c50d859cbf1b8fc8a6b4ca6d34b0940a24b8ba4ff06d1ee5065e72b8ab93dc00", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709766, "uuid": "fd2d651c-351d-4ec6-a330-07de7b9f661d", "value": "36D02279740CC88223936BAE229B820D8CC888BD53B0981D3505C35C31364289E2E1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709766, "uuid": "2c5b3dd9-5518-4719-8e33-75c75067ef01", "value": "3:iHKAwXMD2uVoLiWAjoMUVnovXCTFN2AGKjqF7mMRBD43SDRhCELF475TVo:iHKmF4iHjojovXCD2AdSJDRhCEB4lTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709766, "uuid": "d4f4796f-a01d-4d59-a403-74880f3ade23", "value": 205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709766, "uuid": "e57d6356-11f2-440a-b806-03c9b8b57d3e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709766, "uuid": "f14a74d7-48a5-4474-8d0c-2380df9ca9c2", "value": "Order-ID094962680630143.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1e4322-c49c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622746249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746249, "uuid": "eab01926-fce9-4a10-8f89-93cb88adae93", "comment": "Malware payload (AgentTesla)", "value": "f6783cd1f66f028108e33c4865f27165", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746249, "uuid": "faaab55f-9148-4080-8fc4-7bdf7e57af23", "comment": "Malware payload (AgentTesla)", "value": "3d040cd778049b25bc8dfda10dd89287ef34ef8feefe8e444e25aaef4ae4402b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746249, "uuid": "bde7b961-1368-424b-850d-a2434cb5cd29", "comment": "Malware payload (AgentTesla)", "value": "cac6ed47fcad12151b11cbd8b3197c9a3246be84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746249, "uuid": "b9099915-e2fb-4fe3-94f2-26e3d5e96d1c", "comment": "Malware payload (AgentTesla)", "value": "98f95d7da1546ea70faee2826a6b54ab3195d82dbc71c1a1df97c6830120bd5d5352569434d5d71f9663f3d84ca7868b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746249, "uuid": "66e43725-6c70-44b3-9fa5-a9eb38dd4cff", "value": "25158DF8F59898F1C15DCB71D7909CAEEBA151FE5303892C0AB9DA8C1B0379A8F5D844", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746249, "uuid": "91d24ff9-736f-471f-987c-36c256fa7ec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746249, "uuid": "d3fae01a-6b8a-4342-8696-57611c602311", "value": "12288:6faMYXD1SYonovTDwNggMRGfnuSmwptSupXvaX0H6hZRB1C7yhHsf0IjBv4C4xmV:6f9YU8u8RRaSuFvaX5V1bMf0mBkAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622746249, "uuid": "06b1bb7d-7254-4313-93af-53e2b4f0be94", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622746249, "uuid": "5d650d90-ac98-4c97-b6a0-456dd99aecc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746249, "uuid": "1dc50edb-5432-48a0-be4a-d82932c0d963", "value": "MOQ FOB ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8333d5ab-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622710557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710557, "uuid": "6543c2ff-bb05-4108-a195-181b35d357e9", "comment": "Malware payload (SnakeKeylogger)", "value": "018e8430f0f87e337a2906d7fbfd9aea", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710557, "uuid": "9c012aff-6d12-4422-a898-ee2f7a1fedf9", "comment": "Malware payload (SnakeKeylogger)", "value": "3dd02a3414db4e5a1db01809c06efdaa20f5f7be4b76ecec123f4d95d4c66106", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710557, "uuid": "53fbd8ab-432e-44fd-a9af-3dcee9d0aaf7", "comment": "Malware payload (SnakeKeylogger)", "value": "937062bbdfd27ca8ece7bea50b2b3abd8cb5b539", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710557, "uuid": "14a02705-3f6a-4f03-8470-6f259744b413", "comment": "Malware payload (SnakeKeylogger)", "value": "f3a4fdc0da09f02890b729390819db126347b00050a88ecb86e82146d01e28431847610fb75df9ca50d8504f26e7234a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710557, "uuid": "463f4993-c95a-4bcc-8b8a-061f315bc430", "value": "656423E7853887545491F13FE2103117A425AF8A6716EF3CA66EF801307DA7392FDB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710557, "uuid": "cde19e3e-240a-442c-b326-9d6db4943ff9", "value": "6144:XIftMnvFN0LUUL8FkImTQL2JkhCV3fEQklRXUlMFJS6TX0LnGMybv5SO8:EwN0LNL8FTwo2e0V3fEzlRXtBTXenGjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710557, "uuid": "2308d70a-b79d-4508-b5fb-a0cf853da0c5", "value": 322742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710557, "uuid": "86f35317-09e1-4622-9a0a-1538e12aca15", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710557, "uuid": "419ec84c-17d3-4f00-990e-75264b3cdfbb", "value": "StandardChartered TT copy_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d807216-c467-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622723406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723406, "uuid": "a43ff711-65c8-4918-8860-ab43b84323bc", "comment": "Malware payload (AgentTesla)", "value": "7ea874cad90f58d769f35185efe30be8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723406, "uuid": "06282a79-0fe2-4f8a-8cf9-d63b0fe640c9", "comment": "Malware payload (AgentTesla)", "value": "3ea000933c44e1c21cd8926c5e7bec061de4cffdea1c0cf04522f1e286ed2183", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723406, "uuid": "f23aef86-95ae-4dad-a934-3e6f35c356ec", "comment": "Malware payload (AgentTesla)", "value": "9d2fc43bd28c33dcc29a85e79dff85d4ba962f78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723406, "uuid": "818a6819-1187-4490-bd83-ed3c6f1d703c", "comment": "Malware payload (AgentTesla)", "value": "a65792fc4896ed3014ae5624f010a2225da51e3db25f55a0a1b3b5cd3130d4a1c89f11da219d7ba03dcf13e4e469a2e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723406, "uuid": "023ea54b-54e7-4dcd-bf97-6e55e179a279", "value": "E1D4233A44984AD7AB39E450AF845231CFE45B1F2EF60A827637BEE6840C0767163DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723406, "uuid": "b5665cfe-3b8e-48c6-98a2-4222b511b99f", "value": "12288:EsMPJFW8f1sxmU5O5pf2mBqhoyEs75Ydy8Nve4n4:cDWZJ4eGIoy75eNe44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622723406, "uuid": "872cae03-8a7f-44a8-9c42-3cad9b6ca117", "value": 615047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622723406, "uuid": "2a18c826-3918-4564-8222-5c6daca18de5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723406, "uuid": "53a2974d-ee12-4af0-9be3-5d338a877a5d", "value": "SwiftMt103.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ba58e0-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734476, "uuid": "1694d5fc-ac44-4b19-ba5b-b2629840e366", "comment": "Malware payload (Gozi)", "value": "54028c2450ad69a865227c2d7c025170", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734476, "uuid": "d08316d2-d7e1-438c-9701-aa36da300a7e", "comment": "Malware payload (Gozi)", "value": "3f83656c6edac1ec22ee5cdf50636b83291588d44b69933e81b2fe9d47b1c8fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734476, "uuid": "552bb7d2-e5f4-451a-968c-e83950772127", "comment": "Malware payload (Gozi)", "value": "f04fb5d2a7eda70ea096d985401361298b9af7ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734476, "uuid": "7dd2ba2c-afeb-42f8-90db-b468c86eb495", "comment": "Malware payload (Gozi)", "value": "3a34417065fae6fd775633bff67cf2813546b44a419f5e2f287a2985dc185842bd6d19dfac319430b17701de2b5c93fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734476, "uuid": "e7116531-1a2f-48ce-a454-c10886d48780", "value": "8BB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734476, "uuid": "16aef437-24a9-4d51-8898-8223e7de3bc7", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734476, "uuid": "edf11d59-4fa9-41d3-97fa-93e8f45bc09b", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvbqW6mZuzuJPjX7R75:vz75tzST8Azq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734476, "uuid": "ecd5c766-1836-4ea5-b44d-6b6122c7c5ab", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734476, "uuid": "8bf4af76-b2ee-407f-aa3f-905762b0e98f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734476, "uuid": "8d5fc38f-08a2-4a60-8869-b9a5a7baf11f", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5099a8-c45e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622719589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719589, "uuid": "d316c579-1f6b-4960-bfdd-73955df72f54", "comment": "Malware payload", "value": "ae180dc8d9a48dedcd22b925cf31dbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719589, "uuid": "78eb35c1-22b2-4ac2-ac09-8835f599d75b", "comment": "Malware payload", "value": "4055ca8797b0aef691d55429e0fc5eee84273eee58ad9403dea50f36ef476042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719589, "uuid": "605d5819-f7fb-4512-99a4-655102a90f36", "comment": "Malware payload", "value": "9155eea84ec8fd4abad6b9bb360bbd4727c31842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719589, "uuid": "fed2626b-c30d-4758-a0c2-b2127139d822", "comment": "Malware payload", "value": "75e34fe001b0f4e3ae4ad2a5960f639383cf681c94dc677de04b1593aa918a9e590b251204bd902130415a6484806749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719589, "uuid": "c6bfaed1-d276-4916-8a8d-cf206a3aacb6", "value": "C9A2AEA6BE9CDC93EC36C1BDC90A8361C9AD33C6132D827B8D6878243E79764A530211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719589, "uuid": "b85aa54e-062f-410b-8ecb-67c4e963b4af", "value": "feb2e99724f1097a81e5d5ff8705e96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719589, "uuid": "25ee6290-846e-4cd8-8f05-850e67eea4e6", "value": "384:Dphh49Jl7Em/lncCI+OpiawSwulw/lHBxk36PRj0TCF7jhcg:VhhqCm/lcCcpiawSwxXxk9mF7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622719589, "uuid": "f82cfd5f-727f-4332-b4c0-cd447d3c019a", "value": 23044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622719589, "uuid": "21c8e09d-eb6b-48b6-8403-5cdd35101134", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719589, "uuid": "d3a40f31-0acc-4488-9b7a-898b68de350f", "value": "cultuses.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ae6ab5-c428-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622696412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696412, "uuid": "b9cb8828-b1aa-45b7-beed-543e6bb25767", "comment": "Malware payload (Mirai)", "value": "cfea965686665256fb1d4505af3b415e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696412, "uuid": "cc1786d0-9b09-4e71-978a-192ac9844632", "comment": "Malware payload (Mirai)", "value": "415cbe12d2879ec18a45bf8b68a76e49101b21526e395918d6c7874e93e7fd6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696412, "uuid": "8063ddf6-7b73-472a-b57a-f0749ab4f20e", "comment": "Malware payload (Mirai)", "value": "92ebdffe3b724b7a055624ba5cf125deabeb4363", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696412, "uuid": "69e4d940-d53b-4e91-aabf-71b97b4228eb", "comment": "Malware payload (Mirai)", "value": "667026d5ec51365afc1b5a14b23efb4030acda3f30b4ce9f7bd76ed57159bc99cedd4eb1a4c7ee0da08fc20b2ac047de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622696412, "uuid": "a5a94fe3-b751-447d-906e-b370ad5ae189", "value": "28C2D0455D4835B3D4E92D3BE2F8828487B78E7C69F9711B352507E5ABE28861F2C306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622696412, "uuid": "5eedc851-564a-4b4c-846d-668d3b81f369", "value": "768:JSKkVoQ9lqq+elDLUjRKocqbbDq6NlNmNv3UZo:cKkVoilq9eZc1rbbmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622696412, "uuid": "a3524053-4b67-4d43-937b-76bce122fe17", "value": 28232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622696412, "uuid": "d22b0deb-a108-49a0-8e4d-d5874a567f34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622696412, "uuid": "61f245ac-574c-40bf-bfe1-750cbf248c4c", "value": "z0r0.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74846e60-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622738020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738020, "uuid": "2721d262-6567-4077-8443-b73bd42a0deb", "comment": "Malware payload (BitRAT)", "value": "e7287f303c0b70b8f23c67c962a84f81", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738020, "uuid": "f2d345f1-db07-4591-9efc-b08d4c1adc26", "comment": "Malware payload (BitRAT)", "value": "417b25bebecf3656ce6da37ed282b5f8c5a092a50097b77a84a312af7ab901e1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738020, "uuid": "d51b9c1a-ad8a-4f2c-b72b-832391f5753e", "comment": "Malware payload (BitRAT)", "value": "cf8c57424c7c126de3e29cfe93ad01ba1739e217", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738020, "uuid": "cf4e1d37-ba1e-47f3-97dd-da2a92661abb", "comment": "Malware payload (BitRAT)", "value": "227bbd5418ffa0c350f04e1b58afb0cf81870fb44bfaad0f2ed23a640d0b0bdd7030e58753eb99855cc01dd3e158ff58", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738020, "uuid": "4af3924a-09d1-4766-8262-dda88fe536c6", "value": "0E66F13B3AC2688CC5A80A75446C58CC72F567473A52CB2E709B139C9F0137FB75E5AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738020, "uuid": "a476ab3d-5258-4167-ab71-8a39d8531e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738020, "uuid": "73a6f8bd-e5f0-4db9-a380-82907c6e694e", "value": "98304:QEHeoJ4BkD7pwwwhfAqVo9Eo7bfkNxU+1Nhga4a/ZSmV:QQeohD7wlhNqa4a/ZSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738020, "uuid": "343d81f2-76f7-4337-92d7-b49bb245cc72", "value": 6759424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738020, "uuid": "6887915a-c2dd-4335-aa07-77fdf030f72c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738020, "uuid": "42819b7d-f0d1-40c0-84ba-241dd7535016", "value": "e7287f303c0b70b8f23c67c962a84f81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507d6989-c48a-11eb-875b-42010a9c0053", "comment": "Malware payload (ImminentRAT)", "timestamp": 1622738389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738389, "uuid": "de647c48-58f1-487c-b5dd-edf75dc0bd5c", "comment": "Malware payload (ImminentRAT)", "value": "38c02aa6d06437949ae91666ffe8cacd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738389, "uuid": "4c33615c-9635-48c1-bc3f-0dca0b38ce92", "comment": "Malware payload (ImminentRAT)", "value": "418b4dcbffc1a5a307147cccf7476293945dd18a12ae9c00ef2b942884a8427a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738389, "uuid": "ca5ce23b-6428-462b-9ad5-28467642ed5e", "comment": "Malware payload (ImminentRAT)", "value": "27b1d793be9ce90002782108ee91651e1ac0621b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738389, "uuid": "283e1ce0-e3ec-451c-9d4c-87b42c5a26dd", "comment": "Malware payload (ImminentRAT)", "value": "5a685e0138f613acaf6b49d4701c2c7120c1bd0ac2075837348843d000b65808fca0a6b02366e0312c80fa364248fee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738389, "uuid": "a325a09d-4c4c-4508-bb1d-64cdc388b6ea", "value": "37F4CF6AF3856BE6C72D1F37C617012993F284077A32F29FBCF509D10A27A155B2E186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738389, "uuid": "0e61b32d-a912-4638-8409-51cf693d9319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738389, "uuid": "00e849c7-9270-4e4f-a5c0-d4c20554bc6d", "value": "12288:NnxzN5hiY+yMUR1yL4jvWgSHiFEVhSFm6JbotrKZmzWBlgqGqpv:NnN+yMUR144jWgSCFEV0rZoHa8qGqpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738389, "uuid": "e2327341-ef27-4b0a-abb0-c446c8be4dc4", "value": 723784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738389, "uuid": "5ed1caf3-8bc9-4ef5-910a-52cfcd3e1b68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738389, "uuid": "b947c9dd-7485-4042-986b-dd48e41ab0cd", "value": "38c02aa6d06437949ae91666ffe8cacd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfe7382-c429-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622696721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696721, "uuid": "c988c31f-9446-437f-af6a-54bf91abfe6d", "comment": "Malware payload", "value": "5f9c35ee1cb193ae428df0c0c2eed640", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696721, "uuid": "c9003177-110f-4e09-a1b2-30865ddeca91", "comment": "Malware payload", "value": "42b463b2463de154a27d55cd2047d0ca3ae5f8eb57f0279cd4afa62830a4c271", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696721, "uuid": "118bbfda-e269-44b5-b58c-38629bdec5af", "comment": "Malware payload", "value": "8909cb51f2c26c1f14a83378cd433012adbef022", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622696721, "uuid": "6b87383b-784f-412a-a882-6d8e0ed5b29f", "comment": "Malware payload", "value": "115b65593c459db4c893fdb7671cc23e81479e93d24a3d729a9e0f847eb632789d7eabffe8bc0efe5cfaf81861084fac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622696721, "uuid": "ad11702d-87b4-4c09-a7e1-fef96f8cb0d8", "value": "F9641287EB36BC1BCB002AF225DB4B9D986D775F41C7E0A5F9C0818F17E21867AD1285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622696721, "uuid": "d12c65ed-d4d6-4e13-9d02-8a225c4e1b75", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622696721, "uuid": "161cfdaa-d4d2-4145-a618-768c56808436", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622696721, "uuid": "16d02398-2a33-4c8c-a3d4-e6c5c30a38c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622696721, "uuid": "76f923dc-67f9-4d15-a691-e5b7d3bf8ade", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7aeb4a-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622714041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714041, "uuid": "af6312b1-3e42-4759-8b82-efe8c7c8b3d0", "comment": "Malware payload (RedLineStealer)", "value": "54aebefddfb4af58caed2c3ac9b4bd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714041, "uuid": "3ab3e627-b9f3-4cc7-a2fb-071f76a055e3", "comment": "Malware payload (RedLineStealer)", "value": "43a38e0f15c22a94dec67acce84a2cbed685b8c58014ee4a432dad8f9e550a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714041, "uuid": "7765c922-d68d-4a7b-a086-ce60c63f56d0", "comment": "Malware payload (RedLineStealer)", "value": "403afb1ba22ae89811bee875a275d6df8fae9ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714041, "uuid": "9dc377e3-7d2f-4235-bb79-196b90d21e08", "comment": "Malware payload (RedLineStealer)", "value": "27ebe216fe8fed04cb43120125793f58a19df91fd7b91f3a576c05d58eb5302af90e60a054d76a61f78f2f321abc7035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714041, "uuid": "dea68636-dfb4-45c9-aaf5-0e7923aaf4db", "value": "C484AE10B7A0C034F5F352B49ABA92F9A53E7DE16B2455CB62D42BEA17346E1EC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714041, "uuid": "843de6b5-3f96-44ca-8716-e11be09b7030", "value": "788842c19811b0f2f6994735b8f363a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714041, "uuid": "e5836c74-9b7b-4088-9bac-54b0b8268919", "value": "6144:NKzOImoWq1jJBKDwDPzsu5UEF5nYnGEzv3nt4HwnjkO:NKzfmt2jJBBDP35UEFZgzv3nt4QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714041, "uuid": "f5467278-2b74-4253-81fe-8cb45ef953be", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714041, "uuid": "1f1657e5-5f90-439b-bfaf-10840aa7f1da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714041, "uuid": "0d5485b2-2462-46f1-bce1-c763bd6e085f", "value": "54aebefddfb4af58caed2c3ac9b4bd4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5cc7c8-c433-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622701283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701283, "uuid": "e8382eb7-d357-4daf-8e34-9f0696cdad84", "comment": "Malware payload", "value": "52a186318d36b73b3ad47940983d5fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701283, "uuid": "8b962d17-78b7-40ca-b3d3-5d4ff17156b7", "comment": "Malware payload", "value": "43c7a6a2753a823e9588d72776b4a660d33b8890414fff82d6741132346d8abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701283, "uuid": "c3cd0b58-0c59-4125-8ab8-75defd602997", "comment": "Malware payload", "value": "9d75ecb6b19f5c641c7ea094459f41bac9dd4721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701283, "uuid": "fcc5e8f8-614f-427f-a201-c800878aa3fa", "comment": "Malware payload", "value": "902040eb7284fdd223ae40e1f9c680aef7d303fc0447ac5ecbf500a89c41f83fa89843301922c5f690448aba14ed2a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701283, "uuid": "48ac83f8-3fb8-46a9-acae-5e474d5f834b", "value": "4606482439EA501AB173EFAA4BE479D6DA6FBE733B06645D1090334A0733981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701283, "uuid": "fb6d6e53-4358-4344-b2a8-569f5ff53889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701283, "uuid": "aff3264b-6b8f-4028-8bc7-731f9691da2a", "value": "24576:ieaJ3IOblBoExF0lh+MA3Ec38vt0gEGfrMo/rBaQeY78STdqqtAZHQbbU9llogP4:iVYOLaY7Et7SoTshY7lhb4fS80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622701283, "uuid": "88d1be6c-75c2-43a5-b53d-273c27edced8", "value": 3857408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622701283, "uuid": "9db6f7ae-9049-438b-a005-8633f32f33ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701283, "uuid": "9fbadd65-7569-45d6-8c1d-27e472b99194", "value": "INFOWE09002A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a152e01-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622757760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757760, "uuid": "07f4c2ea-f3b0-4966-a13d-47f495b907d4", "comment": "Malware payload (RedLineStealer)", "value": "192157321ae17032b5edee8de07e0e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757760, "uuid": "7578ffb9-19af-4118-b87a-65363424db61", "comment": "Malware payload (RedLineStealer)", "value": "445d39df326616cbfd206707370348697ee1ad8ffb5ce1edc330afe9bf49266e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757760, "uuid": "63fba922-a1e4-40e3-9dfd-fbb0b54361d7", "comment": "Malware payload (RedLineStealer)", "value": "9252dbf16148b087129afb62a49dbbac278d19de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757760, "uuid": "d9ae46f2-acd9-4706-a1a1-c1296bb6daaa", "comment": "Malware payload (RedLineStealer)", "value": "f68224658e8e671efa43e058c148adc48fd04e029cc4078c9d1fd95c18bad26a6ab07485a2e4124e19cc0bc23e8c61d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757760, "uuid": "b5e50e00-7d00-4ac6-9348-de9a665c52ab", "value": "F3E370A39172CC96CC64D2BCD064EE3B27687F343842B30B54E5AD67F869B4B0DB4199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757760, "uuid": "7d9875ba-615f-4bbc-8aa5-5935586931dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757760, "uuid": "c242c391-5797-4015-a8a0-37129362bc64", "value": "1536:Ee1mvzKcEsVVVgYPrs0u4YnhQa7TIGwXoHtabpihRHEnLayET7L+A:EP7KcEsVpPI4wJIB4AWRH0Q7L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757760, "uuid": "519b53c1-ee2d-4c7a-b352-a2d5f1c3bf1f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757760, "uuid": "01e840a2-854d-43de-83e1-65ad0be5b39c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757760, "uuid": "f1445756-a77d-4467-811b-7b8f033a1354", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.6900.14762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8521853f-c439-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622703689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703689, "uuid": "615c2490-4d4b-417a-9702-ac02d9a1f876", "comment": "Malware payload", "value": "d3d6614282509be0a15a5bc01ab8b5ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703689, "uuid": "57985d05-7f68-4d4f-8f7c-0fe71332daa5", "comment": "Malware payload", "value": "459e454e45f08c917dec9342b7c6a586dbe9edfa4bb942dcd4766ecb446fbd1a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703689, "uuid": "b89058e5-2136-4283-86d5-1ab406ac4019", "comment": "Malware payload", "value": "a3bed9ce0585954fc02e6f20ed68ef6800fce9cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703689, "uuid": "af541e54-4d20-41ca-8291-53aa46575ae2", "comment": "Malware payload", "value": "c61e421bb3076df7ca4265ee8b191b87d94448779acf0a1a8b1c417730f41a31905714ca7c265efc2b9102dce180c216", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703689, "uuid": "29985c69-f3b5-459f-a191-689c12644724", "value": "0DD31222D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703689, "uuid": "ee11ec2d-75ca-4f7d-ac67-74bcb1c89673", "value": "3072:siMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:iYFJvwe1gKCYVl2szN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703689, "uuid": "4d8ef87e-ae96-477d-8251-36dc55ee8ed6", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703689, "uuid": "27b1e214-e561-4533-b748-15a85788428f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703689, "uuid": "9df2ac93-de54-4201-9f5d-b7dd372968cb", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f4b3a9-c456-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622716333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716333, "uuid": "2fd99eb1-ddf3-4cc5-8544-b3384b24ac62", "comment": "Malware payload", "value": "5068c8b4ce1d2505409a6db2a0116465", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716333, "uuid": "0df090b9-a031-4974-a3b8-5e097f892dd7", "comment": "Malware payload", "value": "477109295e2a22b2195baccbaff0ac2601e0fa067dbb4489c40631a851f96697", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716333, "uuid": "bac47f14-8400-45db-b104-b93005d96001", "comment": "Malware payload", "value": "4145a2d305ce669430d143ebe78d527905643d28", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716333, "uuid": "4478f367-1802-44d2-b94e-3eb13df23179", "comment": "Malware payload", "value": "5f85990873ecc7631cc8ad172d88b8ded263cc5ac5c31b5493e5e16395fea0eb7756bf9b0be3c5f625bc86b93eea079e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716333, "uuid": "7646b286-8d72-4888-9066-81b96ec9bdc8", "value": "1ED42384EC9994FAE0EB57EAFE0F385827923BB70848D693353A6F714514139C16FA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716333, "uuid": "c0621551-e607-4741-988a-8bcdca9b33db", "value": "12288:VEHALHtDOokLZPfzNm9rDFZNcG4IqMCU7TyWkV5TwZz25ePPtvg/zbvYC6lki/1p:eUtyoaZHE9rpZV4mCOUUseHWwx2wr/Zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716333, "uuid": "0f8e926f-2238-4383-8a55-e68978972e4b", "value": 620995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716333, "uuid": "7e70bdc5-58a2-4e1f-8928-3b2446af2145", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716333, "uuid": "547729be-bc7b-4165-adbc-4631c28a0c58", "value": "477109295e2a22b2195baccbaff0ac2601e0fa067dbb4489c40631a851f96697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db65380-c44a-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1622710870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710870, "uuid": "e6f5288e-9dff-49de-8322-87d8432b049e", "comment": "Malware payload (TrickBot)", "value": "677e96c969263b6ab69587e55731cffa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710870, "uuid": "0f505b2b-629a-4392-97da-53c40102dfb3", "comment": "Malware payload (TrickBot)", "value": "4835f6d3b8e1414e0176a9142c154d8b67f3cf0183ce9b230cb240ba110d8140", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710870, "uuid": "fe14e27f-29d7-4f54-9e32-cb78939b6c9f", "comment": "Malware payload (TrickBot)", "value": "21c535c0bbb4671dd6b07d20c7187438e2d09cbb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710870, "uuid": "be0647be-3c88-4545-bc4b-a754816355ae", "comment": "Malware payload (TrickBot)", "value": "8d2e33011e6b4f70f5cf6704b149494de1d3dfcfead66a75d37fb3041f8cd481539aab7c34dcc3fe14b324ce807ae74a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710870, "uuid": "71f1665a-3374-48df-bf30-7cd72bce79c7", "value": "6A92BF0EF10538ADD2A7117CA45615F9F54C3142E3A6651A7CC5778E0E886C317B8E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710870, "uuid": "08b38423-b354-4236-9b64-6c2e355e83f0", "value": "384:f0ynju7aJ+QkT5lYdQ6+b1XBRQiujrq2yVvGnZZOPz:9FJvkTUdQ607ADyVvU38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710870, "uuid": "70216485-a1cc-43fa-9e57-2c0a12d2a56e", "value": 20414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710870, "uuid": "a8576f94-6743-41f9-83c0-da91d5fbb115", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710870, "uuid": "9ea4bbb0-6aa6-40f7-82b6-462ed310e07c", "value": "PREMIUM FINANCE AGREEMENT.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d4087a-c42d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622698559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698559, "uuid": "39f536a2-8c98-449c-a48f-f4e9e9e0ab03", "comment": "Malware payload (AgentTesla)", "value": "cde20bcad2234a10b927b2e36137461c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698559, "uuid": "17cf7c90-3258-4019-9c3a-7dea667f619d", "comment": "Malware payload (AgentTesla)", "value": "49a523739a017c04654e91e847334fdd612c5503c412af1021c3ce754865c8c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698559, "uuid": "71571596-f71a-495c-81f6-047854ddb477", "comment": "Malware payload (AgentTesla)", "value": "82ba400302f0dac2060699638e317eeafedb0a53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698559, "uuid": "b2ca2016-bed7-442c-a241-cdfea478bbe5", "comment": "Malware payload (AgentTesla)", "value": "48552cb04a4efbe3e4432fcced985a2fba72dc6f0e049d606b12ca1125a3798800bd4b0a874bf39b20fc569f4ac83f3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698559, "uuid": "2004499f-6d33-4ba9-90d2-404050605b63", "value": "3C85E692B9558DA4E25A9B738DCF985C43BC42F5D6012F3A4F70B7983E2279385C884F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698559, "uuid": "300cb16d-3787-478a-95dd-187e5b13efe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698559, "uuid": "ba593b23-d217-41e0-84d7-e50b6f45c485", "value": "24576:1q3Zx9oKMvnImEDbpvj2CbO40UYTESPGveRLb7UIvLeV:1q3XMv87qhLCeNUIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622698559, "uuid": "0b1b5b21-0ba0-422b-83f5-bc9b8fa11d57", "value": 1724928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622698559, "uuid": "55be71f0-f647-4db0-b310-b23e125790b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698559, "uuid": "11799f8f-7724-4dbc-b958-fa7e94fc931f", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.2603.11174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2474c31d-c448-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1622709969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709969, "uuid": "fe9e1d66-0bf0-4c54-bee9-07124843a557", "comment": "Malware payload (Vjw0rm)", "value": "575eb4b9c7430dece77eb2d8ed3b5997", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709969, "uuid": "ef1c5fc0-5572-476e-b368-7a32b6c8c726", "comment": "Malware payload (Vjw0rm)", "value": "4a157e8aa3f27b82f9a55d21989604a9570c9d0a6eb3a36ce8e5866513abcc73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709969, "uuid": "0076b47e-6fcd-40cb-92ae-8ad60caa66d0", "comment": "Malware payload (Vjw0rm)", "value": "22ac1f40d7611d4f72507a46a4912935a5de79c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709969, "uuid": "090e73e1-7273-403b-bf17-b49f61050252", "comment": "Malware payload (Vjw0rm)", "value": "f03e6804772e69894d86fbb9c0f3b32cbe7ec7a4377d395c84b5772f4b0532c9f108427f8abc99d8aef88ba9c4779bcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709969, "uuid": "83bc078e-805c-48b6-b32e-51891a8d9b7c", "value": "83B236387A16A97E7256F0DF8C0F02DDD2022E8A3D5690956A7EE60F13753B90E72770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709969, "uuid": "aaf1f751-a165-419c-8282-082967ed08df", "value": "96:TRARHRjRmVRaER/R4RORFl+R1VRARIRARHRtRaR8NRRRol6URKRaRARWRFRqRJ9r:T7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709969, "uuid": "67cc2298-5385-40eb-8bd5-80f1d16b393f", "value": 25377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709969, "uuid": "681434db-4f8c-4c72-bb61-3de9ee1bd831", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709969, "uuid": "3ceaafeb-558a-4687-81a6-fa22ca2c7211", "value": "PaymentConfirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d59c85-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622703178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703178, "uuid": "6f5f1c8c-aebe-4925-8c90-29fddb0e5966", "comment": "Malware payload (Loki)", "value": "53a00dd8b66d50b5a0386661cf94cdc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703178, "uuid": "89183ccb-1171-4a03-975e-5714305a91e5", "comment": "Malware payload (Loki)", "value": "4afef235bc6027a2319e50fb91190cc64db8b461095626f1bf5ecdf218d5836a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703178, "uuid": "e0e1f4ae-35f7-44c6-9c91-52d9a7dae82f", "comment": "Malware payload (Loki)", "value": "977e65b6650ade293a18318638893776c8fd6778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703178, "uuid": "dca8a98d-18ab-4b9c-b502-7a5a7915e20d", "comment": "Malware payload (Loki)", "value": "e4c90f1d9f5e27ff89ebfd6e34177033c9c647001919a0edb2578d21281ac5092779e9fbaa7f06a7cdd368935c34d511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703178, "uuid": "7d5bf7af-3c58-4e10-ba57-8ddc80bc37f7", "value": "4D056CF8F19898B1C54DC771C7819CBDEB220DFE6A03496D06B5FA8D2A3378A9F48445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703178, "uuid": "7ba61db0-c424-4ac4-af49-d4de52b56c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703178, "uuid": "139e5636-0dc5-4802-96ce-e250955ae96e", "value": "12288:zB4Y4iVvTExdx7vd9jSM010r+TvQmQYnxn0sBqqZFr4Kg6iq+q52pzs8JtZwmpm:qil10r+TvQ39aZtlj8Z/pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703178, "uuid": "0d325532-9dda-4c81-9c00-cb95cf4ca34d", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703178, "uuid": "aef776f7-f17b-4db6-b2ee-98696c7677ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703178, "uuid": "5bf4dac4-0bbc-4f01-a774-60a23f13d0e4", "value": "819784_ 820391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd29d11-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713660, "uuid": "98a9f294-4065-4383-b130-3aeba5910a61", "comment": "Malware payload (AgentTesla)", "value": "d1268ce90596acbfae9169722fe16d85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713660, "uuid": "5c83817b-4405-406c-b29d-4c58f820640f", "comment": "Malware payload (AgentTesla)", "value": "4babd6fa58cd93ab9f6c80717a8dc1330443f437bce73e4f9299ff1d30b431dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713660, "uuid": "81ae8a91-5189-4447-a0e8-3d69ba94c4b7", "comment": "Malware payload (AgentTesla)", "value": "1eeebb2585df3a85d622834185cc8d4e7eddea01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713660, "uuid": "c339ae26-ddff-4944-8e8a-d304309fdd5d", "comment": "Malware payload (AgentTesla)", "value": "7ec17a9487cb73863f23c5e5e2b562b4922bce6f6eb5a635d9fa65dfa817358a5629cedf011d50a1864802c962c4f874", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713660, "uuid": "563ec034-0fbd-4096-91e1-72c830e7721f", "value": "82C4E012F294CB8AF0186F775B24D5010B753C53B829C63D686A36F748B2BA3165FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713660, "uuid": "2b1f42f5-106d-4c02-afef-fdb29aee1581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713660, "uuid": "fcbfdc2d-e2e7-445a-a387-ecd871a600e4", "value": "12288:XF5mMCh5PavJD5myoRv1PvTd1zRE/Fge:Ofh5PaBDgHRv1HHz2/Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713660, "uuid": "c06e61ce-86cc-4090-b0ee-6b33a5f49661", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713660, "uuid": "a32c1b24-5fd4-48a4-8649-e9e8fa17362a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713660, "uuid": "88ad6419-13e8-4058-90be-35d00e8834ac", "value": "SecuriteInfo.com.Trojan.PackedNET.799.27928.32321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b802e462-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699479, "uuid": "7270bf15-0071-4171-ad95-8a825045eee5", "comment": "Malware payload (AgentTesla)", "value": "23075d8181f6383fca1884d65dac0cfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699479, "uuid": "525a0c8b-777e-4f45-9e36-3235c0508360", "comment": "Malware payload (AgentTesla)", "value": "4cf2cd795a677e2fe744c4bad3d8ba2450e84cfeefae6550c677107ba633459c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699479, "uuid": "b35846f3-cc9a-41be-ac1b-54de0f7f18c9", "comment": "Malware payload (AgentTesla)", "value": "cb2408a7469499c3fc60c7c4a2d157c21a887f3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699479, "uuid": "07e31d6e-f37f-4161-8a3a-8c845eea7342", "comment": "Malware payload (AgentTesla)", "value": "3ad7cea55d563c879c182b1c2310dd935de862b22dbd9a75e2df3ae8323004661b3275704648d89be77eb3e95c4e0f95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699479, "uuid": "7c485574-542d-4a32-a472-74f3d753ad64", "value": "F5E41249A7E8DB26C97E13FE7D6022084374D9294562EB0F0CC97EEC3E61786156236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699479, "uuid": "61ff7452-05ce-4cd0-a8ff-0c3e8f0fc073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699479, "uuid": "62827de1-de37-4e5b-9708-41714914afd2", "value": "12288:GHbY2iNowxEjfgnQrEOkMJN3VwC4g/CW8z6tjbLUAP20D8U6sf36o1PQZp:GHbY1PxEjfHrYM2Cj/CWhHl20QU6sf3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699479, "uuid": "68f64295-b4c6-4423-9d16-23fa08d7f65c", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699479, "uuid": "793f3051-aabb-410c-b0b6-549e72f5889f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699479, "uuid": "9f3ef2fa-778a-4e95-84e3-81aa0a9e9a9b", "value": "3034501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da0f498-c48d-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622739593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739593, "uuid": "973583a9-bcab-408f-a98e-3e9c8d3e46e9", "comment": "Malware payload (Adwind)", "value": "075292834bd77509f595943f8fc57371", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739593, "uuid": "21afd6f9-35c1-48ef-9c60-b542527a2be8", "comment": "Malware payload (Adwind)", "value": "4d5053a99ab1c3b792a0d11ef7e0e0d337290a9efe52b7a46c26b7d269a0fd14", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739593, "uuid": "b0eba787-0f96-442e-8328-6350f6bba57f", "comment": "Malware payload (Adwind)", "value": "fe0a0dd558816bd70a8cb8722bf4da67eddbed24", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739593, "uuid": "17e8afe9-3068-4d7d-b37a-c229d1efb865", "comment": "Malware payload (Adwind)", "value": "d6f758c4a7c4da90800ed7b62c566f4f8a430dcdeb9719d0ed4d6765ec46f38d43ea91ec6173faad6db2cc14669c597b", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739593, "uuid": "d3dee093-fae9-4ce0-b21f-e2d4f8429daa", "value": "596423F570B4EAA8F903C633E12477E4093CBFA7022A1B9B652918045607C7BB76DDD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739593, "uuid": "4202aaf0-a6a6-4d14-9282-610588540d3c", "value": "6144:XLarMSxcnblEbiEvy2KZb7Y6VQ16gh2jLlkJypF3twbzm9yMQy90P3P7a:mrMSxcCN8QzwJkUzy2hQI0P/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622739593, "uuid": "d1fd3394-0aa1-471c-8fa7-13680da884a5", "value": 310070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622739593, "uuid": "57b79ba8-e96e-4207-ad49-ba524b1a32fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739593, "uuid": "cad08305-c311-4539-ad10-4094c3ce7973", "value": "HqQ94pE3r9K1zkT1QgwbvfjE2yqC9Z1SaUjn.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58773f98-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622757730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757730, "uuid": "49f01246-a431-496e-83f4-3ba358e9c61e", "comment": "Malware payload (RedLineStealer)", "value": "f487cf722746e92a8a38036e09acbe83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757730, "uuid": "d43afadb-75ed-4459-b48f-288bf8f33dfa", "comment": "Malware payload (RedLineStealer)", "value": "4e4d1f64ee342ea468d20fa61ce6f7f9061d12ef01e43e9669e7085fd80181fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757730, "uuid": "da7dab3b-e363-4cd3-829d-e746dfd99df1", "comment": "Malware payload (RedLineStealer)", "value": "422762830e142a22d12e355cbc43ca6787179fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757730, "uuid": "de756909-c0b8-479a-ad74-40e7eb756265", "comment": "Malware payload (RedLineStealer)", "value": "a6b132226f2f4898b11aaf52135821d5198073d975732acd4d17519ebf40fe69817fc807422cb86edefc17eaf1bd6f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757730, "uuid": "10d9e6cf-eab2-4ffc-b479-135138748f6d", "value": "5A65CF48AB6F82C1E7790371C3AB255F4F646E86F2E2D369298436442C41FC6EF48677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757730, "uuid": "06e6746c-691c-432d-85f7-d5e09dc3e11f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757730, "uuid": "835279ac-e4a1-4d9e-83b3-866aeac3834a", "value": "24576:7HtYVSy/oBweda8fngBbbdPoWpd352U3LbwmkZ4XlorR:ZnBA8fqJoC35J3Q5SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757730, "uuid": "ce11a17e-9622-42a0-b4da-b2a2129b92a9", "value": 1470072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757730, "uuid": "a8c3f724-21c4-4450-8e1d-1760f16014fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757730, "uuid": "5f579b97-d746-4e72-af33-df11f94735d0", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.20157.6744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92437d4-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622714191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714191, "uuid": "183dd573-a496-45b2-bc23-c94635fe8312", "comment": "Malware payload (AgentTesla)", "value": "bf8f25c6146c33c0f6fc586170f37fce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714191, "uuid": "5708c97f-e296-4295-909c-30e90133278f", "comment": "Malware payload (AgentTesla)", "value": "4e8f287e8fb346d13b934ead4a1ebd812cf9b8f139b16ccb441294e5d50a8397", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714191, "uuid": "afcd7ac9-a627-4d5b-8a2e-431e1826e6e9", "comment": "Malware payload (AgentTesla)", "value": "7b7b5b09f6757ef1309417d9569aa7c370a888fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714191, "uuid": "3ccb33e4-c56c-41bf-9737-cdb8f0780b67", "comment": "Malware payload (AgentTesla)", "value": "70cf14fb6be816ecc4a94ed2b5011f66bbfdac0833c342499d24d95dd6945061492d0c6d6afc810f28d947009000c01b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714191, "uuid": "bf9e3d0f-3506-438a-ae5f-1cd4326067d6", "value": "70257CF4F19898B1C54EC772C6919CBDEB220EFD5243092C01B9FE8E2A3379A9F59445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714191, "uuid": "407b7374-d516-40b0-806b-5b659e646163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714191, "uuid": "2092c868-f4bb-4736-9135-90d6d2c7fb67", "value": "12288:zpVdvTGA2auzsRNWAg+egHYQTQfEtanUYSp9Gi/Owv5iyyLHiEAmD:HIzsPygHjsuaIp9GiGAei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714191, "uuid": "858651a3-d1f3-4b0b-b0d6-c6ff9fa6348c", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714191, "uuid": "3b034563-ef6c-4c3c-bb85-97e369ce0ad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714191, "uuid": "a544b3aa-7339-4bce-ad24-f839ca3766b6", "value": "bf8f25c6146c33c0f6fc586170f37fce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee8501d-c470-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622727408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727408, "uuid": "74e58c3e-8ced-470d-b406-f185ba424640", "comment": "Malware payload (AgentTesla)", "value": "ad598a6fcd86d83d007d08a6953e08c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727408, "uuid": "752af653-9a16-4cc4-b588-39474c3e527f", "comment": "Malware payload (AgentTesla)", "value": "4ee7793ced917a0ae8b3928b869b23d9165376e03d818cfd9a0e5e9e82d37e45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727408, "uuid": "56d6468a-92a2-4527-a168-db190b34ff2b", "comment": "Malware payload (AgentTesla)", "value": "e66e3588dfb0c7270d4411a816acce582df4f98e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727408, "uuid": "88315f0d-b1c7-480b-b432-01d2073c8a18", "comment": "Malware payload (AgentTesla)", "value": "6390ff951b7d1ed1daf4d42d3c77b916634f8dbe4a09f96bcd6be20655dd0422c3d2f6c4cbe83a44e8ab65dc02886b66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727408, "uuid": "5c4b4b1b-ec66-42f0-b54c-068dc38c5f00", "value": "A224F15A38D6916BC0C17BF419B2AABBA7377D910224405BEFF83F252972163DCC11AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727408, "uuid": "557896ed-9d6f-4737-b0ef-3e628fc1e518", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727408, "uuid": "58e070b4-7b2d-45b4-acd4-17ef568e5bd0", "value": "6144:3Qq8EVDJsp2nJdbZdE3UVC2BWelh8pqdHp:6Ii2EmCwWePk+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727408, "uuid": "aeedee49-0fe7-4555-bf21-5cc1cc71a65c", "value": 211999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727408, "uuid": "974552a3-f266-4d63-96c9-98c78e074488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727408, "uuid": "baaf9bc9-a33d-4e30-a0b5-52c6d0248d2f", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55fa104-c47c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732519, "uuid": "8d13476c-51a5-431d-9d3d-c3a9afaa6af0", "comment": "Malware payload (AgentTesla)", "value": "4ce46bf0d5fdcc21c2699bf174bc5f9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732519, "uuid": "9f58f4b3-9c5e-45a1-a95c-93f2880199d3", "comment": "Malware payload (AgentTesla)", "value": "4ff2f77293b6804df81124399a416b304d7e778e5c6157bf1bd90f6e011f06d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732519, "uuid": "005b1844-0fc9-4dd4-b8f3-6706500bd0ef", "comment": "Malware payload (AgentTesla)", "value": "dc721e6ca52b4dbf1c92a7ff5cabbf4831039fb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732519, "uuid": "cec58c22-7f6d-4e9d-b36a-96493b7e8ea4", "comment": "Malware payload (AgentTesla)", "value": "d4cfb182583849f9f53b80693f84313df3a8304da750e0a2f8c01c6d8cb30ce40277d5a751ced6ed635926ad3da3d772", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732519, "uuid": "e8588c2c-043e-494d-92d6-b7379a4f3064", "value": "6484DF62070EC9DCF25A4638482C9B6309563E660DD65DCD8B9DBEF03CB19DE528E07E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732519, "uuid": "a5491d3d-b616-4610-9d9c-acfea36b2f86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732519, "uuid": "dc4639f6-d4cb-4cf4-a5b0-154d75adf60b", "value": "6144:37PCv1T0HiLGSUKAdj5vf6q8V3Zbqh4POdEEe2:jCvB0HiJUKj3Zbq/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732519, "uuid": "79aa9228-5ad5-4638-bcd5-e459c05086a1", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732519, "uuid": "5d697f27-5f23-4eaa-aef7-56b0eb419a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732519, "uuid": "17ed7185-15b7-417e-bf05-ff190afaa27c", "value": "RFL_058_13_72_06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8593624-c47c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732604, "uuid": "831a59af-ed61-4741-b1f5-e1aa911fd767", "comment": "Malware payload (AgentTesla)", "value": "84a333ace4c067ab138d5739272f5d57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732604, "uuid": "d83f9799-c997-4279-a45a-5f2a3c3d2ce1", "comment": "Malware payload (AgentTesla)", "value": "51373314cf58f3170355320bb4a3b61b92c87ec695bb1b11811bdd3db76684f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732604, "uuid": "c43bb0d9-0846-448d-a644-e28e363e08d2", "comment": "Malware payload (AgentTesla)", "value": "64215af1ce53da2330074c10ba8a651a491fa797", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732604, "uuid": "a6c52dcc-0c38-4db6-8134-33cfe4b80710", "comment": "Malware payload (AgentTesla)", "value": "9040c2aaeb2bdd774afe724d7070db2739def43acba8c38ea0f8622c0b2abaa302e6335a3508435919f655c25d532817", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732604, "uuid": "b01f87ee-8bd0-4ec6-9bfe-9605a149326d", "value": "959423CA2DE10B6354740F7CA7872E7F9D8C25E1B528625023DE266FC56BD7033D851A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732604, "uuid": "84fca46a-5979-489f-a504-2f5d3704c7dd", "value": "6144:jWLCpo62b26egfGT9s2Xu5+nwnmASLckpG4Mb9eueQZz3dD5YMqWbG3kSpGoxoY/:jWRN2dgOTS2XHUsLcksDDYXWbsZxo1Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732604, "uuid": "c9926792-a634-46d5-8cf3-aefa42bd5836", "value": 431398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732604, "uuid": "5d80acda-6a2a-469b-8d04-a4d2ab01c341", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732604, "uuid": "9818ca28-b736-4237-8445-4a74b0021fd0", "value": "SOA.rar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407ee128-c47c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732350, "uuid": "62e581de-5803-4aa8-934c-58040aea96b3", "comment": "Malware payload (AgentTesla)", "value": "f619da2a8c1b02b98971d5fba57731a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732350, "uuid": "84a4fc2e-7f78-43c9-b150-600597e60918", "comment": "Malware payload (AgentTesla)", "value": "5226a59ba6ff14a595b8baf29153e57d158d2dac8af801590cfc3a7de98e6c64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732350, "uuid": "eefdea41-2c51-4bc4-a736-ddc2e493644c", "comment": "Malware payload (AgentTesla)", "value": "b5851c2cffc80aa429501fae20b218f113d612c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732350, "uuid": "dbc7c543-8e43-4538-a47c-06417e7dfd4a", "comment": "Malware payload (AgentTesla)", "value": "168ea13f48987f2fcb9784edf2137043a0e09d25365ccb39a9ea57ce4b7d62f097ba14c5c44d454c9079e017bf172b13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732350, "uuid": "4449228f-6ab7-43ef-b484-1b023803ebca", "value": "00A423BAE906BF7863FD4034DECC2ED88BD4E58D0973FE2DC5D4986456A1A18892C1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732350, "uuid": "ffe67395-0d4f-42e5-bc7a-e767f30ec01c", "value": "12288:g3UQRETPzreRZimWQZmUeSf+OXCYCBXr8JO/m1hpfYNk5iIsBAK:aUQ6TMUU3j59cXYJO/ChlYq5iDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732350, "uuid": "902f894a-0eca-4486-bd4d-2e2aa0cf2c2a", "value": 484727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732350, "uuid": "a387cbe2-5244-4726-b0f8-310536c84f6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732350, "uuid": "2c51a04f-478c-46ec-ba9c-fbe51c103d73", "value": "SOA MAY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3ff641-c48d-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1622739563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739563, "uuid": "7de743a7-356c-45d2-a359-574c646ccc20", "comment": "Malware payload (Vjw0rm)", "value": "d4de5dc8ff47ccb10f1465c056da29b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739563, "uuid": "1a21995f-edea-45a2-b397-077cd9fce0b1", "comment": "Malware payload (Vjw0rm)", "value": "5491810d64aecff4eb29aa664014704c1cf3687868629ad9156bed5923d5e358", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739563, "uuid": "5fa1c6c0-9cce-4be6-8a57-67e82dfbb29a", "comment": "Malware payload (Vjw0rm)", "value": "df833e94a7e8613fbbce2b0bb21a0a0176a72371", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739563, "uuid": "4794496c-f799-419e-8ee7-a9ab2c52779e", "comment": "Malware payload (Vjw0rm)", "value": "5290cb84b80dd201621b9d0b0984bb803db1df3408f5b19fd51a26b3319d4975415ad5703d01940eb2ed4851bdd2a7ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739563, "uuid": "965bb5de-c3af-4c99-8e52-9c87fa188059", "value": "6081209C284BC63C53D27B8A802ED148CDF548B47E28D2B5148CDAC5360ED7987B59BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739563, "uuid": "d47129f9-ac61-4924-8464-44097262b151", "value": "96:SABNo5DRk2c24ZRMHXE6/BItr6+Ys+fJ8zDdQqR7bJyKhQPfOS4UK:zSa2c24ZRMlBIJ5Ys+fJ8ffRfSup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622739563, "uuid": "53c306de-fcb6-4a3f-974a-dbe512e0efc6", "value": 3882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622739563, "uuid": "fee60ed5-3874-4f89-8bfd-bf3ac1b40044", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739563, "uuid": "65f162a3-fdb1-426e-90b1-59f15e846502", "value": "D939065332_Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a84c27-c4bc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622759826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759826, "uuid": "2835a640-d26f-4f48-9d62-dcbb42b06e4f", "comment": "Malware payload", "value": "84db12f0d2cc48188a1d6dbbd550f41b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759826, "uuid": "68bda504-01d7-42d5-b230-2f6687900e58", "comment": "Malware payload", "value": "54da53a5a656f79c956dad3c5a197861caa543d76bb08cfc9989a4d49c726185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759826, "uuid": "5455530e-af68-4a76-9c6f-31c1797ef953", "comment": "Malware payload", "value": "fa39ccec62da68f917a4142b3133dfb448aef5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622759826, "uuid": "6bd93ba1-bfdf-4831-be18-ece1040a6067", "comment": "Malware payload", "value": "47f30bbea646b7336d1d10e22ff20f8a5cf7260edcab1d7cb0caed7d1fe98d2c66365feceb12ef1e98f1da88bb6579ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759826, "uuid": "a18865e5-e5e5-4279-95e3-e2f0e68067bd", "value": "EF255AF8B1A414A7C11DC771DA80ADE8976198FD6703C61C2D94FDCD2F333DA8A6A492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759826, "uuid": "dcb5f166-8127-4f5e-9646-6acd1d784bfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759826, "uuid": "e524c444-ed8c-477d-a079-3b472fb65ef6", "value": "12288:T/4/gFMAh6fqTvT6njU4v33XQVohZ8bTz2h90+nb6lWJp1XZ7:T/4/gFMAh6hjF3nQVohCz2h978WjdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622759826, "uuid": "803b2932-315a-47f4-b5e3-ac149c92bc91", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622759826, "uuid": "4ea89d85-f38e-4255-b6a7-5cc076045172", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622759826, "uuid": "fe19b181-7132-4e58-98c2-66f71b03bdeb", "value": "FUND DOCPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1ffcc5-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622734245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734245, "uuid": "cf384e42-b25b-4569-902f-e42ea53a3c8f", "comment": "Malware payload (Quakbot)", "value": "50fe611568c162c22b9f090ce7ca57f7", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734245, "uuid": "907a6c31-a1a3-4ad8-93b2-52caee31502b", "comment": "Malware payload (Quakbot)", "value": "5655a3980b2a78f802e41cfbcd41d0b608b51c4ac165c590911bd835d6469159", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734245, "uuid": "4b9e906a-0c98-43a1-ac5a-16faecbf357a", "comment": "Malware payload (Quakbot)", "value": "edd55574e8e5262f91104f59c21cdcde7e410a81", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734245, "uuid": "0c2cc713-d9b4-4292-b559-5a2cb361507e", "comment": "Malware payload (Quakbot)", "value": "6a00cbebd5408c3586440450f8c20bf0a0f6af5857ce509e76e9f4706e213f1ba074fd8a542300209f0e98b2a95e035b", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734245, "uuid": "04bbaad6-203a-48d9-85d9-1c07c4cad047", "value": "4F74126FE7456CF8C339883ED24495E08256F1E14097F22E02CC7518AB532EBA79E1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734245, "uuid": "eeabfb69-835f-4e53-915f-dd0c7b2a6265", "value": "6144:ICRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNor:ICRMmEv2Bc/nvm8IKABfsYOmauF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734245, "uuid": "b0c47188-1edc-46e2-a0d0-371459076332", "value": 356027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734245, "uuid": "10c16b28-a665-45b2-9381-97d68ad7bd4d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734245, "uuid": "fb4e9748-5e0e-4246-ab04-f2eb3eb82546", "value": "DEBT_06032021_1307872303.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ba7372-c43f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622706300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706300, "uuid": "49568261-fd57-4ca3-9484-fb3aff30e2fd", "comment": "Malware payload (Loki)", "value": "4f4246a4ef74d7539bc6dccaefd4f89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706300, "uuid": "830bd677-5447-4faa-a019-4442314dae33", "comment": "Malware payload (Loki)", "value": "5689e6baf4a5e10b19eb7dc78f65f421e964d49548fdcc6a7751acae7c14ddda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706300, "uuid": "433878a1-762d-475a-b722-6b5503109a67", "comment": "Malware payload (Loki)", "value": "a782ed308dce106c10c5b97a62dc88fe93970d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706300, "uuid": "011cdbcd-3f0d-4f8a-932a-359aec3c12b0", "comment": "Malware payload (Loki)", "value": "08eef1a812c1788cffd374fbb91521e80c54284619366c6117afd8b3e629bbd42162e0c0ee6c1a5dcf5bc049b9461adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706300, "uuid": "9371c485-31c9-4dcc-bc79-f99c168c54d1", "value": "3065C692B7998F38E28D8A734EDF581C4EBC81F516016F794FB376482F12356C53898A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706300, "uuid": "5bb88207-9018-4766-85e9-ddc5fbe6e819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706300, "uuid": "cbf98245-d0f5-48c7-a575-3d25e1ad3f41", "value": "24576:14QbjBsU5EHLFL3TDTECb58GAMF0hk8kyVkr4:qKjBmdLtDb0Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622706300, "uuid": "50b35daa-a898-4fff-9f1c-e6a3ecb6ac6b", "value": 1537536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622706300, "uuid": "ba53c9ae-eff6-4615-9878-42a84509ffe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706300, "uuid": "531de8bb-780a-4306-b287-b8f19a92dbaa", "value": "SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbc55d8-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757764, "uuid": "a580f560-9578-47ba-93a0-fb8bc4b8769a", "comment": "Malware payload", "value": "2448271d92d345830b83916bd3e2ebf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757764, "uuid": "ecb2ba65-1298-44bf-b721-e43472b065f4", "comment": "Malware payload", "value": "577337dc518c70a401a2c6d2f094722b501d04dfc8dc3ec9a2a5f675e769abaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757764, "uuid": "fa70a0b8-5ed0-4ce1-b304-c441c6064e9d", "comment": "Malware payload", "value": "32965da092bb4ebdf6a1475e5344610318b3baf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757764, "uuid": "cf119b8c-606b-49c4-818a-6d8fdaa40058", "comment": "Malware payload", "value": "0b0f4ad8ed50cda0790e7de2d00eef443ae0dd9d1fffe7f076d0d4af7e8a6503f58faaed50bf5e56e45b3b28d729c2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757764, "uuid": "ae65fda2-7c18-45c8-b462-2183da1051a9", "value": "C6B37C38935D9736DBFF0BBD14A3536007B0C7A16B23EB1E1E90A0E94E27B895A11357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757764, "uuid": "8b406cf0-41a5-47d6-95a7-c4ba50f51109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757764, "uuid": "973a2f01-306e-4ddf-b07c-34b3a4cbfc7f", "value": "1536:w3s5LsrMKi/IXkzgWUT3pZVjLn89ffznL79NmxsA99XjrbCzQ:w3s5LsQKiUkTUT5DCfLn9Nmd9LCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757764, "uuid": "a45f398c-61d4-45dc-a8f3-cb70e6173566", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757764, "uuid": "9d39da90-94a4-4208-8217-0fe5ea9971ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757764, "uuid": "46b6b367-0989-414a-b8f2-eae946a6f59a", "value": "SecuriteInfo.com.Variant.Adware.Bulz.5473.2506.15667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d64d1aa-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757738, "uuid": "d775bb82-3ccd-4545-86ee-409be9f034ff", "comment": "Malware payload", "value": "37d1fd356c6fedea253890f93f50bd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757738, "uuid": "59871959-2ef6-4e3c-84cc-5ba4a2767865", "comment": "Malware payload", "value": "57f9ac436d04ea3c02d410f7c2bc213d51e0c9b562b2ae186b77b4a40ed71515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757738, "uuid": "9c01fab6-342a-48b9-a37b-de0d4e45c61a", "comment": "Malware payload", "value": "cc87d0c421cf25b459c5ac0f21ad2a1b2e333d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757738, "uuid": "835022ec-a9d4-4315-a0ff-2533e1ad023d", "comment": "Malware payload", "value": "02c9c22037bf96444cdee99153ba0e826161beb6e756fc6a13d686672b4bee43bfbe32186f01294ba0959c157cbe37bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757738, "uuid": "7abec3e5-1464-4910-a9ce-46666dace478", "value": "B4E3383C93AD8F66EFAF17F854912210477386336613EBBA2EC0A6D95F1376A41112D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757738, "uuid": "63010f27-636e-4aec-93cd-51fa50664a8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757738, "uuid": "89a98da4-a22b-430f-a2b7-0c67edae4db2", "value": "3072:OgiR0wmLsQKiUkTUT5DCfFEU2QGZbsjhGJRmQgIGMY:OmLsQKEsAITbW5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757738, "uuid": "204c8e2f-b757-4dd8-8c56-c2d8777b4af4", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757738, "uuid": "abaee060-d1db-408e-8dd8-2164433c7710", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757738, "uuid": "88aa742d-a9df-4a2d-b934-c74f89d6dc39", "value": "SecuriteInfo.com.Variant.Bulz.434147.23063.14753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcd60de-c425-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622694925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622694925, "uuid": "3f0444e4-a547-49c6-a7bd-913dfd2ebd0f", "comment": "Malware payload (SnakeKeylogger)", "value": "47cc8382009720d25b2b370ff95949fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622694925, "uuid": "872cfa9d-de53-4b36-9069-93464ed9eb84", "comment": "Malware payload (SnakeKeylogger)", "value": "58d3d3a4886d61e9ef4af66b11d93c12af46372a80a691ab2b4d694db63b1432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622694925, "uuid": "3dae513e-d107-4ced-837f-6f09ce557aa3", "comment": "Malware payload (SnakeKeylogger)", "value": "a6963a894591da12f7ef103f82a3b5db1a8cdfee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622694925, "uuid": "b9a414ea-3fc1-45e2-972a-ec29e4a40693", "comment": "Malware payload (SnakeKeylogger)", "value": "4fe3a3df83decfa7896ee212a4eddfdfaf45040942b665f3155cc68807641e54e5c1fd2394a7f03a5a08349e08a1d943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622694925, "uuid": "7dc6aed8-1b56-4411-b38e-1e054d6fb209", "value": "26A4232528D5547BCCBB91399D3B9F65DF34E2231B73262BAF802B110F7B9D22522361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622694925, "uuid": "fc6d8cb8-052e-4e14-af4c-3eb2ccaa1053", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622694925, "uuid": "de0bddde-648c-416b-998d-8b10a7101422", "value": "12288:TY7wyKMpMNlvBRSntCD5eWZgg/Ycg4vJE9jZSJzp:TYTKMpRtI5eWZgYU4wVQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622694925, "uuid": "7ae7f347-50bd-41a6-9003-99846a36065e", "value": 455531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622694925, "uuid": "c859b5fa-107e-4775-a06b-883d8e28163e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622694925, "uuid": "e589b0de-ca05-41cd-b7a7-fb819e7cd5ab", "value": "SecuriteInfo.com.W32.AIDetect.malware2.4950.11765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740882e5-c471-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622727712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727712, "uuid": "3cea9e82-3fa2-4504-b84e-85d3e58b690b", "comment": "Malware payload", "value": "b08e5386aac5c425ec362511cdbe06e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727712, "uuid": "d0684549-15ec-43f3-9f15-7819a15379cc", "comment": "Malware payload", "value": "598d51493dac9f4daa0745d6486a2d824f4858f114090612ac5987dba4101aaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727712, "uuid": "936abef2-3d0e-4f05-b294-14f1ba3b49a0", "comment": "Malware payload", "value": "152fc0a72b2bf0dd67459c99d068aad11edeed9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727712, "uuid": "632eb4f2-a5a3-4e58-983f-f0d9851487ae", "comment": "Malware payload", "value": "bb3e26d21c94019585b30ad6b6f9fddb2856e0baffd8717bfd280c478f52cda3c3f28ec10d5134842107e34c2d2a7866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727712, "uuid": "23efca09-e1a5-4080-80c8-5101703e0550", "value": "96344B4572E41DA8E5AB5139D1A7A31BD53238544730D7CF33EC05192FB3BE0A9BAB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727712, "uuid": "29580a49-c6f6-4bb7-8b9c-e82f950a14d5", "value": "bb2c081751cbe6248c7fe91e32675d45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727712, "uuid": "ecbbf45b-29fe-4284-815c-b203ac743c57", "value": "6144:wopXxyL1YnxbkEUngB32XnIsGbynowLV:xpXBnxUgwXnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727712, "uuid": "7840a1f8-f360-4a24-9b37-7ba364409a06", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727712, "uuid": "34b7dc48-0055-410f-8519-80c89b1387fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727712, "uuid": "74b005d5-7021-45bb-9db2-ffbd7a6a2cf5", "value": "598d51493dac9f4daa0745d6486a2d824f4858f114090612ac5987dba4101aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652c0f72-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622724680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724680, "uuid": "f23d651c-c49e-4821-b349-3044624e8e2f", "comment": "Malware payload (Loki)", "value": "75c23c9b8cb21cafa8a8ce6653b8f146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724680, "uuid": "7d77bc34-d4cf-4023-a129-4ddd5ea0f9a4", "comment": "Malware payload (Loki)", "value": "5aa0ad1da056ce07300596739b3a963bb14948ad53b339f02e8eb8b0e34f4b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724680, "uuid": "ef667b33-c6e5-48d9-ab10-e19e73819a7c", "comment": "Malware payload (Loki)", "value": "c3aa4cdc7bb3096ba24b86c6fef0e4ae2922d1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724680, "uuid": "f7044d49-87a4-4ee1-bccc-bc8abf398d76", "comment": "Malware payload (Loki)", "value": "81244b3787dc67d780c502f44aa2c0e23fb1446d0423806691770903dc65dd1c67fd32baa766ed27065ba054d01f4225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724680, "uuid": "5f80b00d-106d-4b77-b6f9-a6464049fbac", "value": "BD356DF4B798D960E02DC731C6604CF993F13DEA9B96A50C1AE4BACD1E13F86CB19581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724680, "uuid": "0c6e7142-4e7f-4c56-9c05-07e7ea7a1aa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724680, "uuid": "f12ed94d-52bf-48cb-b94f-6b60be1c376a", "value": "24576:yq7Y7bFOBJrQUEF5jC1TTyn14K67ZFbAaKlbBJR/Pe:QnuK6FFbANbtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724680, "uuid": "7d937359-6513-4ba4-b889-09ed2f058327", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724680, "uuid": "bf481c23-cac0-4950-83d0-8c3ada726f2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724680, "uuid": "e50752ae-c4c7-4ea0-a134-3d877166886c", "value": "REQUEST FOR PRICES 200033383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3cfa90-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699436, "uuid": "22eca2e2-2944-4bda-af61-355d12757845", "comment": "Malware payload (AgentTesla)", "value": "c745accf0132345f01aac2323bb345fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699436, "uuid": "aea33a6f-2ccf-46a9-b2d2-7fbf525f207f", "comment": "Malware payload (AgentTesla)", "value": "5b9d8a84ee305113d9915edb5c6adf6182894fefa40e046b536971083064b5fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699436, "uuid": "f39fc1a8-4f2d-47cb-80ae-7a2536d0150e", "comment": "Malware payload (AgentTesla)", "value": "d0502469fbb5df44c0141ce21cb90c7983ab46f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699436, "uuid": "e34ba323-d712-4172-b716-6dd89677c57e", "comment": "Malware payload (AgentTesla)", "value": "37517782c9d8acd95dccca0ea62ee7a56b6e170fb41ccb2ad59459a4d4ba3c31decabc23d1ec0ca0d993c0efc6a84b2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699436, "uuid": "3cc46661-a75b-4f6f-b77b-4c6e5316e3dd", "value": "89B42376DE65139B004D2B68F2122D7402CCFAEF20C4AE9F12E777A628D6CCB5951397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699436, "uuid": "60ca8c5a-5fa0-400e-b7c3-e02539911c1d", "value": "12288:eW3oY/FJ9AfZ34xRK9YKLXlOO9t9tnJyzWA0Bm:9oAAZN9vOctnJZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699436, "uuid": "594689d0-04d1-4b86-8751-426c0fa4163d", "value": 506812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699436, "uuid": "60ab0bb4-959f-4c93-8518-dc91fbdc46e9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699436, "uuid": "bfe4c543-767f-4635-a6ea-2cb958ea7322", "value": "outstanding invoices.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9e30dd-c49c-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622746408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746408, "uuid": "bc1ce84e-b690-462e-b804-7840a4597211", "comment": "Malware payload (SnakeKeylogger)", "value": "6f07a147f988582364ac67ea1bf95df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746408, "uuid": "b76b396b-b8a4-4d16-8d24-272c5419b1e2", "comment": "Malware payload (SnakeKeylogger)", "value": "5dacb02245f0047b1eb683b9414549dc8fa619316457ca723a49db81c2476fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746408, "uuid": "7a3ac1ba-5988-43a9-8dc1-3a6f1c7bf4bd", "comment": "Malware payload (SnakeKeylogger)", "value": "257d2bc5ef4c52b617b8b4352bbd2b7636894c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746408, "uuid": "ff0fd987-e143-440a-8c6d-5599b3aae076", "comment": "Malware payload (SnakeKeylogger)", "value": "6b5b215ebdd2f8ba75d4719d4592ef32f20fd70c7b874d3092f6df05aafb1db2c268a48e443d92e5ca820937795ef449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746408, "uuid": "af3768d9-0ec4-4b24-84c2-0804e77d0416", "value": "BB158DF8F59898B6C14DC7B2C7909CADEBA111FD5243892C09B9DACC1F0379AAF5D448", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746408, "uuid": "dfc99544-8e20-4193-894c-8c7e80534ade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746408, "uuid": "1fd2a437-c222-4299-904f-cc9e2b333952", "value": "12288:2YycmvT8SLFjXXgixdlFcY8kBd5N6CAbYX3tlTkZjax5nDUFYb4:AprXZZcY8KmCAUX3vkZjYb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622746408, "uuid": "fd6e91f4-d88a-46e8-a5ef-1fcfd3a014ba", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622746408, "uuid": "e8257cbb-6fc5-4b60-a563-c6a5c284d53f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746408, "uuid": "01517ae6-957a-45b1-9a57-f2ace6e8ca39", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af38318-c458-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622716959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716959, "uuid": "056d6a3d-20b4-4d1a-ba4e-01568a21a7ce", "comment": "Malware payload (Formbook)", "value": "035d707f97db59999982653b6e683ffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716959, "uuid": "80429131-0e8e-42ab-93cd-d414568c5e02", "comment": "Malware payload (Formbook)", "value": "5fc1f737492b4a7e01b1e2befa4e25b1a65c7a6a83b4ec419660d0c3c4894300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716959, "uuid": "15186d70-960a-4e13-8a90-3a5a38d6e068", "comment": "Malware payload (Formbook)", "value": "b4ee6781a3d4c7fc84e966b25cf7b81ceb2d2b9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716959, "uuid": "990f62f7-dcd0-4706-9ddc-d506a4b931af", "comment": "Malware payload (Formbook)", "value": "65f6307c01e1bae943f1bd6dcd8fa4b1b58da4a91ae87a6516768a17db19b3aeee3eb34301a1aec40fe297630b3f9a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716959, "uuid": "0185528c-fb7c-4ca8-8b35-fef266da3ad2", "value": "5E3412D52BF0C5B7DCA70D310067D505FBFBDB4A7524394727298EBA2E240C5D0E82AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716959, "uuid": "ec69bb4b-18b1-417a-b6b9-5a15850936a8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716959, "uuid": "4d6543a6-289e-42b6-856d-3fb72ca859ec", "value": "6144:8Qq+j2/OAF/IBeTl3i49GbffOMCR/fgd1NmNzNeVZBXaSp:Tj2nawTl3TmfGMYjNzUlVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716959, "uuid": "c9c5b8bd-33f0-4a81-aa9d-9f6dc7fc984a", "value": 236040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716959, "uuid": "599a83e8-0fbd-4dc1-a0fd-8dfdcc2c01d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716959, "uuid": "6a6c973d-3031-4857-abff-3cac61d313f3", "value": "CC for account.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc78724-c487-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1622737180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737180, "uuid": "f193164a-7978-4e26-af88-2d23c148b79e", "comment": "Malware payload (AveMariaRAT)", "value": "c3b92604182c4023868c7284cd93fe19", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737180, "uuid": "3d1c4b6d-1b52-4af1-9f8b-df9742d96065", "comment": "Malware payload (AveMariaRAT)", "value": "6031a48b46df7f0f0902658301276bd0f5f0cb61f0a5c07bd28d7a6805f0c5fa", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737180, "uuid": "61b836af-d837-45d7-8763-2fec1ce6b0e3", "comment": "Malware payload (AveMariaRAT)", "value": "4f2cdd9771452f97fa7b4ff73bc537939df10af2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737180, "uuid": "45fbea94-91ae-4c96-9aa3-082cfa3b6a3a", "comment": "Malware payload (AveMariaRAT)", "value": "55c1ea30aa1ea43607bc709b66f4e681e937b96ea7a84a87ae337fbf81d0031ede8bbad1b4b38dee93d875ca25804c17", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737180, "uuid": "261c2c94-9b38-4777-882f-e14cbc74b63f", "value": "A355334EFBC82767E19313351F02E9081F347E866A56A187B709364B6CB0F75E381D6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737180, "uuid": "4c6ac507-f8ca-4661-b2c2-42950bc3e8c6", "value": "24576:kNt8X3wr5DCUyE1wvn+Ygg92R3KecNFvFNRaOVM69BOydRf41auFHj2fvX9ks:kQaCy1wvn+Ygg9AKR1NvO69BOydpUa6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737180, "uuid": "f4bf9061-d424-486b-9c40-8896d98a94d8", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737180, "uuid": "db8748bd-0d68-407b-8648-38c884aec0c8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737180, "uuid": "24c75fb0-0141-4b04-9967-6ee4d968291b", "value": "Duplicated.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6209a55c-c47d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732835, "uuid": "917071b3-b2e6-4e77-90a4-9c2b104ef148", "comment": "Malware payload (AgentTesla)", "value": "999ee94515419e55f8d8e63e8a0574be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732835, "uuid": "f954c081-45da-4191-9e54-d48b88e49e32", "comment": "Malware payload (AgentTesla)", "value": "604da50ab384200950c1b587812ae2a4abb6f78a8faab78bc6dd9d6680c2eb5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732835, "uuid": "0cd5861a-b24d-4434-92b3-2739976febab", "comment": "Malware payload (AgentTesla)", "value": "27f0a1257190cef43bd42a4df76e02273a446b86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732835, "uuid": "fed638c8-c8df-4ae1-927d-99c45b05057b", "comment": "Malware payload (AgentTesla)", "value": "72da217136a6b44d59849d356533949c0a99c8ac5146a23d804b8f6a1f36b0d3cebc2e09fa45c8fc618e60502db6ec7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732835, "uuid": "fe29c2ad-eba1-4c57-a99e-cc5974dfaf5a", "value": "5494237EFB2A99C3913E18A96931A019C943D5039C98653FD20F7C79C02E05A7B7F5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732835, "uuid": "7a1359f9-89d4-4e88-8bb6-e42232a40757", "value": "12288:drpwwtu3XgJ+q9kPFPODmAgh96CQqZ/f3mjYT/GGRbr:pOwtu3S+q9kPrAg76CQqZi8OGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732835, "uuid": "6d6dcd90-0506-4c5b-a204-e51c496b655a", "value": 425232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732835, "uuid": "829866a7-25b2-4c01-a47a-320c1776dd0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732835, "uuid": "7eacdd2a-b451-452b-b844-70fa03acbbba", "value": "PURCHASE LIST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b77ab69-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622703270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703270, "uuid": "d959a889-9645-4138-ba11-8ce5ac49ecf7", "comment": "Malware payload (Formbook)", "value": "206250ee3ab9eebadee164b8c7a25f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703270, "uuid": "97a0cae0-c962-4575-b33d-4a76d630924b", "comment": "Malware payload (Formbook)", "value": "60ad7da83b985659ccd61ef0a44e33c4ae4184d76a9dd9f1045548831520819f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703270, "uuid": "d8bc11d3-04da-4c46-94ab-647535b178ee", "comment": "Malware payload (Formbook)", "value": "8c7a97221cb643828bbde466ba453a48e3c69df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703270, "uuid": "6e610d03-6abb-42a3-b8e6-0a47570534cb", "comment": "Malware payload (Formbook)", "value": "7a07fcedb48f9d1a98ad143310ac99348aa146461713251123092eebe1dc4f6f338ab154c7c7c3269e4f3ab366f40f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703270, "uuid": "c3b1e867-2ab2-4e35-810a-939f38bd3596", "value": "10B4122AB8C9A2F6D80262757878E8D6B17A7C619B7445137BDF3A585A703C02C3D373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703270, "uuid": "415ad00c-1d31-489d-9009-a797e6cb915d", "value": "3909d7864c2e0d24a030b54d0b8b5e05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703270, "uuid": "84c8654f-e076-48cd-9aac-f1765eb4436f", "value": "12288:vMe+9UflluXcmH8/TsCmIegYKjK2+VoWuTK4viejSDRmpYjqg:UDCflUcr/YCmILYKV+u9O4qZFIYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703270, "uuid": "c82abdb9-6f67-4878-b29b-72b0e4f57055", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703270, "uuid": "aa09dc5b-9c94-4709-8f2a-58864edb2aed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703270, "uuid": "4b7ef6a7-8b70-4d8b-ac78-be141bd77729", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af01206f-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622699464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699464, "uuid": "3360fd38-641e-4a84-9512-bad708fb3a5d", "comment": "Malware payload", "value": "173a76273a1d9617f5b2cde725aa47bf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699464, "uuid": "ba61cc2d-4a0d-42ac-a673-aaed8ba02da4", "comment": "Malware payload", "value": "60afc72d245d76fae7ff9087aa81f677e03f6517bd69a5e8040e5fee7e1449bf", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699464, "uuid": "ed8890d6-4d72-4027-9de2-95c6cbbcf2ba", "comment": "Malware payload", "value": "a165cd9c49ba3b031fc917d8f60ac18bd969d395", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699464, "uuid": "713f24fb-03e3-4de9-9be6-2fac8d5f8ca3", "comment": "Malware payload", "value": "1a1e0904e454ed035bdc4fc8301bb2f967ebdaf5b24c213ab5edf19edfe0186bc1c5a8a9e594671bc467915e312c0c51", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699464, "uuid": "47611c06-a19d-42f2-9769-faee94b381d1", "value": "AB83C507DC059A57E52897BDBE530DB82B4E2608E4927BFB11315ECB3F912221D9F06E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699464, "uuid": "9a318d1e-4639-41dd-af49-9961b201951c", "value": "768:eEPlvqOa4MbghGS/RvTZ9NpKb9uN4S0lXOz4K+8fcafki+OgVJc0Nv51BJXImNx4:RZqz3bghnrNpCuqr4dLcaBbgVNwg1pYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699464, "uuid": "10f863df-57b8-451a-9f2d-5a8baac08f3d", "value": 87730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699464, "uuid": "355485cc-69a1-478b-9969-9e59df096efa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699464, "uuid": "a8dccf5d-6b26-44b5-beac-b2ec9962c2fa", "value": "EQ\ufffdPC-0029-02.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee7d9b6-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622700296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700296, "uuid": "2508c408-7513-4b04-beea-7418861042c7", "comment": "Malware payload (SnakeKeylogger)", "value": "49290d6def5f028d43f5b3dfc943a11c", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700296, "uuid": "aafb0985-ce2f-4efc-afcc-e4ac0f7df67c", "comment": "Malware payload (SnakeKeylogger)", "value": "60c12eb1e87d0fac641179d79c750a8cd46e325a57d7a454d708f95e6d83db54", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700296, "uuid": "f5b9bc51-8240-44c6-b560-f46a14407b9d", "comment": "Malware payload (SnakeKeylogger)", "value": "362bd8516ce946b4601e7c93325aaa44a43a7337", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700296, "uuid": "387253df-a16c-4713-bb82-39d49e3bb933", "comment": "Malware payload (SnakeKeylogger)", "value": "2500da4fb70e3f230485bfba917fcb085f2cedd518db10720ba9801941cf0689b6d007673b8de849d3f643bb4ae66210", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700296, "uuid": "26ba16b4-b2a6-476e-b881-1209596f8249", "value": "FD9423219C0A56190CBFE03DAD1E9D516F34A0B72A7769279B82B3018FFFD653522734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700296, "uuid": "e6580c43-4681-4543-9767-91766b2399e0", "value": "12288:jd27oyaMdmHlxBRSVFED1eIZg2RYc6cvpq9rhrJzd:jUDaMdtFW1eIZgSGcaFlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700296, "uuid": "59d0e4e3-9f1e-48c6-9685-e6a1add0cd95", "value": 443146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700296, "uuid": "476d00ec-05d1-4b9b-905b-991a23db68a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700296, "uuid": "3218100e-40cd-47ea-8ebb-708f76652315", "value": "Invoice-Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b56de-c469-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622724466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724466, "uuid": "8dc8718e-fa03-47b3-9e0f-175671ba5676", "comment": "Malware payload", "value": "0b4ab2b8547d9d49b35788f9da74b439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724466, "uuid": "e8ea032b-9242-484c-854d-cc4d93d1fc56", "comment": "Malware payload", "value": "60e93179fdc24865d5d06c00a6280a224263def03b1d9b081b0edf972ed95ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724466, "uuid": "2cbe7242-87d7-4ad1-ac69-e3789df9342e", "comment": "Malware payload", "value": "7452326f93c8dc33695dee74e092aabcac462f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724466, "uuid": "dc794c77-9066-4cfa-abac-cca21e6615a8", "comment": "Malware payload", "value": "00e801b1acbd0fdb9b94fe10f843c65b132dc220015edc0a2d86be816a4dc6af85a992fd7f8d8defc9982270f9b0353b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724466, "uuid": "1442c8bd-33df-40b1-8333-e88c809c0219", "value": "45362271B22B6DD2E1CD89353F9E932D1BC68AF595E82B6200813010A77F227BD671DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724466, "uuid": "4078afb5-90b2-4cd3-93fa-23411b40a1db", "value": "98304:QbhaIUK+MXPKHfawHXOQTC6gVqAUqxmxlc9c5Pt+Lw1nGosyPS8b3nH0qnQYmrjw:QUIN+6KHfaqUVNfmQe5Pt+Lwa6XHDGrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724466, "uuid": "3519ea41-040c-4aeb-8a15-9f19b473e2bf", "value": 5165568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724466, "uuid": "7bf5c976-4bbd-4add-8875-02522aa93db5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724466, "uuid": "35b49956-98d9-4244-9c26-f48df2a554a5", "value": "0b4ab2b8547d9d49b35788f9da74b439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9314252-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622738243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738243, "uuid": "a90d8a79-597d-4a2f-a584-7605347f6962", "comment": "Malware payload (Loki)", "value": "3116240aa99c6ec45e091d52ab02b053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738243, "uuid": "8605a4f0-e26e-4a35-bcc0-f60b7c767525", "comment": "Malware payload (Loki)", "value": "620c2679e02f6fc64e9ceac8f0b354a4a4d7f520bce128bbe85393091a6155aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738243, "uuid": "fbd5799b-479d-43e9-8630-ba1f62fc5dbf", "comment": "Malware payload (Loki)", "value": "dcc5ef9af3b1c96988ed976fa68960ae76e7b0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738243, "uuid": "36d56c26-e931-461c-9300-9b97e23fc21a", "comment": "Malware payload (Loki)", "value": "bddfc10559a09a59e1374c0860cd2e4bc1f35db5b89e3ff6ef3b46910d6bc81619f7b1fde1fc91dce31d3bccec719a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738243, "uuid": "16ede528-16c6-4c40-9104-ed8e081ba42e", "value": "BE057CF8F598A9B1C15DCB72D7909CADEBA111FE5303891C0AB9DA8C1F0378A8F5D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738243, "uuid": "52a8386e-0c7c-40be-9476-c5e503b4d729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738243, "uuid": "193e946a-f947-41f8-8048-979334410ef0", "value": "12288:B+KD+zXhfqTvTfiLJe5LqibaPD6d9ZhblvqdUEamU5wrhDY/yLCx9:B+KD+zxEFLqiuPuVhblvcUEanChD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738243, "uuid": "3bd32a36-19f7-4fd1-ac5b-4d21a7b38e2d", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738243, "uuid": "88fe3be5-b21a-4189-8f56-47c1023ebe88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738243, "uuid": "7117be81-74cd-44d5-a22d-484033a5db61", "value": "SecuriteInfo.com.Scr.Malcodegdn30.8880.4587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb613259-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622710678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710678, "uuid": "6b9db189-6eb7-4a0c-aebf-a8312bd43583", "comment": "Malware payload (AgentTesla)", "value": "78001af866ffc34a0a903d7df7dc911d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710678, "uuid": "b704d506-920e-498c-9415-18ba665d0a94", "comment": "Malware payload (AgentTesla)", "value": "6268b4d14af382d2e100b4d2c1b7b52b328378c3af21ad4760a68effebba109f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710678, "uuid": "2276898f-e527-4c54-964e-3b33512084d8", "comment": "Malware payload (AgentTesla)", "value": "b9dabef40c0d6c6c6dd6c830f10e3546caa09d37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710678, "uuid": "4593ef34-17cd-438a-b48b-d397695ec4bf", "comment": "Malware payload (AgentTesla)", "value": "be4d3ad5a53fcc0f6e0552201455766f296439bfe0ed76766663f527630c6033cac72ac649e1a5a1fe9f35d5b3c00c90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710678, "uuid": "7c68d936-d1b4-451d-bdac-3f93a1c46c4b", "value": "0C91D679532D1A93DE1746F6E574FE7202D3F6A197CB5DA1734DF8A007273242A39082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710678, "uuid": "7520669e-5a79-42d5-aac1-3e8768348bb7", "value": "96:l0bQfcO9mTbj4wo9u7X0Sj+gjYmaLib710AROe03Vz5N1Rd2o:l0sFiP4HgQSqEZ0ARn03Vzv1Rd2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710678, "uuid": "226ae8d5-45b4-4423-b61a-fbcf0f68b3a4", "value": 4620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710678, "uuid": "bb67ce88-8e8f-479e-8eb1-47829ce155e3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710678, "uuid": "49b47f34-b49b-4c1f-8e0e-defbfbd94f97", "value": "RFQ B 11JU2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f81464-c475-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729406, "uuid": "3d6326df-4cf1-4862-b9be-afe5e79c0ce5", "comment": "Malware payload (Quakbot)", "value": "05e883802ea644dba2b25468430da444", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729406, "uuid": "9ce963fb-a848-4c76-abc3-a128926a2544", "comment": "Malware payload (Quakbot)", "value": "62735b3059bb7c03f2d35c79a32172d00b562256b8abf26d35e1c9a69e6bc195", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729406, "uuid": "bc77f22b-7bd2-425b-874d-5f3c8558766a", "comment": "Malware payload (Quakbot)", "value": "454e8fcaadbe9ec299e14e2782d7b44a1cb9bfd4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729406, "uuid": "d17c6483-e5df-40d5-81d4-d723ba6359da", "comment": "Malware payload (Quakbot)", "value": "9aa6089081c40765b8dcb83bb8b842001c12aae97c2f876ffead5e03bc7ad2b32151bb3e8a7989cf9091ee3fea1d33bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729406, "uuid": "206307da-c929-40b1-93e6-1c12862b9a5a", "value": "40454B01B694E435F5B60AB96AAEF0E8562D7DA00F5D50CB73C02FDF5629AD19C3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729406, "uuid": "fb16a97b-e913-43ab-a8e9-c3c46db6ef09", "value": "6e31f7ef3a3092fdc488764688222205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729406, "uuid": "86e954f7-52ce-479c-b33d-7a5366ee9f38", "value": "12288:nmNDiDQ21Elifgbhc5ZbqWDyALUvNi8KaEIgVteiDqd+Ci6T1l84A79hbi:Mek2CBhcbL8vEnXnZC1Tz8r79hbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729406, "uuid": "823c3863-1669-485a-acc4-a406030ee836", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729406, "uuid": "b1c92126-dd35-41c7-8e48-ba1dac107bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729406, "uuid": "d625da50-0214-4c7a-a97e-38c4f0bbf916", "value": "05e883802ea644dba2b25468430da444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d20260-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622703212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703212, "uuid": "7dfcc380-291b-40f0-ae58-311be497e14d", "comment": "Malware payload (Quakbot)", "value": "1d4f09cd753a31946cedefcdf8250295", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703212, "uuid": "58f51e86-0307-45c1-9af4-effb3bc338bf", "comment": "Malware payload (Quakbot)", "value": "628bf679b1912a6103209a8c2d9a24900c0d158f40ead3fd3870b98b8cbe8e53", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703212, "uuid": "733151e2-e9d8-432b-b4e0-a453204550d1", "comment": "Malware payload (Quakbot)", "value": "767beb6f89b01ea4f8a8a3b893e455462851dd3e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703212, "uuid": "bc94f9ec-3d8c-40f1-80e1-01a57a4500f6", "comment": "Malware payload (Quakbot)", "value": "db57e442d483e01d599f4b7b93730c45f2ea096fa81c45faf0ed0302b18c0f3fb86ccb73ed7169f66cbc1cd6457820d3", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703212, "uuid": "52f0d5f2-74c7-4e20-b2f4-d33ce0b2af25", "value": "5C74227EE28169F4C3398C3ED244A1D0C295F1D050A7B31D07DD3528A7532AFAA5E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703212, "uuid": "acb73228-203a-4d57-985f-03e3b9110fed", "value": "6144:sMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZN9:rRMmEv2Bc/nvm8IKABfsYOmauFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703212, "uuid": "a6cd6025-d8bb-4ddc-887f-51c1a575e8af", "value": 346073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703212, "uuid": "2dba4a6f-c572-44a6-a4ef-18c90f9c2bb9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703212, "uuid": "f6128433-ada2-4a39-a32b-b044a04c43b9", "value": "Document_06022021_228219382_Copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893f7688-c48f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622740632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740632, "uuid": "6c73925c-7d37-49a4-b8d8-19a74fb8a0e1", "comment": "Malware payload", "value": "a9f23d486e3ae354882890ef75a401f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740632, "uuid": "318ff46c-73d2-47a3-89b4-25dd5a20128d", "comment": "Malware payload", "value": "63293604ad35ec909bc87036e5cf6d4f5626d8316ff9e432f833abc50d13ed99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740632, "uuid": "ea6f2c88-618a-4c71-8c5c-fea952d67037", "comment": "Malware payload", "value": "73ba94565e0a5c3ef12a080fc419ae11b0979467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740632, "uuid": "1f40cda1-d79c-4019-9128-b34cd0f49522", "comment": "Malware payload", "value": "1b4fc3cc1607baa032fbd935c0e5cef5da3afdd8c7caa181ee4a6de302171fc7dc5b00061aa5872900a0d1d87d0d8184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740632, "uuid": "5263a414-4918-4093-9805-4b3cc2e2ec0f", "value": "8FC25C197384623EC5BA2E351DD257C107BDFB07CA66EB1E6488116F1E733014BA23E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740632, "uuid": "355457e8-105e-4b73-973e-056491de53bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740632, "uuid": "5a08572c-7049-4f56-9dd4-8b78cff57c8f", "value": "384:yxl73/XBARQrbSIkvwKwq6u5cwgoAjRArKDFW4cwgoAj5ArKDFk:67prOkwXAjRAOBcwXAj5AOBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622740632, "uuid": "ffc43bbe-e5ec-4b24-a189-b5841e8fbad1", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622740632, "uuid": "384d9c50-caf1-4178-8bc7-7815bc0c8f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740632, "uuid": "75f2d7e9-65fb-408a-a69e-72660ab96dcf", "value": "a9f23d486e3ae354882890ef75a401f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cb3db7-c475-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729399, "uuid": "3a8ea67a-67f5-4cc8-ad4a-b9707e9f479f", "comment": "Malware payload (Quakbot)", "value": "69c20bb89e68d4b2d3979b4157461c97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729399, "uuid": "88fb7fe4-e995-41c6-99f6-526b15d0e1f4", "comment": "Malware payload (Quakbot)", "value": "63e724a6dc041996575dd0c227da4a25bfaec4e9505fb83ce41a805c8e9d029d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729399, "uuid": "72301746-15f7-4067-b04f-1a9603a79c1e", "comment": "Malware payload (Quakbot)", "value": "d8744816df2272709fd2c00e681f8466c5357509", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729399, "uuid": "a58f44f5-70ea-4801-b3c0-9ae5da3ffefb", "comment": "Malware payload (Quakbot)", "value": "2b95274ff03a3c39ae91085e801bccdd4eb5a48c8ed0181479a2d132e573cacf640d6ba469edf3482504faac0c072eed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729399, "uuid": "e9e2e1f1-ec58-4283-b86a-06be07dba917", "value": "35454B01B694E435F5B60AB96AAEF0E8562D7DA00F5D50CB73C02FDF5629AD19C3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729399, "uuid": "125035a6-802c-454a-a0ee-f404334ff094", "value": "6e31f7ef3a3092fdc488764688222205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729399, "uuid": "3de08f61-11ac-46f3-ba3c-d05c212e9fad", "value": "12288:nmNDiDQ21Elifgbhc5ZbqWDyALUvNi8KaEIgRteiDqd+Ci6T1l84A79hbi:Mek2CBhcbL8vEnbnZC1Tz8r79hbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729399, "uuid": "c470b6f1-9094-4e40-82b1-4c11eb65bdf0", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729399, "uuid": "fa583e2d-4892-4c2b-aab8-02b09bfc3548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729399, "uuid": "2c160f9b-15d0-4d7c-bf35-50849e464928", "value": "69c20bb89e68d4b2d3979b4157461c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64501650-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622703204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703204, "uuid": "7019fc90-d9fe-447d-a1ee-c0209f6d59ef", "comment": "Malware payload (Quakbot)", "value": "bb66c428fc0d6bd783ca352e1b2d85a4", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703204, "uuid": "e03332a9-0568-447d-a1a8-8181b34f183f", "comment": "Malware payload (Quakbot)", "value": "641035efaf10eb648385c5e694ac4f3a3b4cd0af75150553fb732e324b6e0b8d", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703204, "uuid": "3718670a-1fc0-46bb-88df-1aae6724e08d", "comment": "Malware payload (Quakbot)", "value": "82ea4305840f47492e5c01d9c5095630ad8f8b80", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703204, "uuid": "92a6638b-4900-403b-a8a2-187c4d38a5da", "comment": "Malware payload (Quakbot)", "value": "5312f56ada02c585272173d61e35fe2705d018f9f7bfdcb0dc32bdb2f28a0b50675e30913cc0ea2c746939bdf4d28ba7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703204, "uuid": "7dfe892d-4c84-4289-a348-bccc59cef3e9", "value": "6074127EE28169F4C3358D3ED244A0D4C295F1E050A7B31D07DD3528A71329FAA9E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703204, "uuid": "4ce7e32e-2750-4002-8bef-2694157d65e0", "value": "6144:/JMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNl:mRMmEv2Bc/nvm8IKABfsYOmauFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703204, "uuid": "d85e180d-8590-4442-96cd-693d911a34ca", "value": 346062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703204, "uuid": "9da4787d-15f1-4b68-be22-b47e0a58f2a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703204, "uuid": "3c3b9332-2ce0-4ada-98b1-bb1faecc630f", "value": "Document_06022021_66946893_Copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b09ce4e-c43f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622706222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706222, "uuid": "1e0f0bbd-8d51-4c2d-ad9c-11725b2c8bd6", "comment": "Malware payload (AgentTesla)", "value": "179ceadc4a4a30d2666e4c3a7ec6bd98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706222, "uuid": "7d630ed4-d102-421a-aeca-337ec7ce9799", "comment": "Malware payload (AgentTesla)", "value": "6607f57428581dfa6d570080b7b5618bb0765dac08c59740199ca24c58a0a2d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706222, "uuid": "d76c3907-86c5-478f-a64b-7ecbbffc708b", "comment": "Malware payload (AgentTesla)", "value": "4eedcbb4af2fa16ac1c6e649dc05b917e52add56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706222, "uuid": "666b7d62-a803-452e-92d6-f6147b704be7", "comment": "Malware payload (AgentTesla)", "value": "5f9f645f43f7a9004aea006b13c837589c7ed25ca0bd7634cc6ffc65c876edb117713e42c12d618c052841eb55ae55b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706222, "uuid": "7602f135-beeb-4c5b-b8a4-c9e7c0eb552e", "value": "E481DB3623349E53CF2A29E6E1F0FEE901D2B15252CF4085769DE5F20B2779C9D29452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706222, "uuid": "2e1e8b88-60e7-4827-b730-e8a6c46002c2", "value": "96:lJhhRuioCzqT30x5KTlM3XWL/jldVbJa8GboI2X8tafz:7hhRD5Jx5j2L/jldVEbcX5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622706222, "uuid": "b8c511f6-f0a6-4dc8-b980-a6f4de2943a0", "value": 3950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622706222, "uuid": "0e3b9d8f-ed39-4e3b-9fa7-f3eb84d5027c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706222, "uuid": "7069ec78-4b15-4ff6-ab5b-6265852b28f9", "value": "Ball, Globe, plug, Relief and Check valve Spec..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f632bf39-c447-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1622709891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709891, "uuid": "5e7a1c8c-dc2f-4562-baf9-1c1e01f1fd57", "comment": "Malware payload (Vjw0rm)", "value": "4567e892ebbf0c2baa6590bb239cf649", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709891, "uuid": "58ed66d3-babc-4ddb-81cc-53d9c1fb1579", "comment": "Malware payload (Vjw0rm)", "value": "662d7f915601868bfdbf927466436434cf80456d4bd5c85ca8b8e7353cc835a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709891, "uuid": "9bdd2bce-8851-445c-b48c-9255a65e9830", "comment": "Malware payload (Vjw0rm)", "value": "f2ec49073e5c5b42b573bcbdc081ca596a0bd2f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709891, "uuid": "b48241ef-3899-461a-8c50-78e606e8de2f", "comment": "Malware payload (Vjw0rm)", "value": "4ed5aedd170dcaba30b2ddf92bad2031cb5963bf28dc438d2947b05e350a05ed3219ddff95aec9bf196f0dc1aeed1321", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709891, "uuid": "90e483d0-0564-42a3-abf3-86ccd1ada4c4", "value": "BCB205EDB6C6E94B07B76E35F86E7B4812FB42260A035E0C567FC26D7A3C9528901734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709891, "uuid": "3946d622-73ec-4f00-8f30-3a3083d58dca", "value": "384:mBOKBPq6Bk2d2N2jOD5Ac9jjkZj7n6Kl8NaZI24PqZccZ/7BOrBmBOrB8HE7qN1O:mXpujgYshBpapS7Z7mAm4TeE/IOemoDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709891, "uuid": "09ef09c2-2f08-413e-9797-40e6bfce1e8d", "value": 24321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709891, "uuid": "ad4b1ea5-35d6-4946-aacd-ac59076ba9f4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709891, "uuid": "b65dc39e-3625-4247-bbf5-828346ad3aa1", "value": "PaymentDetails.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc9803b-c444-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622708560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708560, "uuid": "7280bd50-f129-401b-8714-d5f2cdd6f241", "comment": "Malware payload (AgentTesla)", "value": "e6e6d3134eaa84bb22b43f2278f101e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708560, "uuid": "783ec3cb-8676-4459-80b4-25e7c545a18d", "comment": "Malware payload (AgentTesla)", "value": "66b937415f742bca65872360ab21371f8c569a9ca164f345a7c7286361a83b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708560, "uuid": "0f3b8143-96d5-4f73-a8f7-f29206c50616", "comment": "Malware payload (AgentTesla)", "value": "59c12343551ab85a309e6bcc2c161641cad296bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708560, "uuid": "f079687c-e20f-4111-880f-053a37ea9aad", "comment": "Malware payload (AgentTesla)", "value": "4124f2dc42b73f421985ffee8a370a2ad0fd10063501d9cefcdc156d0fd43451cdc7bc868627de365e7569b56e5b1aff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708560, "uuid": "a90271d5-9f5c-4691-841f-02da0b34919c", "value": "9E85B49AB95DAEB4F18987778DDB7819437C41FA12012F778F7299483E33342963C84A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708560, "uuid": "42fe162e-fcc0-40c8-9097-c65a635af167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708560, "uuid": "604daf4f-b750-43fb-8e5d-c23de2b95649", "value": "24576:bKxSb0lvnNv8orLtc220tCap4J1pV698HbH2RepF8F54dqu/xE8AKjA:bKxSb0lvN0o33dp4J1poO2Oc6dh/xE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622708560, "uuid": "310f399c-f8c1-473c-9397-db0b38797486", "value": 1705472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622708560, "uuid": "a80c5ddd-29e7-4dc4-8249-79ed8775d4c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708560, "uuid": "47d7f7f9-27b4-45ca-8c23-aa0e8140b0f4", "value": "MT103-06022021987636472-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597dc219-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622703186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703186, "uuid": "ffe4705d-779a-4e4f-839f-b13ad9787527", "comment": "Malware payload (AgentTesla)", "value": "8637b51394808b04701f939c312b0fc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703186, "uuid": "8d740f1f-d60a-4052-b1b0-3e09ef3eff49", "comment": "Malware payload (AgentTesla)", "value": "66f040d96f2bfeb8129be6be35fdf5b68a6230e7cf7e713bc53c87a2792ca5bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703186, "uuid": "8cf499d9-7e35-4ac4-9151-70c368146837", "comment": "Malware payload (AgentTesla)", "value": "9e9ca667c0e281886406b51637efa9347b51dab9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703186, "uuid": "8abc8eff-5dbd-4956-b8dd-a99995cb3649", "comment": "Malware payload (AgentTesla)", "value": "b964639570cdcd6dc35bee1897d01018e4a3cf546cefacfb5bfd5806e05643f3df72f5e0e5aaeec6f1d1a7577965e240", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703186, "uuid": "6b81783e-b8d8-4cd6-9360-235ddf99fb23", "value": "F744F1CB03B9521CE4AB4FFB21F7CA5545B3AF20193F8A09F531B55272B7288A4163B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703186, "uuid": "4ba56b50-dbcb-4532-91de-08c769e55b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703186, "uuid": "ecc3dc74-346d-40cb-8aae-de18d1cd98f1", "value": "3072:p5N+lwSFenWsVz5ds8KpvGaACKGgS6mRKBJH3k7rZ1pqxG0ERxox+cVZZRWaEOI:p5N+lwS01zNAGaA5GvK7HILqxG0EOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703186, "uuid": "150cddd0-9dc9-46e0-8ab5-4505580e03c6", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703186, "uuid": "e80dee8d-614e-48ea-92b9-ffeea1191b5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703186, "uuid": "8d2d164f-7af8-464a-9fe5-3e0c5b972040", "value": "CleApp7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7ace7d-c484-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622735725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735725, "uuid": "07ac8237-9bd2-4903-9908-c4806ae15ded", "comment": "Malware payload (Formbook)", "value": "6d9d41b8c7b2019d513c52822c6b7a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735725, "uuid": "f11baffb-82ec-4b5d-adaa-ef867273e2e5", "comment": "Malware payload (Formbook)", "value": "67ac52a653d895f47806945a2d84d0450ddc245a9191cf7eec37297649d5b3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735725, "uuid": "ee4db717-8125-439b-825e-1404fcc07683", "comment": "Malware payload (Formbook)", "value": "d717983bc230b07923da2b8d7f7e1371985556d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622735725, "uuid": "34ff9521-fb38-41d5-9308-f634908b0e7c", "comment": "Malware payload (Formbook)", "value": "f02fafc9d7103f7f82f5e52f2c7df5ecdbb44505ba9ca6cb8ce24febdf191476f390872d6d070dcd16291e70773da1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735725, "uuid": "e5b23a66-d90c-4844-b7e2-f99652fe0bf4", "value": "93554AAC75A49893C05DCBB1AA8CDB7F161219FD5313C93A3538B18E3A033E95E69437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735725, "uuid": "218ffac6-11d3-4622-939e-22a54d926cb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735725, "uuid": "5a3fa2fe-0e46-4bf8-9dd9-66554c77c680", "value": "12288:5tHj5OfqTvT9XUUwg5AK7n65mLqcB0P1DYY2af6oYKc7EpCCZeI:5tHj5OORwSA8QmqJEbDoQYpCCZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622735725, "uuid": "2cbb21af-00cc-4b9e-a75c-64138603c46c", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622735725, "uuid": "5ba22e6f-0988-4fd8-b953-0d26385ce1d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622735725, "uuid": "108f02b1-f62f-4f2c-99bf-882d852a1006", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad41222-c475-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729387, "uuid": "8a4b4d0e-5f75-401f-96f1-2eefebed785c", "comment": "Malware payload (Quakbot)", "value": "4e48187fb737dfb8a0161b61878c0a2f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729387, "uuid": "eaf88266-a64d-4d96-84fd-79afef14a975", "comment": "Malware payload (Quakbot)", "value": "67b59da81b4fc9606617d63aefe3eb2f5c28071e6fdd4baaa0dcdd9193ebdc10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729387, "uuid": "0be3f35c-cd79-4808-956c-ec5b7e6f4499", "comment": "Malware payload (Quakbot)", "value": "0807fb79b54d85063ca9ac4ed008f7b7b8cee8f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729387, "uuid": "ec983937-4fbd-4daa-9642-c31733348de3", "comment": "Malware payload (Quakbot)", "value": "af42124955a8e2066de6ce801b64fe7dc97f584465440e416972905e192ec020321adc16922ec2ed26f338b3f4990bf4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729387, "uuid": "c2e3036b-fa51-474f-9210-562d635c2556", "value": "69454B01B694E435F5B60AB96AAEF0E8562D7DA00F5D50CB73C02FDF5629AD19C3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729387, "uuid": "68077bd4-f457-48f6-b0a5-39fd99036383", "value": "6e31f7ef3a3092fdc488764688222205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729387, "uuid": "add22a82-e813-49ce-9445-2f227736a1e9", "value": "12288:nmNDiDQ21Elifgbhc5ZbqWDyALUvNi8KaEIgkteiDqd+Ci6T1l84A79hbi:Mek2CBhcbL8vEnunZC1Tz8r79hbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729387, "uuid": "fcc23c6c-c979-477e-b3ae-a018fbaec5f2", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729387, "uuid": "439e89b5-14c3-45ed-9271-6e8ac2860aed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729387, "uuid": "20a42458-c98f-448e-a73a-e079f0bcde3a", "value": "4e48187fb737dfb8a0161b61878c0a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc21f6b-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724587, "uuid": "ad9a7e3f-58c3-464f-9016-86e098e21b7b", "comment": "Malware payload (AgentTesla)", "value": "8b06379e8c73b1b3ba8cb3879d248791", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724587, "uuid": "501b887d-8a5c-4645-af7a-2db750831676", "comment": "Malware payload (AgentTesla)", "value": "696859d8d34182aa8cb66b969a542eca12811a9e82d15ba8f5a5f88b084ff1ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724587, "uuid": "8cb58815-d279-42c0-91de-7d6f3be9a28f", "comment": "Malware payload (AgentTesla)", "value": "5418f910c6ff38b2629bdc4f13e4c5aa1d988a1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724587, "uuid": "a94a4368-9651-435e-b741-97823534967b", "comment": "Malware payload (AgentTesla)", "value": "716cbeaccc8aaeb4598634702abb90fc156369ddeeeff48ff3b2e650ab4aea20712ddeb8f5d199f002abe4faa92d40a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724587, "uuid": "a6eae06c-a9d0-4d7c-afd0-977e629befac", "value": "B0457CF4B798C9A0D12DC731C6204CF8D7F13CEA5B96A50C1AE4BA8D1E13F86CB59981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724587, "uuid": "a37b6458-8b56-44f2-beec-4916dea7749b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724587, "uuid": "652e730c-d929-4bb1-bd6b-874f9ad80f90", "value": "24576:xkY7bFOBJrQIEF5jelFUGn3YWWhmWzaXUV7dGZC2gib+f90h:4n3YWWhaXgdG5gHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724587, "uuid": "52d43d62-e476-434a-b833-227cb41081b1", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724587, "uuid": "513d7a47-b144-46c1-9473-48a10fbcb524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724587, "uuid": "bb4ec68e-ef46-4409-9d63-e19795826d66", "value": "OS2Is3xL3BScraQ8Oe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a9ebd5-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699470, "uuid": "92789984-cb09-4a75-b1c6-a55a3eb58b17", "comment": "Malware payload (AgentTesla)", "value": "2bae8f71a486883503d04c462a6240d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699470, "uuid": "a443eda0-192f-44c3-b7bb-d5caddf2801e", "comment": "Malware payload (AgentTesla)", "value": "6973dab1da8d0bcb8185df7aa63b8474bc9491f16f7642a347b529789f19d6da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699470, "uuid": "edb5441b-8f91-4deb-9f6b-bb594430f99b", "comment": "Malware payload (AgentTesla)", "value": "2de448bbcdf99977418318aff3a19f0e2bc3ac7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699470, "uuid": "0c84df9a-c5c6-4bcd-8150-78d37d796595", "comment": "Malware payload (AgentTesla)", "value": "fcc57fbbee5adc825ebbd4230b61eafb3a929e0123ec7d9a74a02d2abba4d1d85a64c256499369300dd56d0c70d30d8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699470, "uuid": "64e25cb9-ffaf-4129-aa56-88f501585313", "value": "6FD4238FC1667B39CEB9A1E17F01371CD37ADD764266283C2A2776189FA816F26F0054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699470, "uuid": "15dbe94b-90be-424d-88b5-43cf8cb5a633", "value": "12288:pQ2c2+YnUjrgnQriEa0xN5VsCgA/46uzAt9/HAAHkQD8a6s5N4oJPyrkPF8gw:iZ2VnUjrHrU0UC5/46vFJkQQa6s5NrW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699470, "uuid": "9ce5da11-816a-4e03-85dd-b5d28c264075", "value": 649403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699470, "uuid": "202c7293-d80e-4787-b692-43a50bfc45dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699470, "uuid": "c0e4fc65-d3d0-44ce-83d7-dc6a6d567589", "value": "3034501.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fd3888-c471-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622727601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727601, "uuid": "3da7c147-005c-400a-a5e7-410e828ee89e", "comment": "Malware payload (RedLineStealer)", "value": "6972482b38fda49d5ea9f11bd2496909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727601, "uuid": "f45a3492-9af6-4e1e-8a19-197af15c19dc", "comment": "Malware payload (RedLineStealer)", "value": "69e411368f9407c3c25b453792bd383fed96eb6bb6a7e9d0cf06d980add295c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727601, "uuid": "39d3857e-d7f7-47f7-9e9c-a026c3af9382", "comment": "Malware payload (RedLineStealer)", "value": "3f70b20432fa4ceb9cff4c3bd28028183d7e6fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727601, "uuid": "329e5f37-bd31-47b3-a9f1-0176c225fdb4", "comment": "Malware payload (RedLineStealer)", "value": "dfa924c5b3f2066c20611fa509248d1547c0a56faabe7e981258f6ce0928fce294250eeb4a84ce49b2db6fc63e617993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727601, "uuid": "4e4fb63a-59c4-4272-b445-529ed868f0c1", "value": "E994ADCB6E4142F3C6ADF67544B3733C03AB9A7D2BE38E0DA81B3E556B3225D8540685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727601, "uuid": "6733692e-d114-4508-a86f-68a4c147700f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727601, "uuid": "6bf5ac48-486e-4d33-b824-6432e4aef316", "value": "6144:n+fzwqkBkEkYC23DrKZRfkNqOuZ8qBeUu0BYciq0SqfvZkjcWsSBHB:n+fzwtWR2TrKZRMN1uZ8Jy02oZkVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727601, "uuid": "f4f95b70-addd-4cbf-a070-f25746a52bef", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727601, "uuid": "9c876ec6-b6a3-40c7-abc1-cd183e1f2d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727601, "uuid": "1d2c26e0-a4ab-4482-864e-da47e182a702", "value": "SecuriteInfo.com.Trojan.GenericKD.37018260.17870.25484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5eb59e5-c444-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622708549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708549, "uuid": "6e91a016-8f18-48a2-bf79-b2cf15e06b9b", "comment": "Malware payload (AgentTesla)", "value": "8246a4b29d8dc66ee42fd1992e93f02e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708549, "uuid": "668fb7ae-aeeb-4b43-bf25-d51139af1479", "comment": "Malware payload (AgentTesla)", "value": "6e362240f8c0314c8c10319312b7abe77fd4821f5ace2b8e2837e07c86f3ab75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708549, "uuid": "75da93c8-6c4a-4e35-a437-96f2ece807e2", "comment": "Malware payload (AgentTesla)", "value": "4ed814364c59aac5c2c3feed7a841dfa09dba8d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622708549, "uuid": "1a621cc6-63b8-457f-b819-d9a772ba4438", "comment": "Malware payload (AgentTesla)", "value": "4f53d21f948ef32cd103e0267b9ea59fdaf693ae5bb8adf20f064ec6e53f68875460a91ce05306de569211bafc7be111", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708549, "uuid": "d8dac3ad-2547-4ef9-8ab0-3336dd42b40b", "value": "190523ADED2C0F1BD1C4EBCDF17ED2667C74D26ADC2A10F2403E06A94E35999685CB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708549, "uuid": "e668fed6-5335-451b-8f43-bb97e8f9c9ef", "value": "24576:aF6Za6fGlk0mfXpV6N8HbHY3epX8F/45qu/xEaAKOLTN:CgtXpowYQcw5v/xEa2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622708549, "uuid": "c9ffa6c1-5d33-4054-ad74-903c5745b5e7", "value": 864472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622708549, "uuid": "db3f6245-e285-4359-9f8e-13215898e3e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622708549, "uuid": "0e7c4daf-cf44-40fe-8f60-3b426251f5e1", "value": "MT103-06022021987636472-PDF.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e7c290-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757749, "uuid": "466b081e-8026-4da9-97cd-d370b66ebf86", "comment": "Malware payload", "value": "ac2b7f66f2c5fe32220626b45fb90626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757749, "uuid": "9e674662-d3b4-4601-8f4e-3bb5cf8f544f", "comment": "Malware payload", "value": "6ea4808f0889b9dc62f93e537ddbec6f3e35dd7b5be2a3e75c4ef1a5cd5d9256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757749, "uuid": "f11d80d2-4534-48c7-aa33-f5f098d2f822", "comment": "Malware payload", "value": "3e31f84b6555539365f3c42403fdc73d8532d7d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757749, "uuid": "df9e22d2-fc7c-4267-b910-d0ab6629bf38", "comment": "Malware payload", "value": "b54779935f123ecd2a34a5579875dd621c58e24665f5a8120b3c6a00e4495e03bdb9c1fe8f95bce1b4813b893bbe323c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757749, "uuid": "edc2344d-5599-4085-80bb-20d5ac48ebc6", "value": "B7A3095537E40524F2FE4BB4ACF100658A71B0177826D6AF1AEE1B6D0DB97E4C920FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757749, "uuid": "95594a77-7e4e-495e-970e-009eea14a4b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757749, "uuid": "c92f97f3-e839-4e4c-ab8b-eb16987919f4", "value": "3072:KvE6ITzqgWRu3PtaMbC5Wyn+KmVSj4Dm7:9xTZYoPtjbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757749, "uuid": "44a8e190-8ced-4435-9ba9-cdc933710c8d", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757749, "uuid": "f13e6b51-d81c-43f8-ad65-8517b40df485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757749, "uuid": "44b7274d-1375-4744-8835-60c58b8dad7b", "value": "SecuriteInfo.com.Trojan.PWS.StealerNET.74.4853.10232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db09ca9-c4c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622764181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764181, "uuid": "c297d7e6-8b78-4ab0-84c9-37cc6937ad90", "comment": "Malware payload", "value": "ec250b7fcf58aae6f996e3ad512ac6c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764181, "uuid": "fc12f03e-08cb-4134-87fb-68aa3b7d707f", "comment": "Malware payload", "value": "6f6a28c56adaaf83617deac4c89e060074b14697872ffcbce53c72cd5cf5a3b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764181, "uuid": "1c032441-ee04-4eb3-8598-786fc824227d", "comment": "Malware payload", "value": "ad0e76f8afa8d51f7746b24608ffd3616ca656d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764181, "uuid": "941d5e4b-2ea1-4a1c-b6a8-c159a6f8800a", "comment": "Malware payload", "value": "3b8b77418b2c14fb1069c84890aafcd2c3665a384353887ec1ed2a414447e29fc6119cf26f5c16b84e3f153b0a02e80c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764181, "uuid": "f3a76e33-4c7e-4276-80a4-ad892689606e", "value": "79F4F100A790C035F1F712F4897A92B9A439BAA16B7850CF63D537EE06B57E1AD30B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764181, "uuid": "971e1868-738e-436a-a3cb-e98b08194c20", "value": "cbeae8361a19a91fa1242808c9b08b0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764181, "uuid": "af86b820-1322-46e5-8108-f0d1fc714a4b", "value": "12288:rDhwmbyuTW0anIHMva6/QlN4X0519dBw1ciNPNvLsqFShZS/OnpIxjM:rD3uqW0HsvXQXC0jH+cCBLVFSPSmS1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622764181, "uuid": "b24f2651-b38e-4c64-ab8f-c8c7d6778e94", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622764181, "uuid": "65e02deb-770b-47d1-ad3b-bf2fd220b359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764181, "uuid": "1f1f8304-cc6e-40eb-a304-3d38dfc9d1a6", "value": "SecuriteInfo.com.Troj.Kryptik-TR.2142.2920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78816b5-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622714591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714591, "uuid": "88c5f9ac-153e-4ecb-8be1-ddb449ca0051", "comment": "Malware payload (DanaBot)", "value": "00d6af109ea4cb29969480e0802cedcc", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714591, "uuid": "620376c2-55d2-4665-9c0f-e0d6d372b3ab", "comment": "Malware payload (DanaBot)", "value": "70ab50a285413501e885a1335a980316dc09f6f00b4adeeee31da8c1369f4c66", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714591, "uuid": "e7404bdd-98d1-432d-a3ee-7303fa0d78f8", "comment": "Malware payload (DanaBot)", "value": "2da16a8f7c1d3f4f15d16aa2a5f0caf28b69cdc7", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714591, "uuid": "a8810b94-f2c6-40c2-b4f7-267a2be6d544", "comment": "Malware payload (DanaBot)", "value": "c40a5df81b98423c476f036b489beb0eb00ce6ee362cb9ec21d8cfb010085c20c7dfcdff6db5bb0cf0270f6baafadf29", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714591, "uuid": "e2107843-8658-4d0d-81f5-70e680fdce70", "value": "D7563300BAB1A024F0E611F444FA83BBA6267CE0BB6455DB22C627DE7571DE59E31F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714591, "uuid": "eda0f0dc-8e4a-45f6-ad65-f03885ec580a", "value": "ce0285631d070898f097544ed4dc3769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714591, "uuid": "7d1e303e-03d4-4df6-9965-17944665d506", "value": "98304:4czossVI7JYmZXwflXCfPuzbzXhMXb20NBCvs5Gt+EzjwSIwvBFFuQZi:4cK+RuzbzXirhNzTgMSIwDFvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714591, "uuid": "9006adf8-43ab-4ab4-9f5b-eeaba7210ebe", "value": 6349824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714591, "uuid": "5cd59d2c-7fda-4272-ac65-8b541ac54319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714591, "uuid": "72faf7bb-4ed5-43ac-9741-e1db58ac80cb", "value": "00d6af109ea4cb29969480e0802cedcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7d56f7-c48a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622738379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738379, "uuid": "fb2811ed-9493-469f-942e-d787aff5eff7", "comment": "Malware payload (NanoCore)", "value": "0ac067f9a888d650d44d0f3c9cef21bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738379, "uuid": "c8707f45-dd0b-4784-ad30-0bbfa7eb60ed", "comment": "Malware payload (NanoCore)", "value": "70ce901a087e1bbe46d0b2caa61c46800a4935dc6886ef9baac14bd6e91b2abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738379, "uuid": "e1560942-9933-4d73-95af-cc77794ee6e4", "comment": "Malware payload (NanoCore)", "value": "980754b7b922f8dbaa4e8a4381cb2a085ab6766d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738379, "uuid": "deff7a42-edbf-48a2-a935-682cea9ad7d4", "comment": "Malware payload (NanoCore)", "value": "a390fcf5e235b4dceac789e0a41e3d54be9803782c237e525e4b85a78912ac3ba27757b3b12b5058b017af0df74ebfc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738379, "uuid": "f6d17905-b80d-45f0-8454-df4651c57b94", "value": "78A55CEC7250B5AEC487CE32CA945CB4EB9038FA4B0BE607519766DD5E0EA97CF140E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738379, "uuid": "b45904be-24b2-4208-b9ca-006fb79892dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738379, "uuid": "e648053e-df32-4d06-8e52-c1eb8bd2b415", "value": "24576:ZNTm/OYppm5rcfqfVsFNB4xxKqGHVMJ1i51mYI/GvpMFT5SR:Z8//mgitsReV4VIOvpM55S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738379, "uuid": "a3e19a36-88b5-439d-a352-6f10f73fc42b", "value": 2202112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738379, "uuid": "a236d937-8ccc-48ea-8acb-97c1487586fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738379, "uuid": "4a0f1325-30cf-42a5-bc49-a6ed12f74f54", "value": "0ac067f9a888d650d44d0f3c9cef21bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4595ed4-c473-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622728679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728679, "uuid": "187cff6c-2087-432d-8eee-2ca7024a936b", "comment": "Malware payload (RemcosRAT)", "value": "3aac2e51f94bea6ebde212013f2157a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728679, "uuid": "d4379338-4242-4c5c-a424-72b5c57989d3", "comment": "Malware payload (RemcosRAT)", "value": "724c5c5649720c7ded1b006fe6fd4cd16b49f8d1596f0c358cac8a29d8dab9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728679, "uuid": "2e1364a8-1ad5-436c-b4c9-228487812b50", "comment": "Malware payload (RemcosRAT)", "value": "8cbabfcd197c0e81e69e6fc936ea54d44b6c852c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728679, "uuid": "3d1f6742-6f93-423c-af3b-a8a0dd8994e6", "comment": "Malware payload (RemcosRAT)", "value": "327205fea8cad9e7160379f58a2fe7fdc2a7401b2f01f23c55d48a78881ee4cdd4ccf07881a0eb0a80d91edf1da3496f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728679, "uuid": "225fad39-8274-44e9-a4df-785c3c0879f2", "value": "28541324B2C8DAEBCD9341306B7B1AA6D3B54E524310271B9F161EEE7921253859F7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728679, "uuid": "9d3fd651-bae6-4868-abc7-4caedd68cf89", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728679, "uuid": "9c2447e9-785a-470c-9837-39929c964102", "value": "6144:8Qq+avd/ylkKIsTknNyc94u/e50OKNojiY/Bym1b7hfs5oTSYxp:TavdaFI8kEcWu/e50b2mY5FbptZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622728679, "uuid": "ed81c4fd-72a3-4836-86fe-dd29cb9d1c94", "value": 296094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622728679, "uuid": "d98b9a73-6641-4377-9d41-0f76c7b6c42b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728679, "uuid": "bb693861-2331-478e-8d99-a6aabaf1135a", "value": "e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53cc1401-c48a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622738395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738395, "uuid": "e299a078-248b-4a42-ae53-5912787d9686", "comment": "Malware payload (RedLineStealer)", "value": "568674aca55b1eae0c7ff793d2627d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738395, "uuid": "e0367b13-2949-4027-b07e-5f3b8a7da39e", "comment": "Malware payload (RedLineStealer)", "value": "7422c3cb2a3829fcc4906445566d4290fea9ef16c1591ca1846e91524b26bbd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738395, "uuid": "f74312d3-88f8-405a-b099-de414edbd693", "comment": "Malware payload (RedLineStealer)", "value": "ef6ad320a6b7556f4ba9a4612682466438dcb289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738395, "uuid": "77ae28fd-5cc7-4b32-8306-26a43cc0d9b1", "comment": "Malware payload (RedLineStealer)", "value": "695b41ae8d7437968f3dda731157431d93903293fe7158f8a54402eaed52dcf8ffb99606dca93d8e10020f7a11d7c7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738395, "uuid": "1e7bba2c-ef94-4e07-98a0-c4987d77fc37", "value": "EA84AE10B7A0C034F5F312B45ABA92B9A63D7DE16B2450CBA2D42BEA57746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738395, "uuid": "e5b2d26b-4e00-486b-9da7-f3b51cd8b46a", "value": "788842c19811b0f2f6994735b8f363a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738395, "uuid": "d5148d6a-9d12-4000-993b-244495103e64", "value": "6144:MxzOImoWq1jrBKDwDPRMInJvl8qD+d7ApR6iocDjD3O:Mxzfmt2jrBBDPhd28ksMiJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738395, "uuid": "7fb24049-3456-4d68-9dc7-b0ad0b06957e", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738395, "uuid": "fc3a3da5-e4da-44a8-8c23-f1b8b26a4688", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738395, "uuid": "3bed5c59-cc0f-4a37-b648-fde552fb285f", "value": "568674aca55b1eae0c7ff793d2627d6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc9cba0-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622700217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700217, "uuid": "0883e8f2-5259-4bc1-ae48-b368e533383c", "comment": "Malware payload (Formbook)", "value": "f0ab5f07a02cbe6511ae426f9d746563", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700217, "uuid": "88a01029-69bc-4770-9df8-fc44dba98663", "comment": "Malware payload (Formbook)", "value": "74336b753bee56d595e5420bccaa26e0f124200cb5071e853983118f49009654", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700217, "uuid": "f10d3f73-5e38-4659-9c06-6991209bbae8", "comment": "Malware payload (Formbook)", "value": "9bc21fe6fdd7f252734d0a6399c8bdaa71526ba5", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700217, "uuid": "8e72e545-a73e-4201-9a2a-08edf769f9de", "comment": "Malware payload (Formbook)", "value": "ec3f4d7dad03504d8c24cbeb3942e07eb70a201a2837166add12b5292097504318b7423278b41da099d2c045ffa012d2", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700217, "uuid": "6f0a4144-d219-4674-84ab-900eac2d41a2", "value": "E9E423EDC9F993C23837D239B209F537E0B866148BAA951DFAFDC27D90D421562B8C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700217, "uuid": "a00281ce-cd89-4a40-884a-7cb6a3c7f343", "value": "12288:2EBK5WprtnScqcDVha4bX6u5BNK2ISUkMTWBG9W6vlj/6sk6BEH2RS+f/:R55qqVhPX6gbK2ISUNNW02sk6Ekf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700217, "uuid": "1860b0aa-91e4-46ea-ae48-255faed0a5b4", "value": 705935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700217, "uuid": "248270db-1e8a-47ed-9e61-2ec6e95b9ed7", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700217, "uuid": "52ecff42-f89f-4326-8462-a86235e4ed7e", "value": "Wire-Payment.pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa617ab8-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1622699590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699590, "uuid": "bc0698d9-c4cb-466d-872b-81672b15bea9", "comment": "Malware payload (OskiStealer)", "value": "d06e8007f29254aa4401d33f3785d986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699590, "uuid": "c52e02af-5ed1-422f-b9db-b9a039bbc3f0", "comment": "Malware payload (OskiStealer)", "value": "74a4c90b44c56630cef55f461b176b8200b5c86fd31b4fde52602a4c725f47fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699590, "uuid": "c9537548-6587-4488-802f-c5864ba72250", "comment": "Malware payload (OskiStealer)", "value": "ce52152e4ed64e5ef4f9c34d9b62056bf0dd5afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699590, "uuid": "6905d3ec-ee74-4c46-85ac-a2c0ffa6b0be", "comment": "Malware payload (OskiStealer)", "value": "8ec09d9d1534d0cfdc05b2f974dfa0a1c0560ce1f396e23a86f061042bcbdfba0a64f3d2ec785066115af86048c7b88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699590, "uuid": "e80858f0-197d-4bb1-b964-6828b6c48617", "value": "32C4E121F2B48B8AE0185FB357359A000B743C537865D63D285A35FB44B2BE3266FA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699590, "uuid": "249f5fad-9871-4c7c-96c5-d96841a27635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699590, "uuid": "0c06e3b2-cc2c-442f-8e0d-52dc7d80b61e", "value": "12288:YMEmM7AQD2zRBShglqYVeW8+wfOtvRyp1p/TGgJYFge:n+CS6qYYF+wfOvkGeYFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699590, "uuid": "1873ffd7-1aa1-4b53-a684-50a5cbcc4502", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699590, "uuid": "7dc9d87c-f331-427f-8f78-e77ace9e60e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699590, "uuid": "677f096a-3219-4499-9382-b6b3aba86500", "value": "Po____062032.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ba7f9a-c4a8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622751201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622751201, "uuid": "3b980995-c009-46b7-ae10-bd1789893f0a", "comment": "Malware payload", "value": "e90de32a70aa62322b0ea39ed9b7abfa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622751201, "uuid": "6aa05de8-b777-4e96-b1d1-54548cef14ec", "comment": "Malware payload", "value": "750237a81d2cb12fb8c5569d73c56a51847193070ae3e177060b07a3129623dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622751201, "uuid": "4ae4ceda-a683-41c0-91b2-e335bd796252", "comment": "Malware payload", "value": "521abf908299dd73276afae91cda79d6e0bb75d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622751201, "uuid": "daf49e2d-2737-414b-befe-4c14321090b2", "comment": "Malware payload", "value": "3815b053706393422c51acbdd281c4b479d49809ef045d749b47143cea1ba5a9fd93be8d61035c7fd6d7bcbc1166fdcf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622751201, "uuid": "26014ec1-edfa-43de-8600-adc22557e9bb", "value": "FE35BE42B589FC3AC1551D386A88F5E9474C7C144EAD298F3BD82F9F6B394431A2836F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622751201, "uuid": "cf10bf70-261d-4a5a-a46c-9cf47f94b34b", "value": "9038a5d2fa4d36660070d6b2440dc325", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622751201, "uuid": "a11ebc90-9ced-46ee-9f9c-5c9372512305", "value": "24576:m0u/lKPLdtj+bZLx1GRFqCbQ45N3OYP+9Gy:m0ilkaz4bx02N3d+9Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622751201, "uuid": "8deedfe6-0388-4dc6-931f-028444f9bd15", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622751201, "uuid": "9a7d2d87-2297-42fb-a6a9-f426ad2d6f47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622751201, "uuid": "2c0bf812-e3ac-4a07-853e-09d96677b3c8", "value": "2969341.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7317d4-c499-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622744911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744911, "uuid": "1c160279-67ee-41ea-8ac1-31b93deca931", "comment": "Malware payload", "value": "a185444ff58e6261abff03fa320a6fa6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744911, "uuid": "fbe5dfac-d5d0-4dfd-ad41-81ab9efd6307", "comment": "Malware payload", "value": "77e706f98b1e4fe48a4a1631b27529dc587aeab2d187322439d3b5a726da2f80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744911, "uuid": "d6cc903b-fa11-4e6d-ac2d-77142fbcb0d0", "comment": "Malware payload", "value": "d5e5510107e6f85a0603f7d5058eff5c0f887c38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622744911, "uuid": "de236e59-6d00-42a1-abfd-55a4261bcf0f", "comment": "Malware payload", "value": "80937244b51539b6d4bca4878adfc369f223386cb1a99b69b0b11ab9354db23bfbf843326e99ee7ec0e1781570ca479a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744911, "uuid": "48069ae9-ebe0-4694-82dd-7f08f0b147b3", "value": "07B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744911, "uuid": "cbf2758a-ccbe-4394-8243-8eacf162d324", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744911, "uuid": "4343a865-524b-4213-acfd-c8266a317be8", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvVqW6mZuzuJPjX7R75:vz75tzST8ANq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622744911, "uuid": "365bf9d7-f26f-4293-be5d-7c42ebde11fb", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622744911, "uuid": "20133ecd-7305-4e35-8efe-e42362b359b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622744911, "uuid": "e15c8a06-a9c7-480f-9b37-239358e12191", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e75c7-c48f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622740479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740479, "uuid": "9dce4c52-1e72-4af9-a894-c61ba0483ce7", "comment": "Malware payload (AgentTesla)", "value": "2ce100e50ac65dd58709e1c36c815511", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740479, "uuid": "23a29ca3-d025-4058-93a5-a13a8d68a323", "comment": "Malware payload (AgentTesla)", "value": "7910ca2d0ff258cabb758f00694b3a9d496308d1d6b750e477a9f07673090db4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740479, "uuid": "6b893fb4-ffa0-474e-ab72-4fe3a6804033", "comment": "Malware payload (AgentTesla)", "value": "6466300ef87320b762dee6e060837fa37b88b97b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622740479, "uuid": "ce457a1f-81ca-4c68-98ec-af8a5338be01", "comment": "Malware payload (AgentTesla)", "value": "e913c336cc09d146dc1182ce623b246d1e520442b987c57a9bbf58bdbbda5d26ba2ba828bc4d073dbb6be5a2717a01a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740479, "uuid": "78c372d6-59f0-4db6-8ff7-b976ade5ee17", "value": "F8457DF4B798C960E02DC731C6604CF993F13CEB5A96A50C1AE4BACD1E13F86CB59985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740479, "uuid": "da2303dc-00c8-42f3-ab6e-2ccc6dd37eaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740479, "uuid": "dfb74c2c-8ac0-4585-b557-76ce0f5742f2", "value": "24576:BsY7bFOBJrQ+EF5jfAnGG1fIfVGFLdP5YDJmRGBisdyefujP:wnGQIfszPkBU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622740479, "uuid": "0fa5418e-b8ac-4394-b686-1516f0a29939", "value": 1202176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622740479, "uuid": "f2df7f41-d7d2-45fb-8ad0-fa66b40345d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622740479, "uuid": "f89a9274-28c8-4750-b9c7-bcb74a03e393", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626f333f-c42e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622698906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698906, "uuid": "edf46a77-a01f-4739-b63e-9c5e028f5db0", "comment": "Malware payload (AgentTesla)", "value": "eaf4bec0c1103fa6f87aaddbaa631454", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698906, "uuid": "087fed22-36f6-442b-a1c9-3086e7e38313", "comment": "Malware payload (AgentTesla)", "value": "7bc8e9198c499b6c48d39e99734d3c9081d0eae625f5ac9a2ca4f571946a1501", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698906, "uuid": "32eaced2-adda-4dff-92e4-664679e35f95", "comment": "Malware payload (AgentTesla)", "value": "84bd2145304c05375a1ca676694347901d16cbf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698906, "uuid": "25323793-15d7-4fc2-a2e5-11aa4784eaa9", "comment": "Malware payload (AgentTesla)", "value": "62e4ba92d7430e636f0c7eefff99fb4874d5c386d624b9c364dae9f2b4af65a61b935460e799014f194f8271e39c0328", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698906, "uuid": "8a47e10b-6a01-4293-b25d-7e9837a15c84", "value": "AE9423ABA091AF9675471748BEE77CA55C324A6B2048D033B4B96679903CB170F8FF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698906, "uuid": "7c7d2f7e-3719-48e6-8825-e00c4cc42be1", "value": "6144:l6C2GLL2DnL9sxKNIivxP3T4ewJEXoeLnaEIMRGEwU180SaF1pUR3LU0BG00PrJ:lhZ8NTF2J+LaEJRGdu8SF1pYZ8rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622698906, "uuid": "59ecbc78-ac3b-4048-86b3-5ab3ef61b534", "value": 433884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622698906, "uuid": "40829e3a-7668-4421-ab6d-00c69b5ff784", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698906, "uuid": "67491c13-1b1a-4ef7-99f2-918788ab087c", "value": "Bank swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743c5627-c439-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622703660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703660, "uuid": "e394b6d8-c3ea-453b-97b3-0c8454771586", "comment": "Malware payload (Mirai)", "value": "aa23d5a2c35ee06a598177ec54de724d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703660, "uuid": "dc03e180-9f86-4706-a4f7-581f097ddcdc", "comment": "Malware payload (Mirai)", "value": "7d26547c33d4d8e7db55202f0ed98f49809b1f76edf635e1fc9d53b30eb268fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703660, "uuid": "c6f93edc-3577-4253-9682-decdcdaede83", "comment": "Malware payload (Mirai)", "value": "78837839cad5c590e35a30acf800805b5cbed1f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703660, "uuid": "78488a81-9bee-40eb-8a5c-9028c564ca74", "comment": "Malware payload (Mirai)", "value": "3c395f5426ab67b2b70bae855651187d10e993c06b23c2d1efbd51b34b69188e1f002a582f2ea60a567beb3d1e0ada65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703660, "uuid": "bf1e5f18-1123-4387-9917-cd98e7937e03", "value": "3963C61A6E258FFCFB99823546FB8E21565833D227A1D2C5D15CEA015E6034E780FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703660, "uuid": "2737041f-f3d5-4ba0-9c45-3474ac538ac5", "value": "1536:zqmI7+0xc/thwHh/AwXV1/Hv4Lahv1bNU3Gne:2mcm/74lXV1/gOv1ba3Gne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703660, "uuid": "100ed15d-2e12-46f1-9a3f-99ddd9223b37", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703660, "uuid": "87d8ee8a-1fbc-4215-bcb8-03e2c0422569", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703660, "uuid": "dde84bde-81d5-4a3c-9048-9dc6f208d47d", "value": "Priority.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2ab6cc-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622717879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717879, "uuid": "bae12016-4a27-4141-9ac6-a5bd2cbee75f", "comment": "Malware payload (Loki)", "value": "164641fbbc75d6c9607a72e9e18035b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717879, "uuid": "fab9c60b-d04f-4847-b905-597d9b63c719", "comment": "Malware payload (Loki)", "value": "7d814ec70cd8c05ba64db66b8443022497619409ff91162ffdf1e2722f4757d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717879, "uuid": "e585c70b-49d2-40ad-8e8c-1515dac4e8b4", "comment": "Malware payload (Loki)", "value": "5517bbd53b8965c79170d3c2b5e147856bf92915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717879, "uuid": "4325cd8a-9cd9-4532-8bab-980430ebeb01", "comment": "Malware payload (Loki)", "value": "c10f38fbf77c59c5e6d45ffcfcfc4eed2cc6841907b0fbbf832e7e2515b5ce94e490e036402a642ee5c44224fb200358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717879, "uuid": "012ef5ca-239e-4294-ad67-267888269dce", "value": "B1355BF4B798D961D02DC731C6604CF993E12CEB5B96A54C1BE8BB8D1E13F86CB19980", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717879, "uuid": "b56fe3ba-43ed-42e2-bfbc-5558b2134500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717879, "uuid": "bfd7ad80-45e2-4629-8cec-f58b7071273a", "value": "24576:r6PY7bFOBJrQrEF5jp2PAunXr9XSVN/REsT:hnXrqpEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717879, "uuid": "1be5f7f8-d0c3-4597-a934-9b806cbcaf09", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717879, "uuid": "513e96ab-cf64-4ab8-9841-10e1ffab1718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717879, "uuid": "30e38fdc-3b93-4687-8737-a26799e709dc", "value": "SecuriteInfo.com.Scr.Malcodegdn34.9306.9020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a69091-c456-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622716039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716039, "uuid": "38d58bae-5671-401d-a4a8-e6cdbfa9e54f", "comment": "Malware payload (SnakeKeylogger)", "value": "76ce9a17d2ec9ba7c2a59d5f20041eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716039, "uuid": "49880779-bf3c-45e0-99df-4519ceb4f78e", "comment": "Malware payload (SnakeKeylogger)", "value": "7e404cd96b6ef8cc9e58fba33ad4a306ad99765460e80e10ea417abffa9d8bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716039, "uuid": "2dbf1f4b-67e5-4f51-9ea7-7aa253a6df1c", "comment": "Malware payload (SnakeKeylogger)", "value": "6465c84bec2107dde580790468499d4744229c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716039, "uuid": "b1a22f6f-0c1e-49b7-a5e9-1e28250a1687", "comment": "Malware payload (SnakeKeylogger)", "value": "cf64570e189e8ccacee3fb12ebcb76aee3e81e846545209b15ab61ec4b77685a0fb402860d5e3b81409015160c44e2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716039, "uuid": "2e5dc3ec-899f-468d-9101-c275a961b2f4", "value": "78354BFCB6548C77C15DC73182424CF9A7E01DEA3A87A94C9AF4B78E1B63B8ADB45044", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716039, "uuid": "d844990e-d6d3-4d7b-884e-a1a19f0b30e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716039, "uuid": "1c8fa23d-4dc9-43fe-9c16-863516eaa8cf", "value": "24576:HM4pok2l3cpmn84IX9XGMFl0we3tGzURGe1vU:a3cpmCX9XGMFle92URRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716039, "uuid": "abd03121-cc43-4b1a-8556-9a0fd8ac22dd", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716039, "uuid": "5001fbc0-28f3-44e7-9bb1-cb00428f4341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716039, "uuid": "11c76da0-a651-4205-98fa-119349546e3a", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4115ae-c439-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622703617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703617, "uuid": "297b6a57-2a95-4052-b313-30166ae950f0", "comment": "Malware payload (Mirai)", "value": "41b362e9f51d2306a9798629b83b50e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703617, "uuid": "105be4d9-19c4-4aaf-89f6-fed0f217def1", "comment": "Malware payload (Mirai)", "value": "7e975df2a4a76a0249b81445eee7ff997ebc41eb4e792ab43241806eaa1d78df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703617, "uuid": "6763a9ae-27d7-4c98-821b-07c534e6fad3", "comment": "Malware payload (Mirai)", "value": "b6c3cab8d57e1df8cdceab221e91d78aa66c1a2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703617, "uuid": "b4b3ba40-e547-47bf-ae78-fc0133ba8dcc", "comment": "Malware payload (Mirai)", "value": "2de0069e62aa9ca613173077db08155dd3cd14cc0f473b8557288601c3431c0fb085cf0357421cec30cc7e0115f2b9f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703617, "uuid": "43ed0faf-f807-4e88-ae6a-7aa3ce5083fe", "value": "3BB33A4AFB808F03C4D51776BAEF42463323DB55A3DB73064918ABB43F8669E4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703617, "uuid": "0413c141-8a63-4921-8e95-9b836f0d9eb8", "value": "3072:qBcsxJRKdA8dMHQXKmzctNPq0mZ4bM/9g2msr:qBcsxJgdWHQXKm4NDmZkM/9g2msr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703617, "uuid": "a5ec1fd2-5e48-465d-88ac-ab4215cdc1dd", "value": 113954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703617, "uuid": "38c2aee6-c3cc-484a-b656-80b9781b5153", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703617, "uuid": "50d27483-d187-4837-ab4c-d15f53d44d4e", "value": "a.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5733292-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734693, "uuid": "49666402-5f91-4e2b-a150-430be5e422de", "comment": "Malware payload (Gozi)", "value": "b78e0049d4ff30a66626b47fa7cda61c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734693, "uuid": "db924306-726d-46d6-a903-ab1b1255a120", "comment": "Malware payload (Gozi)", "value": "7ebe09a1b7dee1a21922b654f752273085e0051e8a4f5a813a312c06d223c5a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734693, "uuid": "a78b7893-de96-4847-bd61-b715de54330c", "comment": "Malware payload (Gozi)", "value": "0ae6944164f9b3f0e9964faf5e6e59f4e1fb5cf2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734693, "uuid": "2480bb39-0ec4-4146-a6d2-531dabe64c84", "comment": "Malware payload (Gozi)", "value": "664e0af557b8f227d524713e95c8ca907d6eef19661a04f97baab3700a753c6045dec227f082629b7de9ae442dae4df7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734693, "uuid": "2407a7bb-18f2-4633-8e34-5b3027cbdd14", "value": "A6B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734693, "uuid": "7bc0caa5-db94-4ab9-bf67-9de59554b8f0", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734693, "uuid": "40a68bea-34d9-43c6-ac9c-bab04c4a282a", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvmqW6mZuzuJPjX7R75:vz75tzST8A+q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734693, "uuid": "c9050966-fb4b-4bf3-9378-5440d9fac5a4", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734693, "uuid": "27a39631-731f-4e2d-80d8-94b016f69c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734693, "uuid": "53f8e170-1dce-480e-8529-e5d4b284ae99", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be06e117-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713662, "uuid": "44c66049-8109-45ad-b061-f400034f3243", "comment": "Malware payload (AgentTesla)", "value": "092485ec615cc26fdfa832c9cf35d3e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713662, "uuid": "b8f5baab-c814-49c9-8ada-b097de53939d", "comment": "Malware payload (AgentTesla)", "value": "7f26dcc6924c677d848f4ed98bf7a52a0cdba84a22e5727ba9b9af72fb83bace", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713662, "uuid": "f82476e2-b1c4-4a9d-8afd-f7bdf5ad2849", "comment": "Malware payload (AgentTesla)", "value": "656a33d6d76c78c1c1e2f82af1b2aaf71d4969c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713662, "uuid": "5d87889d-4f85-41ab-be98-d91de5a6fbe0", "comment": "Malware payload (AgentTesla)", "value": "208eb9a9cfd73dff2017fe5e646604c4decc2df1d821371a8c3867847b44c436f90a1dcc924c844475a30c722c4bd375", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713662, "uuid": "ed6a4019-c41e-4f20-b5bb-aa16c51003f5", "value": "BC5508907F56C7BCED09D732AA195C798330A2A51002BF3C9FAD85A82E77745ABCC417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713662, "uuid": "6a7720d2-fa78-459d-9e33-21e47b96ee95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713662, "uuid": "15353631-fd20-49f9-a5e5-83e585e59731", "value": "24576:HPt3Q3TuFZyqTDiYiUkzXQmfCzn7Ff2nTPhK1I7F0:vZY/CiHUG9fS7dJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713662, "uuid": "4dafab87-34c4-44bf-b39f-034ad88a8682", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713662, "uuid": "faf9ed6a-be65-408f-8fef-72c06d4afbfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713662, "uuid": "c93747ea-3318-4045-a8c8-0a38ba5d99b8", "value": "SecuriteInfo.com.Trojan.PackedNET.796.18708.24064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9beedc-c4a1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622748261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748261, "uuid": "6f734873-aa50-4fb6-bb5f-d957d55988e4", "comment": "Malware payload (AgentTesla)", "value": "717ee3eb61e97bab2e57e3e7b88275dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748261, "uuid": "3b35add2-d13f-48d6-8e76-17e530116349", "comment": "Malware payload (AgentTesla)", "value": "8252ac25f576f23a6225b5bba0fc2936be9e3d1444d54567d672e40a81c8b819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748261, "uuid": "fece44ae-9bdb-4a7a-85c7-03fe588bab01", "comment": "Malware payload (AgentTesla)", "value": "b86d522afed94a79d1568cdbd4859b2f142bbc2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748261, "uuid": "1ed82113-262e-4200-87cc-c8d54166b933", "comment": "Malware payload (AgentTesla)", "value": "d824c03d67aba90ec532bf1cdca726fd93d1a148ab1317ce2e880c71c929f74363a8517243b1ee50444cfce887b8ef09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748261, "uuid": "20efc849-671d-4185-a7d7-d27ce163bb60", "value": "CF05392439FA501AB173EFAA8BE4B5E6DA6FB7733B07645D109003864723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748261, "uuid": "369c543d-669a-47de-9ad3-2c6787dc8efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748261, "uuid": "c7b4e405-c8b8-4ade-bdaf-2c8d09cd9744", "value": "12288:XqkLhxPO1c/gr0Opi2Yk8esacIjSDLAKXw/GXehoQKpu4OEW6teHBOIFssdsJ7hM:XXPau9OM2539Ihdho6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622748261, "uuid": "66632eb9-533d-460b-8154-d09ac71309be", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622748261, "uuid": "c2b45ee4-83df-4e51-ae03-ec5764bf2cb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748261, "uuid": "530b64ae-195a-4a58-9d2a-0caf2617b6d5", "value": "DENSCO QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a727f1a3-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734669, "uuid": "d5ddd034-0bb7-4390-89a0-ead40915de0a", "comment": "Malware payload (Gozi)", "value": "d592f2973e1bbd967ce0cc25602ca096", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734669, "uuid": "e93b36e9-9d8f-40c3-87ca-cc8f37057aec", "comment": "Malware payload (Gozi)", "value": "84c2f9ffa40a22ea7082cf9fa91c69f5d5428d616f30f7d4266cb9d74d106245", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734669, "uuid": "5f25e739-eeae-4d85-895a-b59b61ff7222", "comment": "Malware payload (Gozi)", "value": "ae0073b6708ffbcb3bc0d0b250c67b43618d0102", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734669, "uuid": "03c2392e-a3c0-4d85-b8f3-69fe4fff21fe", "comment": "Malware payload (Gozi)", "value": "e9a4f6e9cd4f7e9371e0cfbe57a47733a6c36591c829050bc7b13c656dc361cd74181014ddade918998e239f76bdab90", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734669, "uuid": "050be770-20fc-440f-8fd1-85b44c032182", "value": "F6B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734669, "uuid": "738d3cfb-dc3e-4c2e-9bf0-86cdd7acd9d5", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734669, "uuid": "52e2227c-6a39-4ccc-be5f-bf6b8882a0c6", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAveqW6mZuzuJPjX7R75:vz75tzST8A2q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734669, "uuid": "2d38048f-0dfe-4346-ae03-22648c60482c", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734669, "uuid": "988b5bd3-0371-4c26-ad93-a1711b20024c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734669, "uuid": "cea7866d-b4f3-4eb0-847b-90493ded2003", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cdd65f-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622713675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713675, "uuid": "2a2c4344-e3b0-422f-b110-608a278f6533", "comment": "Malware payload (Formbook)", "value": "d55470b20a6777f44e16bc3f7e4ea4c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713675, "uuid": "cda53641-b687-4d16-b75a-30e82dd3caac", "comment": "Malware payload (Formbook)", "value": "85597a179da53fce07aa53e2d061aa8628e717a3e550ea28d405772a58cded04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713675, "uuid": "954c9b58-f509-4eee-a412-482a3600ae25", "comment": "Malware payload (Formbook)", "value": "f828d93cd2e6275b79d46e3d2742446b3e95389a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713675, "uuid": "cb2cd928-c7d9-4c60-bc50-29b52d2b98ad", "comment": "Malware payload (Formbook)", "value": "217a4dc594de8cafffea9f09557b0af910049033c333cd930054b13aa628a070fea54b7a53b87547979f40b5d7f01fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713675, "uuid": "f578abd8-217b-4afa-8c12-8b2b33397d18", "value": "94F401D063085955C8AE4F7A58E256618739BF29AD83C30E6E8033FC3E773A18B57587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713675, "uuid": "ba776278-c6ad-4d35-855d-129c906b0211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713675, "uuid": "8549dfe6-30ca-461f-b0c7-aa757a0057f2", "value": "12288:BKLpx0a93l+FEZfoifa4pjrDIebeWI1NkyLwaIx4sZfaLSz7XqJlE9NVqesqA6g/:Ar0a9BZfDC4pLIeS1uyL10lZfaezbIEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713675, "uuid": "772d0724-e1a4-4503-b091-140fc1846ece", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713675, "uuid": "105b1647-a203-4106-9e97-a77a2a1cdded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713675, "uuid": "196da8c0-2445-49c1-8e13-88feae5f326e", "value": "d55470b20a6777f44e16bc3f7e4ea4c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f96185-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1622738209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738209, "uuid": "b7670a08-e6bc-4ce2-a669-3273f74bf3a5", "comment": "Malware payload (ServHelper)", "value": "aa80d5960e65ac46ad446c09c1a17608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738209, "uuid": "b36b5c2e-7843-4b67-abd9-1b8142b75acb", "comment": "Malware payload (ServHelper)", "value": "857ddc8de567afa19f5bc9236f6cf3681e46919530f90acc25ff36112564432c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738209, "uuid": "22e9a5ec-03e8-4d5d-a365-98de3434db2c", "comment": "Malware payload (ServHelper)", "value": "c2468b1792e5ecef461d2d89470e8438c05cce24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738209, "uuid": "d954686e-8c42-49bc-97c3-43974bad15b0", "comment": "Malware payload (ServHelper)", "value": "c0f0972376bd34e563792e6d62e5e62254fed88e911e36f6903f565ec68652d07a3163f43c1262b9ab01aadd220f7f8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738209, "uuid": "4c5ee5b2-a472-4e3c-88f7-d14ddfadc410", "value": "C656E012BCE218FAC57AE17098569B513A723CA483317BE32ED4B56D1A75FD02B3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738209, "uuid": "49b451dd-76c9-4a68-a092-3e00110b79b7", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738209, "uuid": "4673c308-2569-4e6e-ad91-58c90e2212f0", "value": "49152:qeJaWFIEavyT5gmuNLtw3vnHkqNhofom+RzWHvlk1rd4c6/3vXQLoUuLy9B6EINy:qVWFIJyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738209, "uuid": "b028256c-eff7-478d-a615-a6e73611f8f9", "value": 6321664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738209, "uuid": "3975dfbf-d184-4f26-a38c-f685d3485fa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738209, "uuid": "94a509bd-8904-481a-81b2-6dbf92301a9c", "value": "aa80d5960e65ac46ad446c09c1a17608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db761b54-c4ad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622753655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622753655, "uuid": "dd249261-a324-49e7-b4d2-20c48cfe39e0", "comment": "Malware payload", "value": "ee0db33e8375008c7fcb6f2dbe0996fc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622753655, "uuid": "5dbd5576-6cf8-4a58-8c89-b8b66ae15f87", "comment": "Malware payload", "value": "8709db8589ccaa0a1ee6e5cb2bafc9cd5f78e96b15e42767893e8234b9603d53", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622753655, "uuid": "970d9dbb-a78c-4d1e-a08f-b748b304af53", "comment": "Malware payload", "value": "79bd47374ebedc4505d292a878dfab56e183674f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622753655, "uuid": "e7dd5029-4774-4daf-89a0-e7b5d2d9e487", "comment": "Malware payload", "value": "9036bc8b3f128cb2c3423755193b4993bcd24ef993cb1f26fd6592afbef2cb195a51631b61138cf37304d7f3714dfa65", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622753655, "uuid": "cdd15dd6-47fd-478c-8b88-0429c31115cb", "value": "D2063326CFA446A7DC5F4530029AD7CF11246ED841E9787B1E2E8501AEE7F859B02EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622753655, "uuid": "91739f77-54d1-40d8-a9ca-cb27407c72ef", "value": "98304:wrjZ1EkaXjz7xQ1bigCRRe6RAI27c79AMD/bi+GGOp1TK:eaTzcbigyeI2wBAYmHGOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622753655, "uuid": "5dc7ab6e-8bd7-49a6-ad14-e516e51b114d", "value": 3877219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622753655, "uuid": "6e369975-b4df-481f-b52c-fc09f13d2ad8", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622753655, "uuid": "099dcaef-d857-4eab-9da3-11f67f5a5601", "value": "hibedestek.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a2645a-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734769, "uuid": "b5989dda-db6f-4371-8949-6584ce03a88f", "comment": "Malware payload (Gozi)", "value": "d500f60f598b4f245e99df02345ed148", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734769, "uuid": "93aaefd0-b665-4b4c-89ba-0e38682ecf0d", "comment": "Malware payload (Gozi)", "value": "871193097b82dfa586f0c8701bd7f9b533fda74709ce53ce7e06fa541221e8d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734769, "uuid": "5ffa1707-3699-4c89-85a1-6ee2b7a7116d", "comment": "Malware payload (Gozi)", "value": "6c2ae001df0ce96046f33a1861f067b4518df26d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734769, "uuid": "82d48e14-7aee-487c-9d2d-b38e651f0d48", "comment": "Malware payload (Gozi)", "value": "b75c97ff155347892e437813ee41c5e8482b0118ca5e3baa0536ccc884854e3ffc6419e8f729c4287dfa907733841a64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734769, "uuid": "45dc728d-cad9-43b2-9bff-cd0b06905253", "value": "13B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734769, "uuid": "dd421918-84da-4b93-b20d-c4796497cfbf", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734769, "uuid": "36bb2ec1-99d2-43b0-8cac-525fdb5833dd", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvnqW6mZuzuJPjX7R75:vz75tzST8Afq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734769, "uuid": "022ec343-f01a-41ae-bc79-e6a92bac18b2", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734769, "uuid": "c210ad5f-88c0-4f73-8570-1dbb79bb4290", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734769, "uuid": "bdd74e9f-2a5a-43ea-a14e-1c29ac0f1c29", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b9e15c-c44f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622713081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713081, "uuid": "8f637ee2-724f-48fa-a056-d008c03009c9", "comment": "Malware payload (Loki)", "value": "1078b887591458d119b5251bf376b85d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713081, "uuid": "c5eafc2a-007e-4f23-8e8b-fc9d923e2ea0", "comment": "Malware payload (Loki)", "value": "899b47b9275d51d5f7b517337e011fea0f19629b969ff9dd85a1036e8f39dc21", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713081, "uuid": "2e4054ac-9aee-4412-876c-e94833c181d6", "comment": "Malware payload (Loki)", "value": "543906076e1d5d51524b77ee0b31e60fb2db856e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713081, "uuid": "56ea1ad6-2172-4dd5-aba2-853d6a6c6f6a", "comment": "Malware payload (Loki)", "value": "bea0146e75f3d952ba56e398b7583df9b1cf082b9a525bfb19d6d89d53bdd6f74f8bd5852c41da70e9e59cff2bca3b97", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713081, "uuid": "63b9307a-0221-4eb9-b8dc-ff99ddc74810", "value": "815533296ED48B1BDC578474582B4D060A7D9C417202E82367AD7F0FA53ABB84793F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713081, "uuid": "cb9cfc7d-fbb8-4cb7-843a-385e1fa0734a", "value": "24576:ib04ocee3zWj1Q8Xv9kgQmB6/Z2Tt7wsF0NEuG/j4jUWxx:xe3zW1Hfi/iQ+tUsFLuE44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713081, "uuid": "24c17712-09bf-44ec-a73d-cd840af0c06e", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713081, "uuid": "e28a6018-efa3-4f3e-b8dd-d5f8a6f1f144", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713081, "uuid": "aa705b86-ce94-4002-9500-59cc44324700", "value": "invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ae8b33-c475-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729268, "uuid": "04897025-9e31-4b4e-98f0-d16d74239b37", "comment": "Malware payload (Quakbot)", "value": "240851be8c73117d150f88a6290a54dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729268, "uuid": "e38500d8-052c-442c-a3e5-0e1118e47edd", "comment": "Malware payload (Quakbot)", "value": "899cd5353d64f74fe42928858ff88ed62c0a3b3e54110e62ec579bbce2ee9c3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729268, "uuid": "8504a7e5-0f56-4a54-a6c9-1cd77f723c14", "comment": "Malware payload (Quakbot)", "value": "09073e368abc263cc82e675e86e6fc88ffd40c37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729268, "uuid": "c5cf229b-28ef-4124-9f17-88e061fc6a84", "comment": "Malware payload (Quakbot)", "value": "ee7f8b5384b8e5ba9b89f2fdf5fa313259da40a45e985958c421bcd771fb5eb97dda523c72b010871236d2ba182e59ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729268, "uuid": "d7ca1a77-85d0-4844-b95e-958cf9d2206f", "value": "2C059C81B18AED76D1600A343A89F5D5475CBC050FAD299F77D42F8F6B381831A287BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729268, "uuid": "fb3fdef5-4efc-49fd-88f7-740a65aaaeba", "value": "dd1715b296a45da8514656949f8428f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729268, "uuid": "a0f652f8-62f4-4dd5-90eb-bb25a53a47e1", "value": "12288:WvanFwICa+kqQQuOXoVo4DojSHSz2nAu41SeT0Vrh3JMj8CQyvYOLQMOGBeuI:AaFwICpFQQNUezTrMeYh5+YOLQLse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729268, "uuid": "37622b11-2e4f-404f-a4b8-76cea50293c0", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729268, "uuid": "605757d3-3404-4732-be9f-f84c3f2d2429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729268, "uuid": "9f6a2d0c-c223-4a4c-8c3a-88dddac4bbaf", "value": "240851be8c73117d150f88a6290a54dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431d90a-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622724813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724813, "uuid": "bdc85575-1474-46b4-b730-b4d2413b7ff7", "comment": "Malware payload (Quakbot)", "value": "a3fb3af5569f54615f09288f206db895", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724813, "uuid": "17c33fc7-0f77-4fa9-9fd0-a079ee3bb77a", "comment": "Malware payload (Quakbot)", "value": "899df3d7c6bbee748a466b90794e3e223c413268d7ed76b6e80bb3eec3d1c9ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724813, "uuid": "6db463d9-d13f-454c-be4f-07c65138546c", "comment": "Malware payload (Quakbot)", "value": "c077f2de820ac81fc0c1e49462307798c07892cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724813, "uuid": "8bd83b5e-6e54-4f0a-8964-1a287da99873", "comment": "Malware payload (Quakbot)", "value": "250307c46ca182c264f09642c1171e2490ca2511991db0cce2c7e04a5504deae7b4b21e1b541505b13381a3841acdac3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724813, "uuid": "a1182fca-db5f-4c3a-813e-b1b6694a8abb", "value": "F0454B01B694E435F5B60AB96AAEF0E8562D7DA00F5D50CB73C02FDF5629AD19C3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724813, "uuid": "040d36b1-a8fe-40ba-aa95-f26b9ff80531", "value": "6e31f7ef3a3092fdc488764688222205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724813, "uuid": "fcdec1a1-0a90-48e1-817c-e1760bd1a044", "value": "12288:nmNDiDQ21Elifgbhc5ZbqWDyALUvNi8KaEIgBteiDqd+Ci6T1l84A79hbi:Mek2CBhcbL8vEnrnZC1Tz8r79hbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724813, "uuid": "46792342-e903-4616-af0b-15bca7bc2884", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724813, "uuid": "2a731f88-8677-48a4-9df7-06ea0de97394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724813, "uuid": "fe38359b-7681-4fe9-ae11-215df8ba631d", "value": "2969281.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f540a5-c430-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622700014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700014, "uuid": "15390bf8-6ed7-4905-a81b-bdac15e04b14", "comment": "Malware payload", "value": "7260bd4aaa38dfacaf093fb2ac23b65f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700014, "uuid": "ba7d4bb7-81b7-434b-9337-b6932eb26c34", "comment": "Malware payload", "value": "89a642dd4ca4091be3f29bbc9226e5fc53933fa9004b36e4424f18dd94053615", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700014, "uuid": "15ddb805-b008-4e58-b1fc-ff4e65f816ae", "comment": "Malware payload", "value": "f9a3109abfb02f84f9bb74d861db438a16595c1e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700014, "uuid": "708597a9-fe90-496f-aa34-e2ddb7842da5", "comment": "Malware payload", "value": "9a05f4746343420691b2fddecdf2f2dc58dbcbcd9ab9874470098113fdd8864ca8c3a2d4227a8d76e90ce35667ee40e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700014, "uuid": "ff311596-287e-4d13-a2f7-e3da3f6386ee", "value": "D9141906E8444B2BC2D367BAF75A52CD37361FA95BC73316DA287C702BD0B592A3D190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700014, "uuid": "a0fdfff6-dc2f-4f80-9afc-f398883b7a0a", "value": "6144:pcYSBrWxvqRxetJ8addQtVrRNPhZlQsgIMnJCH:pTaSvgetJ8aW3NPhZlFgIMnJCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700014, "uuid": "f1f06657-7407-4a98-9df2-17eb120ba745", "value": 205334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700014, "uuid": "fec7c63c-31d9-4ab3-ac09-49987c9938be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700014, "uuid": "d6ad4128-ff42-4399-b455-c3e1389eef4a", "value": "Voltage.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f28a0ea-c4c6-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622764184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764184, "uuid": "d6c3266f-6a7b-4173-99da-b4c4363aea37", "comment": "Malware payload (CryptBot)", "value": "8d93b4ca20dea336647b556294a36ab4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764184, "uuid": "65efd385-65c6-4c29-bfa9-a1cc72576de2", "comment": "Malware payload (CryptBot)", "value": "8a76004d1a369fe370c6427a17869a59844c131ac485ac7577a41df8f61d13f9", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764184, "uuid": "5614de14-89a6-456e-8a45-5db4a99930ff", "comment": "Malware payload (CryptBot)", "value": "f4c3c4e89f53676b7b88280fdf37dba5a237d047", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622764184, "uuid": "61f14771-ca3d-42e9-a043-502816b6f1d2", "comment": "Malware payload (CryptBot)", "value": "b3fd35eef2aa3f7c0ce3d26ce44a99dfb50c2a1a6463aac99e3e5294cb6fc4304b5c31bf0ea783d3f899b15377d72a2d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764184, "uuid": "8f144701-106a-452a-948e-0abe2786f967", "value": "8CF4F110BA90C035F1F352F44979C2B9A63A7AE1677854CF62D067EE16B4AE1ED31B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764184, "uuid": "886606e0-274b-4549-8935-be8a5194aa68", "value": "cbeae8361a19a91fa1242808c9b08b0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764184, "uuid": "e6324104-4778-4f34-9331-be89df748a53", "value": "12288:m61wmbyuTZ0anIHW+JiU8IPH5mP1PmCPVcLBYECp72k0DVBb4J9P89a9e3Cqp6g+:m6DuqZ0H2ckIPZmoBGnKMJO3Ctp4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622764184, "uuid": "983ccd6d-0e79-47b2-9fa7-d58eee5f83b5", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622764184, "uuid": "5e80e789-c276-4e07-8172-00e03a7daee9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622764184, "uuid": "f58230e6-11c4-44a8-9bbf-984778a8ae61", "value": "SecuriteInfo.com.Troj.Kryptik-TR.832.4367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97de0750-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734644, "uuid": "3704318c-9681-4ce9-b76e-c0111ff01bf8", "comment": "Malware payload (Gozi)", "value": "7baac8ddbdcdf8e60b4a2d91fa6e1bef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734644, "uuid": "f61c4e38-d46d-42b3-85c3-3241f956693b", "comment": "Malware payload (Gozi)", "value": "8b288921b1564824348d566efea90f5b3915a37d0e3b8a2a3e0a95299013890b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734644, "uuid": "bbee4bfc-798f-4920-989f-9b59842dc50c", "comment": "Malware payload (Gozi)", "value": "7ba908347f36deec45bff3c5d61de26333598636", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734644, "uuid": "1d4086c9-21c3-424e-893f-2ba0494139a9", "comment": "Malware payload (Gozi)", "value": "2681878fab992d3fb967a00dcdc0885f869c728d11cf6e726920d477e7a8085eaf0a4fc018de37cf588e418672a457c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734644, "uuid": "4b6dc140-c050-4d9f-9dbf-2aed70ba4451", "value": "FEB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734644, "uuid": "b2b778c8-6ed1-4331-8cb6-86142084a8b6", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734644, "uuid": "ae19bb43-ec4b-4982-8f7b-cd04fbae8870", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvlqW6mZuzuJPjX7R75:vz75tzST8ANq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734644, "uuid": "1e886aa1-50d5-4a4e-a802-ca2c9123127a", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734644, "uuid": "87dfcf68-e848-448b-8bac-da32d4b2fed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734644, "uuid": "40eaa03c-9b75-4383-bf8f-2004e65ec210", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0225a88-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622714579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714579, "uuid": "4c1f7f46-0cd9-4863-bdd5-6c782321f188", "comment": "Malware payload (RemcosRAT)", "value": "1ebd267f990c03f0cffa9355a28ab48c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714579, "uuid": "b243ac40-c517-470d-b153-9ddafc84d89d", "comment": "Malware payload (RemcosRAT)", "value": "8d412a4c1f64570ac98ccb0ec55d80ae36e97b8c5d6ab544b0802f9e91458449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714579, "uuid": "c18756f8-ec4d-4fb1-b704-d104fd09cef2", "comment": "Malware payload (RemcosRAT)", "value": "65bf072360c5d77784248561fd597d437d728139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714579, "uuid": "4a46c4c6-4be5-46fa-aa7e-71f6ed720c22", "comment": "Malware payload (RemcosRAT)", "value": "b411b524c395f328b9427970b767ae645bd6cdf1e0a2b0d0ab09c786af04704dbd85694e2d0df9927377f5f4850d7e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714579, "uuid": "7ee4efce-a537-43b1-836a-e9f6a238fdd6", "value": "ED5518D07F54C3B8DD49D632AA145C3983B0A2A960013F3D9FDD85A92E77B45ABCC42B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714579, "uuid": "07983478-5356-4cff-a482-1dbc3281f860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714579, "uuid": "0289240d-b864-4953-b00d-76ebdfa07c91", "value": "24576:EAAsKd6zrZyqTDiSiUtiAvoPuvQFMYZitlUXso/17MWilz:ZFICi1Uo1PuYFMYCksOIWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714579, "uuid": "3a39277a-78af-4c89-a8ae-90b9fd71d2fe", "value": 1408000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714579, "uuid": "dee45562-299e-4cb4-83fb-2ea6154703e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714579, "uuid": "63b7740f-7d8d-4e5c-adc5-46f398e34cff", "value": "1ebd267f990c03f0cffa9355a28ab48c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328e4789-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622713858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713858, "uuid": "3501918c-3926-4051-9440-1993efcc55e5", "comment": "Malware payload (Stop)", "value": "7926aff415a7b205a816db0ea4bc54d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713858, "uuid": "3dbb3793-7641-486e-b9ae-c5de36dab4b2", "comment": "Malware payload (Stop)", "value": "8de1c803e333135d44bccdc6d357a6a25c60aae00a95f36d827c48142eb1c1ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713858, "uuid": "f5eb53fc-b7c4-4b4c-848d-676b1a03c488", "comment": "Malware payload (Stop)", "value": "201d18be2749c275ed1766a1ed872924d7f10486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713858, "uuid": "46333725-2656-45b3-87d2-c2306affbc0b", "comment": "Malware payload (Stop)", "value": "8336dcb7035154bd712c20b3e9849f7acf86083d2f34b9c8538f61beb5db156b90e4cfd324a3f4b9f77eb7d5d8e0a0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713858, "uuid": "52dd98b0-b68a-4965-820b-7eb84b2a53ef", "value": "4C15F10067A0C034F1F656B4897692BFA53AFDA17B6490CB12D426DE3A35DE0AE71F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713858, "uuid": "3c435e45-9272-496a-8259-1e962a5fefc0", "value": "ad8bd715488c60ebd0287d0239f0c2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713858, "uuid": "0c246aae-5065-40d8-8c8a-63ac868d6825", "value": "24576:AN75PD4Msfl2+ZgZGkw+VDm77NTzeJbOcOfcQT:Axwl20Lkw+VSiicTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713858, "uuid": "f9c84579-5b72-40b4-98b9-1a6f57359e86", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713858, "uuid": "4b4bbe20-344f-45db-8651-90ee7ef4d9f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713858, "uuid": "7f2b585b-b85e-4ce7-af59-92b7c01dd902", "value": "7926aff415a7b205a816db0ea4bc54d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec1ae5a-c448-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622710228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710228, "uuid": "539f4b20-cafe-45c2-bf9b-8bb1c8f13b46", "comment": "Malware payload (AgentTesla)", "value": "4870160002ed13d1664b579e2134367d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710228, "uuid": "86687a6b-9729-4224-9c10-cfeb1fd0da18", "comment": "Malware payload (AgentTesla)", "value": "8e0eb9de7614d5f266b4d4ecb1e7af79630c6ea4f52d2090092b00ab547091b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710228, "uuid": "de556217-02e0-4870-8eef-bb0169d9a8a5", "comment": "Malware payload (AgentTesla)", "value": "58975d5723ff7ca7fe807cfbb8288217c01c1449", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710228, "uuid": "f5580540-32e5-46db-b9e2-8899f90db6a8", "comment": "Malware payload (AgentTesla)", "value": "5f97394822c9cdff068f074b7bc24f57fd9816548d5bdb66dc141f01ce5e32c1ba7da9f15e23c187d839854415ff77d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710228, "uuid": "b03eeb17-17f0-47bd-8230-6bdb777ffe8f", "value": "FB456CF4B798D960D02DC731C6204CF993F13CEB6A96A51C1BE4BA8D1E13F86CB59981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710228, "uuid": "0b0e1a7f-5116-4842-94c3-b51851694bca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710228, "uuid": "e985e307-33f0-44f5-b874-77ebe7c61f44", "value": "24576:7MY7bFOBJrQoEF5jv88ZMBnLhIhmlF7L6093tAkG/gsS4N0OHoKWsjxvyH:+nye1L7dAkGw6oIyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710228, "uuid": "2c6bbc46-cf75-4021-8700-6fb4f090045f", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710228, "uuid": "849bdb4d-1f77-421e-a313-3abe224e58b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710228, "uuid": "235a6571-c3ed-4b5a-a982-c5053c8a507f", "value": "E8aAJC09lVhRGbK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8e301e-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622724694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724694, "uuid": "44178415-ccb1-4743-bc8f-cd2f0199d504", "comment": "Malware payload (SnakeKeylogger)", "value": "1416d425b0ab8f3c5379c44303274a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724694, "uuid": "2a94be57-0694-45ec-9d31-04c5f788b5c1", "comment": "Malware payload (SnakeKeylogger)", "value": "9220e60e98a443efcbe7a7d9e73f8ec7d04100d8c1c03a2720579bee0e33d37c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724694, "uuid": "82ad5bff-5246-4c39-8ec8-edde3667396d", "comment": "Malware payload (SnakeKeylogger)", "value": "f9b09b32ba2f7bdb8e187d423c325762ddb6b3c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724694, "uuid": "7420f413-3e27-4ae1-9c57-ab3e8f6cb5b9", "comment": "Malware payload (SnakeKeylogger)", "value": "18aac9fd9d39e0d38cab99d263ba0bdbdcf07c74a7da4f789580b4dd429b2d440fe98a6b7333aab7f632fc073d388eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724694, "uuid": "de6428cf-6a4a-468a-9e23-e09e06358577", "value": "7F156BF4F1A898B1C54DC732C690DCBEEB215EFE5243092C05B9FA8D2A3379A9F58445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724694, "uuid": "0f0e928d-f722-43cd-9e3c-e485ea977a28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724694, "uuid": "0b78911d-adf3-405a-ac8e-37c0149f9f66", "value": "12288:OjveBvTk026YHyhUWzPNVOsmIajxkTC63s3z6MVwTfru2mjqOEO:Gey6qyh7fOsm11kTC6c3ZwWGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724694, "uuid": "3ce87a32-3150-48ae-8f32-a9cd3e1782b4", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724694, "uuid": "a596c20a-4036-43e3-a57c-b2499468c193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724694, "uuid": "8d664394-c124-4fd3-941a-3294ec20082c", "value": "Haftal\u0131k Piyasa G\u00f6r\u00fc\u015f\u00fc ve Fon Da\u011f\u0131l\u0131m \u00d6nerileri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f547664d-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622713755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713755, "uuid": "e54e417d-3864-4adf-a672-5006a37fa5a4", "comment": "Malware payload (Stop)", "value": "a11bee4c07272d5d5f98b064a0fc58ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713755, "uuid": "10fad147-86f3-49eb-acd2-753b8388d9ca", "comment": "Malware payload (Stop)", "value": "92c886fc39b43b7615f88fe7231e1c1f85af2ff8daa44374e351265cbc81041a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713755, "uuid": "92485fe6-c173-453f-a579-ece134df80ee", "comment": "Malware payload (Stop)", "value": "e1739bc98fce9f772ef7d8d84ac1198b1cf0a5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713755, "uuid": "791ff5c1-2a4d-4f52-a047-9c205e2c9293", "comment": "Malware payload (Stop)", "value": "365731e354c6a4b86558d472a5f6d96f162fcbf88d1e9275a1fb960a8ee1c0853aa69554b562a97ded47f875cad01468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713755, "uuid": "850e2853-74fc-40e6-b72d-78820f7809b3", "value": "72457DF4B798D960D02DC731C6604CF9D7F12CEA9A96990C1BE4BACD1E13F86CB59881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713755, "uuid": "7e194ae6-7c0c-42a3-92a1-8f26acd7a95a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713755, "uuid": "42e1733e-f27b-4e9b-bd06-0a4ff42285d0", "value": "24576:lu3Y7bFOBJrQcEF5ju9CsBngv/DM9q1dmmLkB9e24:mnaFdBoB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713755, "uuid": "a4545a0a-1cfe-49d3-a1f3-37b0c9b4c106", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713755, "uuid": "fbb25139-bc3e-423a-9596-f9c7696759cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713755, "uuid": "5b098299-4dc7-4f44-ab3d-d7d7ff9d6bf5", "value": "a11bee4c07272d5d5f98b064a0fc58ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a0a690-c42d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622698557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698557, "uuid": "1ad9432b-7b78-4321-b57f-cdee34b1d75b", "comment": "Malware payload (Formbook)", "value": "5514a879b79164cb55e20526350417d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698557, "uuid": "14966723-5fce-40f9-89e1-b6e3c4deb3e5", "comment": "Malware payload (Formbook)", "value": "932d535ab92b682eff0f74322211abd760021a9003d18b953e7226a6ebc38902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698557, "uuid": "197aba44-9041-45ed-b146-ae07c63b40a1", "comment": "Malware payload (Formbook)", "value": "3fd6d7dd2bf0f35b7fe42ce76d9107825ff8f7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698557, "uuid": "278237f4-aafb-49e8-afa2-a85896a50c5f", "comment": "Malware payload (Formbook)", "value": "77d10d2c79342ca22b08be3af632461cca35bd7fd18d494abd7906f846c3be7f6934b528f0bdcdac2b3971e8f4401565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698557, "uuid": "4137dbe9-c0e3-4acf-a6a4-7f817a3aaf03", "value": "0434120A2AD7A8FBE74645320473E323E57253652A74176F2FA01E715E748CB4A3E783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698557, "uuid": "2fec3cc0-6f32-49fc-8f6a-92863d36e604", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698557, "uuid": "79f17b81-c868-404c-b6c1-f587e09bb38b", "value": "6144:8Qq+WQjeNwOMxafWK0ky0rFPvAP55ju3UmBTThp:TWQKNfmaA0JvASN9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622698557, "uuid": "2de6ddc1-1105-4518-8091-c9d2331d6a6d", "value": 240535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622698557, "uuid": "f2e1e62d-b7fd-4faf-a610-4aa88e2e174e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698557, "uuid": "154afefb-d514-4972-bc29-6a2154d8ab52", "value": "SecuriteInfo.com.W32.Ninjector.J.genCamelot.16652.5411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16851124-c48d-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1622739581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739581, "uuid": "af28dde7-f280-44d6-9fe7-93618ea23735", "comment": "Malware payload (STRRAT)", "value": "5a2479c9909378ad9bdd7e7306234bd2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739581, "uuid": "2acee031-ed64-4e86-96c2-45008eae7a56", "comment": "Malware payload (STRRAT)", "value": "95363884cf0cfa8a086cd09714ec1825469f2bfae513e908ec2ea1ffb4215143", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739581, "uuid": "dd896f43-6ad0-4e6b-ba20-e178c2e7279a", "comment": "Malware payload (STRRAT)", "value": "3516e0b8783ad3aaf5fdedc8d2d764d4994962e1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739581, "uuid": "f123c9a0-311c-4877-b2f6-da3a74af5301", "comment": "Malware payload (STRRAT)", "value": "ebc25c9b90bda7a207c93e9cf426c48ede4bbe32a5eac10c85f511d108b9b769b014b468681872e4c9a66aef84204f96", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739581, "uuid": "46623b28-12f4-4120-b09a-da2a4f523dd3", "value": "A8B3D02FBFBA82E1E01F817611488537F64D42DAD152A12F6AFC59060E71E6E4B136CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739581, "uuid": "7f6f2274-2c24-442d-8858-2369271bfe22", "value": "1536:Kn/Q9D2Gb8nrKbkEpCpii4ryVn0t1waoHmJclCeqSuHvO/drH6yyo34tYttmFEnE:Kn/Q52U8nrSCpi60cjJl+P0l6u7FOrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622739581, "uuid": "ef528c2e-bc10-437d-a7b2-67905f83d31c", "value": 107483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622739581, "uuid": "f2b8aaf8-c253-422f-b86e-603b872185b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739581, "uuid": "dee67cd9-da60-4532-9a80-d8d1cc394e6e", "value": "SKM_C250i21053109570.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b33af6-c45e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622719427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719427, "uuid": "a03b9e91-911b-4e94-a727-55bf62374342", "comment": "Malware payload", "value": "5b8bbbd04652a343bf5b0123193b96ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719427, "uuid": "edd9eae9-e18d-4c6c-a6ef-be72adc5fe24", "comment": "Malware payload", "value": "965abc1014cad586b2e63cab6c7a0f8a4d33505c46d47eda4750b48c5af8adac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719427, "uuid": "1cd96e7b-3ba7-47d0-8297-9794e31937a8", "comment": "Malware payload", "value": "5a41b4d704349d2d39ed499ab3b8768a9b59d620", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719427, "uuid": "5570db74-dcfb-4eb9-a040-d8607159281f", "comment": "Malware payload", "value": "9352fdca303b9a48a544a9acc17cf4f84e17a084950c89f4df4edc4e98f92da713da8edfef9c25df4812f8c7f8a16c60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719427, "uuid": "c5cf64b5-3939-4c8e-ae60-6db75048914a", "value": "44C5173C7811AD71D05AAF333B14F82074654DFE98A948AC9935DFE53DA9BBC28AD0C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719427, "uuid": "cb1c2f4a-87a8-4c8d-8461-7dc812775465", "value": "9744d86ebc8fecd98d641ae6ef121af0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719427, "uuid": "993bfd3e-867c-4673-a3f8-c4bab6f9d80f", "value": "12288:OpsAWv+libRJ6GRB5uLyuaukuCA1vq+3W7FaDgag8+dwgh+5Dno53JOJc9:OGPcRDga7+dwg7Zyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622719427, "uuid": "da5b4206-55a9-47e7-953f-ce9ff6e6d6d5", "value": 2705920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622719427, "uuid": "4cef5d08-20ff-418c-b93e-12e47b5535a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719427, "uuid": "8713ff0b-de53-41eb-bd2c-e285dc1e625f", "value": "965abc1014cad586b2e63cab6c7a0f8a4d33505c46d47eda4750b48c5af8adac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5023b2-c467-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622723348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723348, "uuid": "b204e967-997e-49b8-a067-170a524fe07c", "comment": "Malware payload (AgentTesla)", "value": "502f91f5c9aba5cea7157841a4f5cd4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723348, "uuid": "c169dabf-a243-469a-a470-7c1c7b9c5566", "comment": "Malware payload (AgentTesla)", "value": "9699f6623a555a81905b77679dc69befbd87063400029277ad651a316abf21a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723348, "uuid": "658a4e35-4073-4aed-a5db-6d1d5b73da8f", "comment": "Malware payload (AgentTesla)", "value": "c47522331b3d86ad2c6a498167ed314e8e73167c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723348, "uuid": "24ee9082-3cb4-4922-80ab-cc09faa0ed0c", "comment": "Malware payload (AgentTesla)", "value": "017ceaa71f1cf79e21727463e204ba8e2332f396b50d06ee38c479f0fcfe6ba0b49ee0230f64a95ace347c77c69f547d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723348, "uuid": "721db093-558e-4e6c-9d8c-d9cd48ceef23", "value": "F5D4E012F2A48A8AE0145F774765D9010B743C537829C73D68A636EB48F2BA3166FF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723348, "uuid": "6207568c-374e-4a06-98fa-6d22bf3202a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723348, "uuid": "6651a32e-3cbf-4222-933f-e3b601cf9fc9", "value": "12288:0V+mp8+c84awvPks4QQxy7CYFe0zEAxrhAUNlAcFge:2pp4JnkFQnbzEkFFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622723348, "uuid": "76b6c427-9edb-42f7-8bce-cc7247c1f6b7", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622723348, "uuid": "68b8bc6e-856d-4b39-b5e3-b6129f216392", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723348, "uuid": "30dd1c4a-a36d-4a02-895f-c7ddf83dfaba", "value": "PZz41HFVhgHgaBa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7767925c-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713973, "uuid": "444d2518-206d-4f10-b3e0-8a4196a1b786", "comment": "Malware payload (AgentTesla)", "value": "4a6d4f7e8a406a92228604f076758e22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713973, "uuid": "20597521-1f0f-44a9-8367-7af7817ce7c5", "comment": "Malware payload (AgentTesla)", "value": "96b067e320b73d73d44df9a4ccc7041deec2059fb26a2efa50a877a528ada172", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713973, "uuid": "9ac3d9dc-b15d-4651-a208-ea1ce98f40e4", "comment": "Malware payload (AgentTesla)", "value": "c2662cecfa450cbf989aedb820cc2dab02b8b1e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713973, "uuid": "3527e345-326d-48fc-813c-5e8af45dcc4d", "comment": "Malware payload (AgentTesla)", "value": "81073a618f2fc542acaae9117380916aa34f138cba78aa6d5cb05a70745d5e2beebf599d4a4d1b8a88e9b08d9e91b544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713973, "uuid": "a4aa71ad-29c3-4fba-ab97-61ab31603b2c", "value": "CCC4E121F2B48B8AE0185F774774D9011B743C537429D63D68AA71E744B2BA32A6BF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713973, "uuid": "ddbbbf7c-6fd6-4a28-8da2-76ff07df9056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713973, "uuid": "3d7cba92-12a4-4553-90aa-6e35e5433116", "value": "12288:zYSmz51mcMxbuohE43roV1yR/7HlFmdfjHKpMFge:gz51mckb73rO2zHlFmRjjFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713973, "uuid": "0541db1c-c606-42e0-a9ab-b0474440c696", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713973, "uuid": "ec7df79b-b558-47d6-a4ea-24aec77fcc66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713973, "uuid": "7001ef34-4a2a-420b-957e-e63d8cf31ee0", "value": "4a6d4f7e8a406a92228604f076758e22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ed3b93-c476-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622729861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729861, "uuid": "61bd0ac5-2417-4d04-883b-d136e2b24bae", "comment": "Malware payload (AgentTesla)", "value": "82111e8d64804683a77e56d4171453c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729861, "uuid": "56ce6c92-6b0d-4a04-a594-36369f2c9ac0", "comment": "Malware payload (AgentTesla)", "value": "971cbad0d6aa786edc401fd9525336bd3f2d1d6718b3290e93b85458d3e34401", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729861, "uuid": "dc8452d8-3949-4546-b73c-83ddd013780c", "comment": "Malware payload (AgentTesla)", "value": "f5475d7f6d4111e8885fbc94b4ea95a4645d7203", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729861, "uuid": "95496036-9618-4683-9f81-b9c6ad534e56", "comment": "Malware payload (AgentTesla)", "value": "4fe623a306e08791f5bb60d93d88303b146eb4b5760956e9c36ad59095a27eecd9c22fae16e761d8d1bd6c22aefc9f1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729861, "uuid": "854b1677-a85a-4c32-aaf4-4457b1755283", "value": "8184E126FA54DCA1E4179C702022A877CF315F1131AE9D13F3B6BB6B5029DD1692BB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729861, "uuid": "db955875-dce2-43e6-ad6b-b61b8488e8dc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729861, "uuid": "fa5b4365-aabf-49ee-a9c9-5126d9591848", "value": "6144:KQqDxcBdXw7SOdM/1TryLSKFUcEzuAA8Wrh34K0B8OMhip:QxcBd8AXoSKF3QuA1WrhV0GGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729861, "uuid": "5cd824ae-19dd-447e-baef-8f98d4bb56a4", "value": 377165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729861, "uuid": "6c171836-60dc-429a-979f-9aa60d072a8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729861, "uuid": "7d1925c5-5e3a-4f62-ad73-6eb800f4a043", "value": "090009000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e712c32-c438-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622703194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703194, "uuid": "71f5773d-7da6-4cea-a51d-b23dd06dc7f8", "comment": "Malware payload", "value": "2bedb333df65ddbb280436d2f2d36a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703194, "uuid": "6c3b2a5e-ee67-48e7-b2f7-9c7ba0674b51", "comment": "Malware payload", "value": "97769629d5e94f4df144495d4a7bf4d691c739e1ebcf26c75c65ed2b3574e913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703194, "uuid": "2682125c-4426-42d3-923d-6c996713b446", "comment": "Malware payload", "value": "d81242a037e082b3b45ab383b9121a1da2c7d8c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703194, "uuid": "d6bbf282-629b-4ce7-9286-d97272967406", "comment": "Malware payload", "value": "c646ba9a861e12e8549ba501928e8ad242fa46c4b4a02527b61b1073680b97af1a914be09da2d98ad73edadd547bfee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703194, "uuid": "c08e63ec-0077-4b4d-bb2a-23f6c05d76ff", "value": "A734F1C75ABA199CD06E1FF760EF811447B39E21287ED609BA35723672737DD28203A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703194, "uuid": "10449147-a0e2-4227-8457-73932bd7c0cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703194, "uuid": "00da0b70-fa2c-41e6-90ff-ef2c1933c638", "value": "3072:SPbWkCVtlrY/AveWQdsIKp3KYff1iMQyv1WBGTfW9YFz/YsYVySqBfCrql+vJ:SK7tCoeWEOKYff0h9gTYNVySfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703194, "uuid": "e859048a-974a-4658-ba0c-f285b60cc55d", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703194, "uuid": "082ecfe1-f140-4d99-bb3d-082ce77c9c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703194, "uuid": "00d1eb27-4d86-44d4-9ee7-3a41448cee54", "value": "ConsoleApp5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0e6ede-c453-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622714733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714733, "uuid": "270da29e-0e3a-477e-8eed-7eda94732469", "comment": "Malware payload", "value": "97e04e7498f51014e0745cec9e85cea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714733, "uuid": "ed14b658-676c-4069-a096-3a1f4790e3e0", "comment": "Malware payload", "value": "9803a9ef11eebdd87b948f892924c8cba93fdd62a303e85cc9fb5e0438c532b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714733, "uuid": "1f17710d-9c19-460e-8184-47dc27b740e2", "comment": "Malware payload", "value": "4603f52eec487e7de45fb90a03217f50e13204e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714733, "uuid": "da52c2a2-07e5-4ed7-997a-494756a82613", "comment": "Malware payload", "value": "b7b6082f69de626a751e129ccbc0023edf7fb8838923fb3a45694bdfbea50634e768c1956b7ec8aa0d7e917ea13978d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714733, "uuid": "330fa673-fe01-4d3a-9a67-582ea610d30f", "value": "D956E001FBD2C1B2D99301B509AA932E4579EA1407309FD7F3D82F1E5E316D1AD3A29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714733, "uuid": "3d4151d3-2f7f-45cf-a493-b8e2851604e2", "value": "ed4a0ca4fd3f32bbc458559d57cc9816", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714733, "uuid": "a6ebdf02-7a3d-42d9-a44e-f3b46608ebf1", "value": "98304:xvzdpCuVCALwdebHSEgiaZZk8ymjcvnvXUU7uSmnhRXQX:1CuTJ1aZulnvXtDOhRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714733, "uuid": "81ee9a63-a6e2-4519-bd9a-5ac356ec13df", "value": 5892656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714733, "uuid": "0e43f251-796c-4361-8b5c-4b20a57c630f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714733, "uuid": "c8cbb392-55e8-44d3-b686-be85d03248fc", "value": "GBPCEF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8421003a-c477-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622730316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622730316, "uuid": "9f7fba69-12e7-4b89-bb8d-54a900a0b615", "comment": "Malware payload (AgentTesla)", "value": "2c2ccf90aa58dfd44b56e0b375c6b2a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622730316, "uuid": "be53be8c-c804-44f5-a872-e5c8c21535c9", "comment": "Malware payload (AgentTesla)", "value": "996622ce157f045f7b52955268d0dcc0f312700a3898515405dc344967095a2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622730316, "uuid": "a836ac9f-2aa9-4c77-a63d-a9b43c81b24a", "comment": "Malware payload (AgentTesla)", "value": "bba8e2bf09c034e914c5e4e14d79b7a3048b94d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622730316, "uuid": "050dd098-507d-4a50-8961-a1baa840666e", "comment": "Malware payload (AgentTesla)", "value": "5ab3e077886a757bb0556bc14315e8ccd987f09054aeb834bd3f1dafb402cb0a58ec0688745d2cac4ef04cd5352032ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622730316, "uuid": "28e1d44c-62c5-4f12-bb70-68c4514dac61", "value": "6315392439FA5029B173FFA98BE475DADA6FBB733B06545E10A003464723A82DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622730316, "uuid": "beecf302-e988-465e-8eda-09546c6f078a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622730316, "uuid": "7b2b5552-a2a1-49b0-a277-ee0373f72aa1", "value": "12288:a1UEdTJ30xvdwcQfJoVPSpHgieY+AADS77+5lXe6D8yG3obhZSjt3HMePN3obAOg:WP0YRqKt7aRnltw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622730316, "uuid": "97792fd7-35d2-4d76-b3d2-2baad7c189f9", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622730316, "uuid": "60356951-8afc-43c5-916e-0e70ea7164c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622730316, "uuid": "7609b86b-cecf-4e43-ab54-e3b77915cf68", "value": "PURCHASE LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116e8003-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1622713802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713802, "uuid": "57cf0ef5-950e-4ee4-8db9-f2d78102ff16", "comment": "Malware payload (SystemBC)", "value": "9c08ab412dd01579a2c5709cc2f8e806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713802, "uuid": "7c61a2b2-9280-4ed2-8658-e69a4ef5d0a4", "comment": "Malware payload (SystemBC)", "value": "99b04df64082620a08803fd947499f4662f967420327b63c6438174ed473e915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713802, "uuid": "d0621892-f529-4b44-9a82-eb97ec8dddcb", "comment": "Malware payload (SystemBC)", "value": "c63ae1a3e96950d59bf542e80f4c24b14ac9a269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713802, "uuid": "27276edc-bf49-4d8f-8cac-cbe5bddf0f31", "comment": "Malware payload (SystemBC)", "value": "5cbcc07f372e6f3d7aa0ba3f9530cb86902fd3d34bcfc28b8b91177745fc6b03f7953472b05eca212acdfff14a2c47af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713802, "uuid": "216314ba-8431-434c-88b6-d6c8a7b48adf", "value": "2A157D26F3924837C5332639AD5B67989C39BE006D38AC472FE81D4C5F397813D6A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713802, "uuid": "451d4175-de78-44ec-9a4f-34672396922d", "value": "9a2a7aae9114d22ac47b1fe0953c1e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713802, "uuid": "ac8fd820-38c0-460d-b9fe-1ac9af3ea3a1", "value": "12288:u5jstvk8D3uz0yNIU58aA+amdQXwKW4dkaTSJxtBBmcDgAfXPyNPd:ag2YuAWP/fvdQgD4dkaTSJrjUAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713802, "uuid": "b98ce3e9-0a7a-4207-a53c-a4b5fd012b5a", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713802, "uuid": "100e06c8-7de6-43f3-99da-f7339630bf55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713802, "uuid": "50f4afdf-8625-4e74-84aa-4bcd4b895a37", "value": "9c08ab412dd01579a2c5709cc2f8e806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b103d20-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622714409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714409, "uuid": "e0886638-6ff6-4cde-9940-b8eb9dab5997", "comment": "Malware payload (DanaBot)", "value": "3986f058232d8417708c9237dc40e41a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714409, "uuid": "b4eee7a6-cafe-4f22-bfd4-bb717c9ed9ad", "comment": "Malware payload (DanaBot)", "value": "99d2fa555047809b0a3d7dbdf27ed83a4aa04de6c989dd1b581393b5cc12ba93", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714409, "uuid": "1677feaf-8889-45e0-8b47-0d651b0d3153", "comment": "Malware payload (DanaBot)", "value": "fd0728901999fa233db9ceca11eab6a054a5f976", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714409, "uuid": "82eddaa8-9b45-4d1f-9824-a1d5dd43d8f4", "comment": "Malware payload (DanaBot)", "value": "746f351a8f17b358d919954eed9f82f5a172e619e2be2201805b50edd67db07ddb2c2a276e0ccac2f66d2af2832a7ea9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714409, "uuid": "59a55cba-4b65-470f-970e-e12364504258", "value": "87563314A7B0E029F0F706F848BD52F1A62974A17BA480CF52ED57EB12B4DE0E976347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714409, "uuid": "0783246c-979d-43e7-a0c3-58ea30379a81", "value": "7564d134519163dd4c1168b5e4bc3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714409, "uuid": "4730f055-7cb5-4919-8dc4-1fdacc4e5b7e", "value": "196608:r/ucasZB+Ag/Xc/cglRMapDA+7JFj0XRX6Y:r/ucaaoAN/mg7JCRXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714409, "uuid": "3a495015-8abf-45c7-a814-de3f2e4bf37d", "value": 6322176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714409, "uuid": "39fe22c0-45dc-48f3-8b6d-86fa80ba1cc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714409, "uuid": "c7323b65-f3f7-45f4-b603-c6d7b2f8a7df", "value": "3986f058232d8417708c9237dc40e41a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fde941-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724277, "uuid": "c7d7a47c-b5ee-4f31-b62e-fff0aff1f4c6", "comment": "Malware payload (AgentTesla)", "value": "de6401f377f747f03e084396fc6de3b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724277, "uuid": "f32930de-5c4f-4134-85b5-a28d0368c6ef", "comment": "Malware payload (AgentTesla)", "value": "9ab4adc4bb4702e2d161d3a7b255b1f2160844f3735339c8e304f54968307ac3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724277, "uuid": "27365b01-40e1-4f1a-8a62-d92a1ce114fe", "comment": "Malware payload (AgentTesla)", "value": "d7e5836470d1bd486392b28f8eca8c2c641b6f7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724277, "uuid": "bdc544f2-9096-4195-8e5e-58dad841ad7d", "comment": "Malware payload (AgentTesla)", "value": "2e9e97be05935f952f2cfa5e00af43c95fdf2f5cb494659448f6925316e709c4f50aafc84a8da7f34edd0cb55773f065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724277, "uuid": "087d30a0-f893-480c-9a8c-97d87f5953ce", "value": "D8456CF4B398D960D02DC73182605CB9D7F13CEA9B96A51C1BF4BA8D1E13F86CB19486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724277, "uuid": "39852245-0ef5-40ea-8e9a-b92b1b140188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724277, "uuid": "f9cced0c-0ef2-43fb-b6b5-0499478e739d", "value": "24576:CBHMZ91C2oNvzaCswKnaikdthp8uZU2Ksyemcu32I4b:7naRhr62KWrui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724277, "uuid": "fa47ddc9-29b0-4b49-ab43-f1bdc0c2a47d", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724277, "uuid": "2824bca7-6933-4ef2-8f2e-fcb771811721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724277, "uuid": "0e4d4e31-77eb-4cef-89e6-beac43926aeb", "value": "de6401f377f747f03e084396fc6de3b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bef5ff1-c43f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622706223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706223, "uuid": "5821fc51-932e-44f5-bef7-916f7979ed13", "comment": "Malware payload (AgentTesla)", "value": "a980192d229fe850f5cc777f8d96c561", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706223, "uuid": "1f65629c-d478-4eab-b655-d0f2e6046705", "comment": "Malware payload (AgentTesla)", "value": "9abb70441c1fb02e6425d487da4500d3f5eaa08ca164a5568c3243c842a1c49b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706223, "uuid": "3f188498-5194-463e-b726-f4254b69ef5f", "comment": "Malware payload (AgentTesla)", "value": "8fbd2886a686f13a252be242c093ca804542cc77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706223, "uuid": "2cbece67-9182-443d-8da6-e0ae1d904d96", "comment": "Malware payload (AgentTesla)", "value": "108fa8ffbf5b2988dba02565b2421507e638a55482d8d38b45c0143bdcb8475e4c3889b53e94e270debf2566bd2b5457", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706223, "uuid": "876b3138-bc81-40ec-8fe6-1e7adf0a8363", "value": "9D626D35F5D1DD81CA4FC498575FB6662531F84A81C698D8FBACFB308B9629B0B2F900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706223, "uuid": "8138465b-d976-4036-81d3-de7a507f8012", "value": "192:zElm+Bs2MGft/8SiBFe5JmXlcOJK6eBBYtlGpTY3x48Zvift857orDCISK7:wlpBsqftKs8KVBZTIO8gWZrIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622706223, "uuid": "dc4e62b7-828b-43e6-ab68-e9a46fcf7b18", "value": 14950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622706223, "uuid": "66f13d5d-e4b8-41a3-9dac-58f8f5b8d8e8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706223, "uuid": "64bbc070-3db6-44e5-9d26-ace2a304e6ba", "value": "RFQ1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d06b4d0-c476-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622729713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729713, "uuid": "c4f7129d-f6da-49a1-8e9d-b30b2c829405", "comment": "Malware payload", "value": "04ae48f906be5a36b0f96fd383a5ed49", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729713, "uuid": "efef8bc3-d656-40a7-b187-16314f61fba5", "comment": "Malware payload", "value": "9abdb1ba01a1b0951b0a9aa9f78ca8de7c9831f316e754e59d967092520a05ce", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729713, "uuid": "566d28b9-b228-48e9-a64a-5bf5c6d610dd", "comment": "Malware payload", "value": "e324095eaebc6f601f12fc638675bbfb8dfb7925", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729713, "uuid": "90cb9732-b42a-49dd-9a96-53e09f593a53", "comment": "Malware payload", "value": "fee761fd775966c3beac50ec9d76cd550afec8f5874aee251da4a37958ff6bd9c4c7da2ef898d6aec10dd9977c229095", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729713, "uuid": "657bb77f-e0ab-488b-a6f6-2647368b3c53", "value": "2451B79F7D5687550EAE2DC2383EE42A5C3607399090DC845F4BE8442D50EEC8D2A9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729713, "uuid": "88f0f6e3-7748-44c8-ab6a-8154c2a59f06", "value": "48:kqyvL+g9hrK9t/X0txE//s1S21CT/LYZCrMw4CIltOYOKbbhoOdqM03FeBFJf:+LFhrQ0ffhaDmaI/OYkWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729713, "uuid": "f8fbb216-7475-4448-93c7-268dd7c13ff8", "value": 3100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729713, "uuid": "694f2b9f-52e0-47f8-80bb-29f10c9f7c38", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729713, "uuid": "1b19479c-bb81-49f6-8f1f-cbdbfb7056cd", "value": "collectionBoxConst.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd3ff2f-c44f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713102, "uuid": "8feba874-385f-4287-8c40-fc4f44601863", "comment": "Malware payload (AgentTesla)", "value": "a2597261035eb27e09ed267f4f5147de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713102, "uuid": "47e044f1-b7fc-4b13-8126-66a825a1aa61", "comment": "Malware payload (AgentTesla)", "value": "9b28ce55d61616271f1796f3eee9b0b32be89f7c5b818de1edd6549a29868467", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713102, "uuid": "471ea1cd-5f05-4247-ad2b-801f3feba02f", "comment": "Malware payload (AgentTesla)", "value": "7cb2cb21598a2c909903d26bb8583a7ca31e170d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713102, "uuid": "17a06176-10f8-4bd4-ab31-95bf0e854e9c", "comment": "Malware payload (AgentTesla)", "value": "dcc75328894434e66b83749e35e5e59ec321710baf972fd71c2afd1dda80a4bcadde1a5d186c003f7378d5d49afd409d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713102, "uuid": "d96fc53f-7470-43c1-ae16-d88b82940ebf", "value": "DE2523DFF8B41F5BC986683C82CE8A08190DAF006A48D9434EBD353A357377965C6DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713102, "uuid": "7f69ce4f-b622-4916-9a73-29eeb89f0716", "value": "24576:6bX2rBePl8H1PGBptni43ZwJT9AvAxCMNyHC2mX:OX2rB2mVP2syah9AvYpJ2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713102, "uuid": "a7cada73-c997-4536-b652-2252220c2646", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713102, "uuid": "d9bbd108-842c-4861-8f5a-f5bd7a533591", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713102, "uuid": "487df406-3453-4682-96d9-f2f2cd222bdc", "value": "List of Items.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a073ca73-c4a6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622750550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622750550, "uuid": "ad00b670-1f08-4019-9d23-01a730dd69df", "comment": "Malware payload", "value": "c76974273db07cb6139086c56c801b98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622750550, "uuid": "e114a7de-d397-4f94-b311-663b1dac6c95", "comment": "Malware payload", "value": "9b6f49558e731e732e8a5ca0887400f7cbaa30ea4216f7bc06dd29a5fea2c616", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622750550, "uuid": "5a399ba7-2184-4021-9813-f3d217355669", "comment": "Malware payload", "value": "874700ced6281bcde64791add4475e0aeeefb4b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622750550, "uuid": "0f3b6629-c02a-42bd-a2f5-f71b0cb5e3c7", "comment": "Malware payload", "value": "c4cb409bf83c03412b2755bdb4489a833bedf2d130e5bcb6a0362ec8d00e867e6c0963b05d7edf4894f1f67636519e6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622750550, "uuid": "09901b1b-ba02-4786-b0d9-c97c1281847a", "value": "C95329619AAA4065F0339B716BF326136B37F9A31943D6CE145603FB5B03B019E522FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622750550, "uuid": "c97270b6-17a5-497d-a4cd-a26a3068022d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622750550, "uuid": "d7514912-daa5-4995-bcfc-62aad109c5d4", "value": "1536:nKq0vXXPm+PP+yX/2qfP/mLn22X+XWu+mePXDn22X+XW7n22X+XWe+mePXDn22XN:nKq0vXXPm+PP+yX/2qfP/mLn22X+XWu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622750550, "uuid": "be7af143-e334-40b0-a7fe-8a1eb7193be2", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622750550, "uuid": "7d076452-a274-470e-84d5-e924f3ca8a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622750550, "uuid": "22f53fdc-d803-4c33-99f9-1a9ac377e443", "value": "gggwhqoy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee994e6-c475-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729421, "uuid": "d2c6fc80-86b1-4062-8a91-9e5828c68ba1", "comment": "Malware payload (Quakbot)", "value": "d366cbde9a1d7e949f19ea3bd8cadcbd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729421, "uuid": "56d2cb9e-3f74-4d20-a9d0-d737be5edf4f", "comment": "Malware payload (Quakbot)", "value": "9c20624b568fdf671799042f411f283780e6fc6c00a98a5d628d85054039c094", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729421, "uuid": "83729cc5-1f49-4eee-a2e6-6d346894b5bf", "comment": "Malware payload (Quakbot)", "value": "5d0462898e0108d87b63740e3d7e2cd615274b32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729421, "uuid": "f6a812dd-49c8-445c-af0b-3335ae07d28f", "comment": "Malware payload (Quakbot)", "value": "6de462bc393c93866111d578918c0d22b96eaa469f73a9036bf23a55f4bef8584cbe201b32f9daae36a0f7a698b1110c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729421, "uuid": "aa3ee0fa-b7c1-46c0-a22b-b7601c06346e", "value": "CE059C81B18AED76D1600A343A89F5D5475CBC050FAD299F77D42F8F6B381831A287BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729421, "uuid": "fcbb7ff0-61df-43a2-a8a7-e9813ecd20f7", "value": "dd1715b296a45da8514656949f8428f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729421, "uuid": "6904fab2-9dd1-4853-9200-c3075274634e", "value": "12288:WvanqwICa+kqQQuOXoVo4DojSHSz2nAu41SeT0Vrh3JMj8CQyvYOLQMOGBeuI:AaqwICpFQQNUezTrMeYh5+YOLQLse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729421, "uuid": "6778643a-c3d6-4d7a-a7e7-0ae21030dde3", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729421, "uuid": "d0b60102-3ad9-4635-86d9-99da387bd48c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729421, "uuid": "b4b3594b-d537-4fe7-b6fc-ecc59b3f7393", "value": "d366cbde9a1d7e949f19ea3bd8cadcbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ed173e-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622737994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737994, "uuid": "dded4fe6-ce88-4fe2-8f0c-9477e6ce9095", "comment": "Malware payload (RedLineStealer)", "value": "9e58c0aa0027962e7d97674195a65c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737994, "uuid": "487c7017-80fb-4cdf-9128-f8d722ba2d88", "comment": "Malware payload (RedLineStealer)", "value": "9c48ce52b22244d4ea8510d26f01833426d88fc7b76e46601a1410e52ba993de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737994, "uuid": "b62242b0-5a0e-47c7-b93e-7e9b867b47ba", "comment": "Malware payload (RedLineStealer)", "value": "8ec9f437d4dcefa6d739be387e8fa2ed66e7ae99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737994, "uuid": "331cb0bc-cc64-4783-b96c-9c4f75bc1551", "comment": "Malware payload (RedLineStealer)", "value": "81fc55c1eda58d17a5a8c503b78eaba330ad0bc82036f7bd84dff6db216e228d8fbb7bf64956f2fe1de4ee8edd00ce33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737994, "uuid": "23414b90-d873-417b-bd47-390360141c70", "value": "B9A2B92077E6CF75EC761BB159B1A202EE39FC921401EB0F05D4415679A3A88CE7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737994, "uuid": "d621c46b-f3ea-49be-891d-8159f977292a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737994, "uuid": "980be97a-9cd4-46d7-9dcc-a06ec9e2d34b", "value": "384:bEKWa2oDztHu2hAuSYcaIQhPyoOIygKa2z+at6sDmPMr:d2izFu2hAu4aIQEvIu+E6cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737994, "uuid": "cf7f162d-8462-4686-9e79-be436ad6678b", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737994, "uuid": "77805090-6f2a-4409-a3fe-a0ffcc6f7691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737994, "uuid": "df9045a5-4f9c-46f9-a630-88282af90df3", "value": "9e58c0aa0027962e7d97674195a65c57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adea604-c475-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622729414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729414, "uuid": "9815c2a2-47ab-48eb-8701-61a6e5e76ec3", "comment": "Malware payload (Quakbot)", "value": "98ada9881b1161eec3882d0efd8a7204", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729414, "uuid": "dffb9c39-f802-461e-af6c-75943b7e8019", "comment": "Malware payload (Quakbot)", "value": "9c9640cc857c2c233e0fc0db1930489314cea509e88ce077c214cd110fb81511", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729414, "uuid": "0c8dcedd-bfa4-46e9-afde-ca2d8d3dac6c", "comment": "Malware payload (Quakbot)", "value": "cb7e7fe9df077ee3ff3b8ff544816711d2e8c3b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622729414, "uuid": "00e1c6e4-7ad4-4e01-b1f0-99717d958673", "comment": "Malware payload (Quakbot)", "value": "63ac7b6f0c6be318128dcdc82bd5f0f7be38b80e68e53354ae0000a46b6977a0e86879b0a359605108fa329fcb5ceb94", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729414, "uuid": "643c5b76-8d11-4711-b0fd-fa8bb7791c38", "value": "D7059C81B18AED76D1600A343A89F5D5475CBC050FAD299F77D42F8F6B381831A287BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729414, "uuid": "ef61fbc3-1e5c-4b18-8429-2728c4235f2f", "value": "dd1715b296a45da8514656949f8428f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729414, "uuid": "03d64456-3adc-4bce-b005-3f914b87f557", "value": "12288:Wvan3wICa+kqQQuOXoVo4DojSHSz2nAu41SeT0Vrh3JMj8CQyvYOLQMOGBeuI:Aa3wICpFQQNUezTrMeYh5+YOLQLse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622729414, "uuid": "8c6d413e-f2f6-4427-b7f0-86ae6cc13b8c", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622729414, "uuid": "ffcda7aa-6dd5-41e0-b5ad-5a7166288916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622729414, "uuid": "dc886178-306b-4c5f-a065-15394c3b99e4", "value": "98ada9881b1161eec3882d0efd8a7204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa2bae9-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734791, "uuid": "1f18ac71-6b1c-47e6-be22-079553745524", "comment": "Malware payload (Gozi)", "value": "7bd23ed45f3eeb684de30b330b05303e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734791, "uuid": "aa90b68f-f7b6-4603-bef2-1dd85762b31c", "comment": "Malware payload (Gozi)", "value": "9cfe3a387b6632c8bdfc55cc7baca861038e07f6c6d0ed88afbc05e025879edd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734791, "uuid": "a0f2d149-1688-4a33-97aa-093db1c1e2d1", "comment": "Malware payload (Gozi)", "value": "483b40a413d8fba4aafdee2ba1bbaef4712024d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734791, "uuid": "f2ebf894-415f-43e2-867b-6687663106cc", "comment": "Malware payload (Gozi)", "value": "4dbb159855b5fc52cc8a6f268a794bcbb28e262db3c4fc4524cfad9bee635530e128a31083ef610893a276154e573e5e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734791, "uuid": "5c71b135-8b07-46a9-baa6-faf1f6a8cb81", "value": "9CB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734791, "uuid": "7844ed7d-adab-4afb-bfce-4554f0d6b3d6", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734791, "uuid": "3d2fec08-e4a2-4540-b1fd-9323d87bff5a", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvIqW6mZuzuJPjX7R75:vz75tzST8AQq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734791, "uuid": "e2518f3f-a4e3-4ac7-a218-254d79c862d6", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734791, "uuid": "3d2b6931-aebc-4c26-a2c2-aa35d2630155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734791, "uuid": "625e8f3c-feff-4162-9a06-b599872f98c3", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde064f9-c49e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622747190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747190, "uuid": "df715c94-5e89-4971-8dfb-bb0a385b4b61", "comment": "Malware payload", "value": "da3b5bd5eb84d663252fa3c4d4e15005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747190, "uuid": "d8259e8d-c640-48f7-b0f6-fe1b8352231c", "comment": "Malware payload", "value": "9e31503c4d7b07cb9dedadcf39418e37572d2ffd6ab34867c28c1e7e2173122d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747190, "uuid": "8397dc66-2a3a-4ac1-b1f5-a2b3fcebb314", "comment": "Malware payload", "value": "85ef1a96d5f567bed44ba77cda476115404f1849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622747190, "uuid": "151924c0-e2a8-4b9a-b3d0-91998479e70d", "comment": "Malware payload", "value": "eb4f4d0ef99d86e7c2b948469e25b369efea8b6e34e66b55b1a84512bc277b568ba15d71299a75070fd672c8c1a8161d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747190, "uuid": "99843ff0-d351-4b81-ac10-bae17aca667d", "value": "4E84BED2F11045EDED6A173264270CA259A32CBDD6B8D15C70F937236BF72A3402A95F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747190, "uuid": "91005b31-3b34-4280-8c58-1ec333d87507", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747190, "uuid": "4689f3ff-3660-4354-aa1a-2c7d6f10fd24", "value": "6144:jQqbWVqB0pnC2bf8EaYeJk7jQ+dGWa3jTPp:KW0pCm8EaYak7c+gWa3jjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622747190, "uuid": "da675615-fc4f-4024-8b9f-6bc1ba773f34", "value": 389316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622747190, "uuid": "036b64cb-5375-49e1-ab7e-057712b6389a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622747190, "uuid": "ed761493-abc2-431a-9f37-00017b5cc7fe", "value": "0900009000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903fbdb1-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724323, "uuid": "1b734b20-d615-405a-9f70-6e3413f7f608", "comment": "Malware payload (AgentTesla)", "value": "fbddb66cd27129735dd8d26efce10c3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724323, "uuid": "db93be71-38a2-4ca8-88bd-ee5097a78e70", "comment": "Malware payload (AgentTesla)", "value": "9e4efb615e3ede276e526ca52c03930758043713397d411cd228b5cd4eeb9568", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724323, "uuid": "31c3ac58-d02f-4967-a6a0-d8555af1975d", "comment": "Malware payload (AgentTesla)", "value": "09a0230d0d06424a7a15ce86c23c441e0b78289f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724323, "uuid": "7bd1dabc-44db-4e49-9fd2-e19aaae2bc7a", "comment": "Malware payload (AgentTesla)", "value": "e8deb6a26ed86475fff1cb88d0348aa38833b4f9a6d131e85ede2d9221b4058dd4954a8f08152dd0294d77e63eaf5a7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724323, "uuid": "d3c3cbd9-e3e2-46b5-9d28-c2a8891198a3", "value": "A175D692B5929D28E25986738DDFA87C53BC41F617013F39CF735948AF223E2CD58886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724323, "uuid": "e88e38e4-60f8-426a-9f9c-7b72a6e806d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724323, "uuid": "6b510138-c453-478c-89d5-d5c47ead81a2", "value": "49152:ncE4h3FSc1/3159oIPBjBEAy5H98qd4dDcRRO8t6drKuDKNR:ncE4h3FSc1/3159oIPBjBEAy5H98qd4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724323, "uuid": "b925ee77-c151-4efd-a638-018bfbd6b69a", "value": 1631232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724323, "uuid": "32168430-d208-4877-8624-e308cb2530cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724323, "uuid": "0cdee650-f848-46b3-8cd2-ebcbc58b0bc2", "value": "fbddb66cd27129735dd8d26efce10c3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbd948e-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622710733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710733, "uuid": "293f1e0d-f3e8-4e99-a6ad-ae5373235bcd", "comment": "Malware payload (AgentTesla)", "value": "3c868963b61f99ea0917c7b9274be12b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710733, "uuid": "ea161ea5-4793-4c46-a445-e4bf70c43cc4", "comment": "Malware payload (AgentTesla)", "value": "9e5b5856af5482edfe327d4f4d6a5af750a1adc1910e6daf681095f13a2dfacb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710733, "uuid": "e0993e2a-0699-41ad-b923-51be427bcba5", "comment": "Malware payload (AgentTesla)", "value": "344bc0938488f2c442bd9a10dfd661100120ed9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710733, "uuid": "b9610a7e-38b3-45b6-8032-a186095af323", "comment": "Malware payload (AgentTesla)", "value": "d08596215c21d2e65802a789faff9281a56e7d542b3a7131f2ad5a3ef225dffc26aa4b83ed39f57e95834de2c1bb7704", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710733, "uuid": "aee4deff-da14-4c4d-ab9f-20ddb1de9678", "value": "0D557DF0F094C8F6D95FCBB2EE56A83466626EFD5151000C06A9FB4E2B73346668ED0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710733, "uuid": "2615f5e2-a94f-4df7-b8b9-c6d7bd38fb84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710733, "uuid": "bdea1e2c-04d2-4283-868a-2a558bf156e0", "value": "12288:KiFbm28vTgKjn6j6/NSFi60RjK7yFWi4FYVh7ReLugmq+NIK6DvYZavrVw5joFBu:5m2xQLGUsc7Ruxr+8Ykv4jIYZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710733, "uuid": "0b2fa75a-2b4e-4a1e-aacc-3307e24b5f5d", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710733, "uuid": "b371b684-e942-4b2a-a09f-060eb5323555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710733, "uuid": "59ebbcb9-993b-4e18-8b6e-ff62370f4ce5", "value": "Invoice and packing list for shipping this week (June 3, 2021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f1c566-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622700073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "cd727868-90c4-4da0-a51c-3978148d9012", "comment": "Malware payload (SnakeKeylogger)", "value": "365cef6b9f1d3672cf86d043e48845a9", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "3e9c14bc-51fa-4612-9975-c22c1e5c6bf4", "comment": "Malware payload (SnakeKeylogger)", "value": "9e6994570cedbc6d1bc2b077bda2bdf38c26ab2f2d09ea3797c45d786fd1b2d9", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "832ace17-e8b7-41b1-bbbc-f89029f30fd9", "comment": "Malware payload (SnakeKeylogger)", "value": "ca35e76f6585fc7a3ea036cdc33b6606faeaa050", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "a916552d-32b5-45b2-a39f-5e92aa42e74c", "comment": "Malware payload (SnakeKeylogger)", "value": "801ec0d156d73bf90450d360b0fc957fa1d212f0f468608698798aeac24b1baa4c00b1dfa39e88d244d9897a25a2ae22", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700073, "uuid": "0d7ffb83-4132-4c65-bcae-869b0f60728b", "value": "F6E423F3ECA4ED5AD8CDE02ED85178D07C8B3C91030D69899E219EC458EA76AF1CF159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700073, "uuid": "e197e06c-7e61-4632-b2fd-bb4f0c8fab64", "value": "12288:eKtDrj7SzZJwObfxEsu2iAqHMUzcXbnBKBekTf1cvot1Q8BISglm/6F9ZvqMOO:eKtDrjIbf69DzcLBuekp/Q8MlGQZvqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700073, "uuid": "fb5d140b-8377-41fb-a95d-60f7edf3083c", "value": 705103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700073, "uuid": "1651bd34-033d-4d8f-81a6-c4e6f3481c8e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700073, "uuid": "e2f58caf-4630-4af9-a5da-5f13242341a1", "value": "Inquiry.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa59540-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734415, "uuid": "d0fcc808-aae7-4acc-99bd-19dd8510a13f", "comment": "Malware payload (Gozi)", "value": "6c6be2b6a5e34f78749ec8b662e737c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734415, "uuid": "973817b8-c71b-4338-84d9-7f3c4c96f0dc", "comment": "Malware payload (Gozi)", "value": "9f4303a1c5f37246ea27ac19368dc8478a5a5a3ead60ca561f96abfc0e3dc129", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734415, "uuid": "036c7fb3-d81b-46c7-a4d2-f800ed998f23", "comment": "Malware payload (Gozi)", "value": "f921b465d3d8a2d9eadbc8daaeb2319259371774", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734415, "uuid": "da86b058-a269-4357-9196-5d1081961b82", "comment": "Malware payload (Gozi)", "value": "708d322536418b8e3664ac05e5ca72984547a52af1f556420263f5dc50397239f4f9f1dd40b4aec30a73d482c41f17ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734415, "uuid": "5fb4f0b0-e4bb-4b91-b8d1-9b84a7d68d03", "value": "74B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734415, "uuid": "d39814cd-8a3a-49e3-ae14-b83a80b6e06d", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734415, "uuid": "cd02adfb-16a7-46c0-80d0-3491571eb6cd", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvSqW6mZuzuJPjX7R75:vz75tzST8AKq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734415, "uuid": "d02bdc51-c57b-4340-a85f-dd5f422cdcdd", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734415, "uuid": "fc1e1a8a-2380-4fbd-8098-5e0afa487805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734415, "uuid": "c8d18a9b-f8ab-486d-907b-89d31c0228b1", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba92dd06-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1622713657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713657, "uuid": "6d670dcb-1be8-4e67-98e1-9e4b73678127", "comment": "Malware payload (Glupteba)", "value": "2079a5be219a88020ca05b8a452b8f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713657, "uuid": "d3b6ad0a-fb89-49db-973b-9caea59e9a1e", "comment": "Malware payload (Glupteba)", "value": "9fad25499af5a99eceaa0a6c887f47a3f67165713951e107505f67b2437869c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713657, "uuid": "edca8bea-42c8-4fd4-b0eb-2ca58aa9b64d", "comment": "Malware payload (Glupteba)", "value": "c349a273d750b0bd94cd6a8820dc1a83ec17a03b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713657, "uuid": "8b1047d6-94e0-43ff-bfd0-be15beafbcbc", "comment": "Malware payload (Glupteba)", "value": "380700031519b576b3ffb851de787a5d9782759c1861c81cd48b0f2481f2edeaec779902a2b17cd1ae45cb51b42310ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713657, "uuid": "54896d73-5a72-42fe-a2b0-cb73663f15ec", "value": "46263300A6B0C034E9F782F4997AD6DDA435B8A17FA450DF32C42BCF6664AE96D30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713657, "uuid": "540adb0a-77d3-48c6-b31a-b4dc2f053ef1", "value": "e81b9f97b533b87273485fe586897046", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713657, "uuid": "24170369-6254-491a-971f-d7f1fb4e11c5", "value": "98304:E3F7nnOgZB8qUdgcs9C1HE/jwdUz1bN+PiKmW6HAlF9h79iH:E3FnfUdglB/sdSR3iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713657, "uuid": "e55ec785-a2f5-4aea-ba4b-2ef55f02bfba", "value": 4652032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713657, "uuid": "e49a95e0-5055-4332-a765-719b04989a01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713657, "uuid": "d9f20bd1-782b-435d-85cc-006f14b5680a", "value": "SecuriteInfo.com.Troj.Kryptik-TR.8051.27521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff7bcf1-c4a1-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622748213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748213, "uuid": "b413f1b1-2fe7-4652-bcf9-eab4dd3af721", "comment": "Malware payload (Quakbot)", "value": "b0f2dcd95efaaff4a848e5e22f9604f1", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748213, "uuid": "0d1511de-dcab-46cc-96e5-9b75ee1f0b05", "comment": "Malware payload (Quakbot)", "value": "a00d1d5e58241874d09ab383a957562d9f55038656feb477223b1ee08d79af01", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748213, "uuid": "02ababf1-307d-4241-a406-19bb79f47efd", "comment": "Malware payload (Quakbot)", "value": "a586b13a51bc230365043b521c9a17074ad7832f", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622748213, "uuid": "80cdbd15-1245-4e70-a136-40feaa2e2e71", "comment": "Malware payload (Quakbot)", "value": "f1fecd444fe877c92112a8b2cfc4faaaf590cf412721538eb1af2eda6af44ffc7a1751087a9dc17dfd455a047c99e78c", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748213, "uuid": "a1847be7-f5d4-477e-850b-7356c4b34d6d", "value": "4874126EE7456CB8C3398C3ED24495E0825AF1E14097F22E06CC7518AB432EF979E1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748213, "uuid": "4caa819c-6bf2-4d23-bfe7-6b01acd4c08c", "value": "6144:kZRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNoL:kZRMmEv2Bc/nvm8IKABfsYOmauFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622748213, "uuid": "1b8467e2-d8bf-4800-b2e0-a93d301b209b", "value": 356029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622748213, "uuid": "6fc59cae-4aa8-4233-9925-a2fdebd22c09", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622748213, "uuid": "a3713bac-eaef-424f-871f-7cbac852b78d", "value": "DEBT_06032021_1841965006.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47aa07f-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622700359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700359, "uuid": "e2613f89-84e6-455c-b68d-f0822dc52939", "comment": "Malware payload (Formbook)", "value": "cc65708a2561327d9f2d41968567bf71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700359, "uuid": "d39b33ca-6246-470a-b307-55d120babfcd", "comment": "Malware payload (Formbook)", "value": "a07b9b54dc56712a664f80bc5626e5ad3157945601b8a5f6df7068230e22a1f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700359, "uuid": "3073d605-1d84-4857-8668-4212b4d96848", "comment": "Malware payload (Formbook)", "value": "28706e6d414003f32b1dd9478f498ccf5ecdef63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700359, "uuid": "0fa580f4-904e-4d5f-a4a1-58bfc7a882e8", "comment": "Malware payload (Formbook)", "value": "51eeda0942d318e5dce7cc1c76251df8f7ba97607e387ed227b666f993a5890a7b7883fd4afc2cd07934af5b6ac5b337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700359, "uuid": "7589f209-c551-4561-9975-330bb2268466", "value": "C4156BF4F59898B1C54DC732C791DDBEEB211EFE5243092D06A8FA8D2A3378A9F58444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700359, "uuid": "94456c36-e6d1-48e8-b4f0-c0b14f8bbf0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700359, "uuid": "bc70a7fc-8940-4dcb-86ff-29f85ca35c1a", "value": "12288:IQVvTxH9KUYnwBy7jt1tnxUfTa/IfrZ9Ukxx5xGRGeojx3bmz9IaI:6AMBGbrskxx5x3VjgCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700359, "uuid": "10f30fe4-c12a-46e2-9c79-9b6c86f00c14", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700359, "uuid": "aa317e2c-a089-4e4e-bdb2-bd21d0d24fdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700359, "uuid": "1a839287-aa68-4ae1-adae-706498143106", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3c33b8-c471-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1622727730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727730, "uuid": "79d7bce1-a44f-482e-af86-4ff0333f2224", "comment": "Malware payload (IcedID)", "value": "cd88c540b4c5aa55947cf474e8e433af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727730, "uuid": "11a09b4e-5002-402e-a65b-cccd7f0713af", "comment": "Malware payload (IcedID)", "value": "a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727730, "uuid": "8f06c2c1-4a28-4ddd-b550-825577dd7e11", "comment": "Malware payload (IcedID)", "value": "47bb790cecf426f51bb6111a8370f086ce9d94da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727730, "uuid": "bb3a6581-9162-43c7-93e7-1e4c0e9e47a2", "comment": "Malware payload (IcedID)", "value": "83aaba31afd2528572ff7312c66351a0a4801cbdf9e860cc569b96be6b0316c366a525489750c90530d113be66526a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727730, "uuid": "fd81705a-fc53-4f4d-be41-601f34c1584a", "value": "59940976A36149F8D01AC0B941524CC6A9727C2B0B3CC9FA737667362F6AE245E1F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727730, "uuid": "9ffab4b2-a644-4e68-b764-94aab89f0b9c", "value": "05afaa6bfc5d201c946211bd35577320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727730, "uuid": "2992c961-96b3-4e6f-9c9e-59112f63845e", "value": "6144:3OVfleTw80HrSgGCiMFnNcbT3yFa++TsmqtAVBOrJBohzYMQ5Nw:30sw86rSvcFaXCc+pmLBONBotB+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727730, "uuid": "a5a3a813-113b-47e9-b8f4-6e014318ee7d", "value": 440072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727730, "uuid": "9faa4dad-b3e3-4f71-ae29-402572273f3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727730, "uuid": "0d343ec5-d3d1-4176-8b0d-2b42ea9c96b4", "value": "a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbc87d7-c480-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622733986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733986, "uuid": "252d0886-86d3-4c27-bca8-5cad1c4489cd", "comment": "Malware payload", "value": "464ebaf895d826da39d50674e85004b4", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733986, "uuid": "d6d054a5-0a18-484b-bb46-d1d03c5d75a4", "comment": "Malware payload", "value": "a42818707e951c71e0341bff0918341730af1a736fb1b7a5044b35ea55b9a818", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733986, "uuid": "73eebf64-ade9-4011-9a51-34509f38da92", "comment": "Malware payload", "value": "eadc529400e4bcfb933987aa70de7d5ebedab078", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622733986, "uuid": "a2348f61-bef2-42b2-a6cd-c799294eb544", "comment": "Malware payload", "value": "ab45e9c828392b1e7c02b5704ae1bb045b252185d3251b5047424ba8eae7c653e1466060c6564475a2dc2a96bbc7ef5e", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622733986, "uuid": "dfcc9d89-4e55-4f69-b3fa-8ea82f127e39", "value": "CF0175D8BC64F88C0379B371D4F54C89F49142539164EEB6B2D41C974B643880B891DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622733986, "uuid": "e1b8426e-50a6-4a9e-8162-f2a673bcab98", "value": "24:q0aiPsoEQbylaNA9Fn7SZ/ewUyJdsuLUypS:/aiLEQutn7SPUyJdsu4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622733986, "uuid": "c2b2fe8f-1af3-41a9-bdb3-aaff40f08fbc", "value": 829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622733986, "uuid": "1122d69b-e296-46ef-b179-d6a76966ddd4", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622733986, "uuid": "fec05796-74ab-44c9-b90a-a8498d76e4c3", "value": "g5DtHGmA.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c158f8a0-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622713668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713668, "uuid": "ed5f0265-d7a0-4bdc-a15d-0e3506ee318e", "comment": "Malware payload (RedLineStealer)", "value": "f2567926fe0279780e03083c67b27c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713668, "uuid": "3aef4ecd-f4c2-40ad-ba45-8f61139377b6", "comment": "Malware payload (RedLineStealer)", "value": "a46f22fecc59d99c6abbf24076db9dab47f5a3e4ef5bfec8bb37b0d164a8d1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713668, "uuid": "357a27e0-a313-40c4-ac74-45c01131f866", "comment": "Malware payload (RedLineStealer)", "value": "87be6f44f0b0977426699e07bf1b94efddccc8c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713668, "uuid": "49063063-3449-4287-a84e-13135d13255c", "comment": "Malware payload (RedLineStealer)", "value": "fe5d5875dacfad43004e129d4450849f0e51d59eeacec2fa3c80d5fb98a0111997b826cad83d8aa70e84be9d121a3097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713668, "uuid": "a69e2aa1-c03f-43f3-9780-d10f603bc10a", "value": "D665E0073FBC82A1FA183235BCAB0D358F646C4125EDE75E2947308D1E3BA15EEB1959", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713668, "uuid": "055741dd-7ce1-488e-bdec-e842fbf80249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713668, "uuid": "77f6fd7b-9a8c-4f47-93e3-811dcaad45aa", "value": "24576:odj9LN+Sy/oBweda8fngBbbdPoWpd352U3LbwmkZ4Xlcjo:oxpNHBA8fqJoC35J3Q5SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713668, "uuid": "e0113965-c533-479a-8fed-3e540a613ab0", "value": 1442936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713668, "uuid": "8e94db2a-7875-4ea5-b493-6d6fb34f8be7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713668, "uuid": "aed1e902-667e-42a2-bc2d-4cd4a892363c", "value": "SecuriteInfo.com.Mal.Generic-S.24155.18332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ffb7c3-c438-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622703261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703261, "uuid": "dae44df7-28e7-446f-b316-7af99b7e2b0e", "comment": "Malware payload", "value": "3eb27964270341caf13c6e68d4e504b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703261, "uuid": "c072f533-c617-47c1-a5eb-ced59f3f7c62", "comment": "Malware payload", "value": "a6033e8da9636fc2ef3015548a76970bb881629604acd0a4ce1f1c8d4f316c03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703261, "uuid": "07eb0628-6161-4d8c-a988-51e33464ecce", "comment": "Malware payload", "value": "badd40bda2212389b30b0c110e418cbeb0d7f32c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703261, "uuid": "d67bb981-74b6-47ef-a456-bf6ced4b09f4", "comment": "Malware payload", "value": "55da7e7e02713fe22ba36c21f34d97d95e081b160ae050b78dbd46549195bb74b57ac73b33ac9d8bbbdc827c3eac68f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703261, "uuid": "31aab4eb-6916-4df2-a014-43fc2d11e55f", "value": "5583E11E24D4CCB7D56607718977E73AE77BD3062225225FAB345FBB3A111C78A0A2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703261, "uuid": "f0a9fd8c-9ca6-4f2f-9d77-991ad9c5e188", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703261, "uuid": "b78df9dc-e5f5-4327-9d2e-e059ae2c133f", "value": "1536:8LXB65939tY6HBg4sXJvMRQ0TOua8050Agp8QIjpf3pmw5WLS5+2WLnVL:8Lk395hYXJvMRQoOua8zaRt3//5jenp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703261, "uuid": "d21ea900-ace4-4d2b-9c87-6adc7134ac05", "value": 81154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703261, "uuid": "2efe10c0-1c19-433a-95fc-df210d1c3cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703261, "uuid": "5a01ab6f-86da-4f7b-b744-29676506b6a1", "value": "June_BTC_Key.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3017d214-c448-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622709988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709988, "uuid": "7c873132-3909-431b-b712-f96dbc7be501", "comment": "Malware payload (Adwind)", "value": "69e5d0842072d1d647b06ce48be4eef2", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709988, "uuid": "032a4a0a-4047-4446-aa7d-2dda798eb7ba", "comment": "Malware payload (Adwind)", "value": "a653e06067c5300375fac7f717f595f25faeda962e3655c1e30684acb9d9ae3b", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709988, "uuid": "eb7bcb3b-0adf-4df0-8f4e-b297c3e94d63", "comment": "Malware payload (Adwind)", "value": "72008bd8e5ea6b11a91c92e10d5affbf5b412d02", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709988, "uuid": "efa06b81-aafe-47d5-af5f-c1cd0e84e650", "comment": "Malware payload (Adwind)", "value": "37cf63b074d51f49d8bc926fd4bd17d2d1da8fea671d70cef5fbaafa794a79ee2f6ff3f31fe7a41f1c98c2c5fe05d0a4", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709988, "uuid": "771944b8-74e7-405d-b849-d4e0df4998e5", "value": "F66413CD4EA8D4A0D6176823F0A45B5069822E7FB2F90B345CDAF6932173CD7E497C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709988, "uuid": "8f821271-a08c-47c1-835a-0e95a9174992", "value": "6144:i8S0pif1vsEUaqC0i9MFpcsxICqmkJjAmcW1F5yVe/b+X10KElSrTLca1sC6G:i8S6OUEUaqj2GksyhImKOcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709988, "uuid": "60367f66-a9ab-46f7-bb79-c64ffb7b6221", "value": 319099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709988, "uuid": "fac99396-3027-466b-9c78-1af645867962", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709988, "uuid": "a26c081e-e468-42e8-a844-7136a999e69e", "value": "N9JmgFHtIOYLy98CemuUkk48B2Um.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067255f5-c48d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622739554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739554, "uuid": "bcc47a25-7ed7-40ec-b0cf-97e93f8a37f8", "comment": "Malware payload", "value": "98b90a1e287c794595775c1822c93fb0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739554, "uuid": "bc62138f-c672-41b6-83ca-06fd4f56963c", "comment": "Malware payload", "value": "a6600519bc76b92e2cd14956d2bed3d28967120453238932f4da7b84148909c8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739554, "uuid": "882c44e8-144b-4bff-9a32-3d2fe65be0ed", "comment": "Malware payload", "value": "616c7a9011e8ba6922f442e7221d1ee2debdf55b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739554, "uuid": "dd596e9d-17bf-4aeb-a990-3d0388761825", "comment": "Malware payload", "value": "0683b990ee63da87d0dcd38ee3c65cab8b7a80eb074a991917e5749768402bc2ae381a45462e2d451603cb43b4c1d410", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739554, "uuid": "ed6a5d90-a8bd-46be-8cb8-04fa47e25e7a", "value": "4B72B0B65A7EA9E1CD6F91780204503AE32A5371A1D2B67F92FE140F951225BC6333C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739554, "uuid": "44bb25ad-adaf-49f4-8b4e-9e2f4f9c873f", "value": "384:7e70FoVisbiydlMq5njId5tw42GKK8kCG+AC9Nr9SU5FMOZx:7e7Pi0iyQ9D2GKI8nrFMOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622739554, "uuid": "1336ee3c-9eb6-4573-89b4-a0cd8ab19578", "value": 16620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622739554, "uuid": "52eb06c2-5cf0-4fc1-9727-50432feec14a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739554, "uuid": "1f399db2-f2e5-4b6a-a45e-784559584da7", "value": "SKM_C250i21053109570.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cd9c74-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622699524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699524, "uuid": "2f979e8e-790b-4d99-a372-12dcad638872", "comment": "Malware payload", "value": "92ac9dbc5783ddeab66cff673b4bbae4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699524, "uuid": "1addd2b5-d024-4d06-8067-8f442658dd00", "comment": "Malware payload", "value": "a70495ddde64524d6c16dca86296d44ea78c15c3ac97609dac318559ee2644de", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699524, "uuid": "61fdf6ce-dc34-48b1-b47f-d803cc253baa", "comment": "Malware payload", "value": "dc6853e410d615a13e149819dd9e279372ea7282", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699524, "uuid": "b0320fe9-01ac-4304-8ac7-c93068cd94dd", "comment": "Malware payload", "value": "f62c094933698a804ddf63e302a7e98a5e417173afb78df35afda29e852c115d501bfe1f10c3d5941e58ea709cc468ba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699524, "uuid": "9df6b5f9-9d90-453d-a301-fc34bc58152c", "value": "20F4233253C55E83984A1CC8A0ECBAFDA97D87655F39058707EA81D4852A5F2D33C89F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699524, "uuid": "917c28cd-e777-4427-be99-5f62049f6342", "value": "12288:4Bdd0D9ioR9tpbNtDrhpj9Xw3IHvz4hTFgqE+TcORNDkzex0spYpUls+jm8:4BwIejpBtDpPvz2TSMcw/xLapSbC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699524, "uuid": "e9f59481-c58a-4d1e-983a-78e7f6c6e0d5", "value": 734959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699524, "uuid": "f7dcc744-7c50-4d3b-ac27-ae9653b7c7b9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699524, "uuid": "6663fd1d-6647-4b8c-aa46-fd5b24d58c05", "value": "RFQ-14000135846_Scanned from a Xerox multifunction device (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00525342-c482-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734819, "uuid": "973da91e-6116-40d6-8c05-94eb31c1fae1", "comment": "Malware payload (Gozi)", "value": "ce7a30e830dcd286b940f55f531cf9cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734819, "uuid": "56a63340-4e89-49ac-9ac7-8b864f705758", "comment": "Malware payload (Gozi)", "value": "a7342431e2aa3e9ff2d125f0b06a9fb2a381257eefe2aca975c3c83c9a0fed6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734819, "uuid": "3065ff2a-a1ce-4f98-bf11-ecacc4e30cbf", "comment": "Malware payload (Gozi)", "value": "05b1ba0916046145b2eb79ef822eb7724749a0a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734819, "uuid": "9d6b8c32-f1e3-4c44-a91e-8dc098f730be", "comment": "Malware payload (Gozi)", "value": "ca2e7d384680df3436fe25318cc3ac80c2cfdad72915048ce02990f6177c41f4b5a1a16fd46a7cf63a00c2e5700cc26f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734819, "uuid": "3b584ae3-ba0d-413f-b70d-53b16fbbd34d", "value": "82B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734819, "uuid": "365f69cb-2d86-4678-9068-d2d0f2ddf7a1", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734819, "uuid": "82524a97-b816-49e7-aaba-ed4f28e0cc77", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvoqW6mZuzuJPjX7R75:vz75tzST8AAq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734819, "uuid": "50a7e556-4d33-4f71-917d-6158681fc226", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734819, "uuid": "a6fe325c-08a9-4d8e-88bb-27f70b768c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734819, "uuid": "424e1ef0-b00e-418c-9218-c919c61f94e1", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f307d00-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757742, "uuid": "643d34ca-f847-4397-bbc3-6f5de71384e1", "comment": "Malware payload", "value": "71fba3b84a2718a6e9ca098663c541f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757742, "uuid": "0a52c629-5cc2-4071-b551-8f938db5b974", "comment": "Malware payload", "value": "a73961edef6f942c437c5443c8078a8f10d7ed73872d3449dc736f25413bfbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757742, "uuid": "df3b295f-fd4f-4a15-8c94-af5e1e7e103d", "comment": "Malware payload", "value": "7713c8b9d02245cd9111da5e35117df8d711f2bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757742, "uuid": "dfafc3da-49f5-4c45-8b20-5f1dbdda872e", "comment": "Malware payload", "value": "a52727883c6d988c50fd40c8be0fa2508a33debeb3db82d814b3ecec2061ce72e7f05711c64a852ae777292f2a4af957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757742, "uuid": "b40955c7-cf17-4964-8e87-2678a0e13708", "value": "D8F27C7C56949232CAFB0DF614E7D7618B30875A1A06977A7CCD26891F13AFC6E433A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757742, "uuid": "bd6dac06-197e-4c44-912c-ae87e94dafdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757742, "uuid": "560131dd-326a-441b-84b2-703204dc2a5d", "value": "768:XdWnXb6Ew0VSlbpgZ4tkbuHhqOBsp8Rr7Oh6i3YcLdjF:N0L6ELVSTrHIOBpng3tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757742, "uuid": "12d861c0-c77e-43f1-8b95-1450db9702f5", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757742, "uuid": "3696b0e0-6fb1-4f23-a7a7-9a730e6a912a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757742, "uuid": "7d793e06-c797-45b6-9263-173accb53c4d", "value": "SecuriteInfo.com.Variant.Bulz.434583.12020.6419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7840a887-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724712, "uuid": "378394f5-af2c-438e-aa7c-5d83aa94252b", "comment": "Malware payload (AgentTesla)", "value": "ba562ff157147e6191afce2e78b56ea2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724712, "uuid": "d962757f-25c6-4599-86e7-f2dd164c8528", "comment": "Malware payload (AgentTesla)", "value": "a895a68bb13034029be4ec32611db4b430bb8287449babbc4946eb2fe5044ffd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724712, "uuid": "f41e6871-d75b-404f-b7a4-86eff32b50f0", "comment": "Malware payload (AgentTesla)", "value": "682d117591198af1d7dd792586635250946a543a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724712, "uuid": "e9515200-305d-4cbb-a152-2542cabd1d94", "comment": "Malware payload (AgentTesla)", "value": "e60e673906e2b6876c1cd79bae6cb99ffecfad2c567ae71ee882b6f7c204f75807dcb5d8608e83bfc0407677eed70698", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724712, "uuid": "b70bbc26-a82f-4aad-ac8a-c7c303fa0058", "value": "AD7423BC46E1C5B3C6B387709C76BEB9D7BB87751A10042B63205E2927190F2D6792CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724712, "uuid": "13c0c15c-3934-4be5-a01a-44c5a4cad26a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724712, "uuid": "eb16b4ac-0607-4bb4-b831-20d347b0e65b", "value": "6144:8Qq+n0PMRAsM/uzy6AS2faCE5vAr+NAcmavaySkx7QVjfEUgfBKF5FRi+QZQp:TlHzy6ASzH5or+NAvCaySk2jfCKnFjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724712, "uuid": "90b8fd9e-0bb0-4c68-b9ee-b3730e63eb2f", "value": 354192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724712, "uuid": "1aa58861-b630-4c2e-a7be-a19647431187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724712, "uuid": "ab31f6b5-a605-41eb-96ee-64451dc3ebe7", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ac2e37-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1622724359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724359, "uuid": "f33b9ed2-801d-411b-82a2-f260ef980242", "comment": "Malware payload (Dridex)", "value": "80811d2e39e6854db45247bfb9dd2d6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724359, "uuid": "acc56234-7dd5-4f75-a8cd-5a52fd66c5fa", "comment": "Malware payload (Dridex)", "value": "a93c981b5b7501545df3d6aba5b76d7b312107a402a4e54521d009eb382ddc97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724359, "uuid": "023d8fdf-ea47-4b14-96b4-501c5c82a38f", "comment": "Malware payload (Dridex)", "value": "717ea19d097530d2433c044ab4cad0a04769895d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724359, "uuid": "e61f6056-beb1-4241-bd6d-d8fd1af7243d", "comment": "Malware payload (Dridex)", "value": "a11b73e0fe86efd56825c4c2f243c60a6696f27c28d800cf8f96725085edd674705441f3c7438cfb83e5d52aeb5d1752", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724359, "uuid": "1b523050-4477-42ff-963f-c8a10bffda9b", "value": "04F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724359, "uuid": "47e0db34-bd62-4381-ab10-09664d5bd3d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724359, "uuid": "f3e38ddb-782a-44ac-8530-7da1b877e341", "value": "3072:6IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Tc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724359, "uuid": "acc26dcb-940e-4c18-8286-925f9972009b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724359, "uuid": "70225758-09dc-4035-942b-952ef81078d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724359, "uuid": "7cd27d54-f6d8-46d5-9b48-4b6ac46e908d", "value": "80811d2e39e6854db45247bfb9dd2d6a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb09798-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622703250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703250, "uuid": "138b582d-99ab-4742-9e7c-d2003c3f06d7", "comment": "Malware payload (Quakbot)", "value": "122735e5492035bd9099e7d05abddcfb", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703250, "uuid": "0f446be8-367f-4a77-ba12-45753b740957", "comment": "Malware payload (Quakbot)", "value": "a950d0e96c598969be995628db504a20d25cae885b74352f09831a9c4e1f2642", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703250, "uuid": "850c9f3e-283d-43a9-a5d5-7152025ac430", "comment": "Malware payload (Quakbot)", "value": "3a3c55c28b8c37203652b7e37851b29382942fdb", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703250, "uuid": "e93f4bef-be7d-4941-ad68-2d339cbab57e", "comment": "Malware payload (Quakbot)", "value": "e4342e1dd80ea269706d9a22e1b1e3723901c54a791c72b07d0d874d001623db1e75437a2506b6fb8e67d5e95ba6c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703250, "uuid": "103b9fcc-227a-4fde-9eba-d1687ca403e6", "value": "6674127EE28169F4C3358D3ED244A0D4C295F1E050A7B31D07DD3528A75329FAA9E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703250, "uuid": "1bebc59d-cf63-480a-9e39-2984b5d57429", "value": "6144:5JMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNl:8RMmEv2Bc/nvm8IKABfsYOmauFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703250, "uuid": "84da89ae-2038-40f7-bc19-0bee4dc1972a", "value": 346062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703250, "uuid": "ffc11eb9-6925-49ce-a27e-7da85607ca01", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703250, "uuid": "e7e72701-5129-4e78-a5fa-47287922e135", "value": "Document_06022021_1658142991_Copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5afd1e-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622700161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700161, "uuid": "c6a51053-65f3-48d0-9d78-de20e0482c88", "comment": "Malware payload (SnakeKeylogger)", "value": "0dec0263243d7a3b2f69e139f41c455f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700161, "uuid": "165b065b-2565-4d0a-abed-ce9805353e54", "comment": "Malware payload (SnakeKeylogger)", "value": "a9c17a18861e01200624ea6c949d9ac252478a80496add163211973f171f807d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700161, "uuid": "141e3370-917b-465c-898c-96f7418f0c16", "comment": "Malware payload (SnakeKeylogger)", "value": "1f93ec8587a41c1626f8ebb95776200472d80b2b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700161, "uuid": "a0cf81d6-b7b0-40b2-ba99-59f0fb7662cd", "comment": "Malware payload (SnakeKeylogger)", "value": "0100f07b5711500a8b821a5ff200ec673390614204cd2c26f943e899c7d4508b6ef3148eb6e193c2cdd051db7761a317", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700161, "uuid": "20dc3c4f-7258-40ec-ada3-7f6d6cd51a99", "value": "DD9423219C0A56190CBFE03DAD1E9D526F34A0B72A7369279B81B3018FFFD663522734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700161, "uuid": "dd704f88-f8b3-4e1f-afbc-1277f105aad6", "value": "12288:9d27oyaMdmHlxBRSVFED1eIZg2RYc6cvpq9rhrJzn:9UDaMdtFW1eIZgSGcaFlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700161, "uuid": "fc9e576d-f5a0-4f53-aacd-3226bf5e787a", "value": 443142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700161, "uuid": "1b8aff41-db37-4f14-9c98-347c67be5a04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700161, "uuid": "066bca0e-8c9a-4cf1-9a5d-856afeb9365e", "value": "Swift-copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd1108b-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622713931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713931, "uuid": "7b5d8313-5fec-4b6d-b7a5-58b4f2679919", "comment": "Malware payload (BitRAT)", "value": "8e0e7f9303562f19bd052408302c7ed7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713931, "uuid": "bd701880-7dd7-4cba-ae0b-34be4592ef32", "comment": "Malware payload (BitRAT)", "value": "aab354a5e76026ce109b65bdf21c8d35941f0503705defa91c378106f28382ff", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713931, "uuid": "26e3310a-3027-4e93-a799-3081a4f2996b", "comment": "Malware payload (BitRAT)", "value": "652ca1ffbdc9f49edb0d9b97781ea74fce9c6485", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713931, "uuid": "dbed6ee7-d254-4819-b6f1-6768c9da507d", "comment": "Malware payload (BitRAT)", "value": "74ab4e7827636f811cfe2997e9d5089190f28476f0b3f5fb7ea2a99f4d74647a47932eb885409eed9047e516505fd6b3", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713931, "uuid": "d16ba35d-d012-4f85-b219-80c8fc96cdeb", "value": "C58533297ED7FDBBC9A1AB362D70C63AD6B910327357076333105F9EAD596E62C02108", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713931, "uuid": "4e8457ed-63ce-4156-b1e1-b2f5958f91e4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713931, "uuid": "38d4649e-8366-4f95-9eed-f4111f118ba9", "value": "49152:BDg5LE/KBPKKMf5UcKPHe6x3yv1Ox7FOvzFWCceE:xKOKBPKKMf5S2sE1Ox70bFoeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713931, "uuid": "46e66f19-ca6d-45ba-8021-238a22ed092c", "value": 1832384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713931, "uuid": "e196f693-220f-4c81-9585-5fe584d6d274", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713931, "uuid": "9ecafe87-c9de-41fd-bebc-721690e3d106", "value": "8e0e7f9303562f19bd052408302c7ed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71962c86-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622724701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724701, "uuid": "028cb458-3820-410a-ab48-8076c0b4562a", "comment": "Malware payload (Adwind)", "value": "1ed107c2b3e4cee17e114bf137490bac", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724701, "uuid": "c3323d02-29a9-48fa-a707-7b43c2042439", "comment": "Malware payload (Adwind)", "value": "ab3b9a785c5890292dcf70aed97f5981468556ec6f964445f535c17913c3f74c", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724701, "uuid": "b3854bf2-0191-486e-9c57-679312d693d9", "comment": "Malware payload (Adwind)", "value": "ead30b8122e677e4b39374b4a7c56efadd254607", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724701, "uuid": "e30ff786-ec9f-4655-8e06-bcbb54d22b1d", "comment": "Malware payload (Adwind)", "value": "3962aa8ca665a74bec32693016600b1fea398aa6f9655e0e3df408a5933db2802dcc96fce2b48840f2c690ee116c9e90", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724701, "uuid": "18354a1e-d62c-490a-9435-1400a2eed31f", "value": "066423ADE73771ADE86F07795748FB1E72DA895B8003B609E0C57E2C4096C007A75F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724701, "uuid": "4c9acb80-3c90-489a-8f31-b0a107556ecb", "value": "6144:0QUPo636OT1fYvyOiMBmpeBspsEACPs9Y7ce/8XX0+82xlLbSQo5X:Wg651UiMEeBspsEJxf8n82xlPSQGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724701, "uuid": "4ce2f626-c923-4c3c-a5ab-70c0c2622116", "value": 320394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724701, "uuid": "0379792f-a415-4f8c-b68c-96a13903106c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724701, "uuid": "27d4a4ad-d693-4144-b2f0-056f6f736b5c", "value": "bTpmDd8ENQi9ALWQ1If4PJ7is.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fc0f31-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757733, "uuid": "71a00b40-7768-4c46-abc6-14f4ca426ec9", "comment": "Malware payload", "value": "7e6280c6eb73dff0a99e07c1907f2392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757733, "uuid": "9ba96d62-c247-4d01-b090-df420bbcb07c", "comment": "Malware payload", "value": "aceb1fe903267c603ff26e08481f659d5bb8c10c2d8858bd35a21bc95f115824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757733, "uuid": "a8ec7f15-9170-432e-a6dd-dd22bd9d7bd9", "comment": "Malware payload", "value": "dfc0f7434cbce13162d10cc393da7affbfa2376a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757733, "uuid": "64406835-aca4-4cea-a100-a1641c8ccbec", "comment": "Malware payload", "value": "f00c2a0565262b469d02faca2aebc5163269609f20c243f7dea4662ccad538098f2f191196a5c2d9706fe95027ff4f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757733, "uuid": "85373912-21be-480a-b23f-203904a438f7", "value": "AFB35C38A75D8732DBFF0BB958A393104B71C5B1AA22EB6A1DC061E54E237C96F11253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757733, "uuid": "617ba2ac-e2b7-4b6f-aab8-65691d8dc7ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757733, "uuid": "b1ecab3e-6007-43d2-a4af-434b0754349e", "value": "1536:M/8cgfLsrMKi/IXkzgWUT3pZVjLn89f3b6TYnj4RZ9D42zeCJ9uDprylXd:XrfLsQKiUkTUT5DCf3bj4REgepdsXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757733, "uuid": "6ea108ab-2a61-41c7-80cd-38d1e82ff606", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757733, "uuid": "26a51205-9560-4118-8e4e-df0c17e626b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757733, "uuid": "a808b5ce-a168-4dac-94be-6df99580b727", "value": "SecuriteInfo.com.Trojan.GenericKD.46313967.30439.16609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2e5789-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622724536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724536, "uuid": "e0f46c49-78e8-4d81-a65d-9d9794594692", "comment": "Malware payload (Formbook)", "value": "a04ff069af5adc30efbf068ec95077e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724536, "uuid": "b23b66b4-ca2c-401a-ae4e-ba57cfb9f331", "comment": "Malware payload (Formbook)", "value": "ad24fa8fe46848770e3bd8a2c2f084fd36e1916824b875204d7f9f2faa52375b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724536, "uuid": "b8c96d23-3346-4654-b331-47eeb80baf2f", "comment": "Malware payload (Formbook)", "value": "4adcbf339a33c2a5a27fa231c0334ae1cca17ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724536, "uuid": "82b6ca17-59f7-4e12-80a3-1a3233a6ddfd", "comment": "Malware payload (Formbook)", "value": "1f6e6d899c8c9de33b44ac5c5fb0ef948e9999354b1502e9caf6df42b5b498ef1f80d7b4a1ad50fce451ec1343dcbea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724536, "uuid": "19ad7322-b823-4fea-8bf8-8477e2a52d9c", "value": "82258CF8F198A8B4D15ED732C3909CADEBA152FE53038A6C06A5DA8C1F1378ACF4D455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724536, "uuid": "457fa999-edee-45d1-a5aa-7597815d3bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724536, "uuid": "8c18db3e-d240-44e7-8097-2b1a26dc0f6e", "value": "12288:PMOCKAkrOZJ0EetGACIoULaMs7PblgeG+yOBvT:+mq0ESGpI5LiPblgedyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724536, "uuid": "06c13aab-e170-4688-8707-e0a087de6317", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724536, "uuid": "339aa660-8da5-4f5b-b09c-ecfd6a8e0595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724536, "uuid": "070e093c-ad13-47af-bb82-eed5f2af8bf3", "value": "DHL Shipment Import DutyTax Payment Alert.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15c1af4-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622738176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738176, "uuid": "4535d8b0-4201-4fc7-a27d-f8a486220847", "comment": "Malware payload (RaccoonStealer)", "value": "017dc540caec3dc0cf35c5be5c83ead3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738176, "uuid": "d4cc0b98-71ec-4643-9b25-4f4ddc723176", "comment": "Malware payload (RaccoonStealer)", "value": "afa7f830663555f46ce1f944605092c8259dbc9f36970d7305588d56ba03c728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738176, "uuid": "784894f0-fe9a-429c-963a-fb12e435da7e", "comment": "Malware payload (RaccoonStealer)", "value": "069a54181efb02477b009721ae2c1749824cfaf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738176, "uuid": "71c6dc8d-243b-470c-92ec-317aeb66fbe6", "comment": "Malware payload (RaccoonStealer)", "value": "86c83aced3478edf7e1997233ca62687aa494d59b0737e4ecb663a330335275fb905383aceaeced2fe7c577cc04d92e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738176, "uuid": "c84018ee-9ec9-4a6b-a4a1-28f2f4a39e21", "value": "95C4D000B790C034F5F776F49ABA82AD6A397DE1676490CF62D526EE56346F0AD30323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738176, "uuid": "06b68252-8371-4f27-9e09-13830fc38387", "value": "1736d54edbb0bc75969c6531257cd3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738176, "uuid": "47c108a6-fd02-4a07-85f8-20ac5ac90c4a", "value": "12288:vAXCCdRQs5EuUUmDgqdh0I/IpOTQJuj8Su:vA3us5KD5rr7cJuBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738176, "uuid": "3541cd9f-7e19-4c5b-b1e3-d5ba1a9ec7c8", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738176, "uuid": "03c603cf-4952-4bb6-b25a-a2d71f309906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738176, "uuid": "5a63f35f-d9a5-4b35-9fa7-ca70613cfe9e", "value": "017dc540caec3dc0cf35c5be5c83ead3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d186fb1-c487-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622737203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737203, "uuid": "acfb05df-7945-498c-b196-d4efc389a859", "comment": "Malware payload", "value": "ac2fb4155b5e5823a0e140722976aecb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737203, "uuid": "67236a02-86fd-46d2-9878-76d71156c6d3", "comment": "Malware payload", "value": "afc4256312f7c930056fc0ca31d1893568f142cf9c810e0e765749bd43fea6dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737203, "uuid": "6bd97ab2-d5b6-4a42-9d96-7476ccadfcdc", "comment": "Malware payload", "value": "c6315b8c81e63cddf6ff2396b10c545cfec4a750", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737203, "uuid": "2eb11d80-3e69-4941-8381-7d4f6bb17527", "comment": "Malware payload", "value": "eaf1915b6abbf217d5ade36bd7340072d6478aeaf06291605a165fde9aa90318e3d3d5ea107ab851272a7614aa0948ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737203, "uuid": "00fe0ad7-c1c9-4074-ace0-27d639ffdd28", "value": "0C91C6B656B81887CE42A27ADAB0FD2253E7F24684CB1F84B27EF9F4071F3151921651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737203, "uuid": "d08dac48-7bdd-4af1-a380-c8ba82d5bc2f", "value": "96:cFLp7O4eYOl5xUAEQABV1HdE7yRSr0NwOe6/qjMCEUNJRnWiFxG9z:wLp7OFl56AqBzOuAhOeXMC9nWGGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737203, "uuid": "76df0a50-3b8b-467e-870e-8fb3b207e31f", "value": 4330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737203, "uuid": "c0acd578-4937-4fbe-af7b-bf860e95097f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737203, "uuid": "3c1bf9cc-93af-41e1-adec-def6a466462c", "value": "RFQ-9010543.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef006a4-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699249, "uuid": "fb7ffb2b-2abd-410f-9db1-62b6b9180714", "comment": "Malware payload (AgentTesla)", "value": "21ab3f0250d6a797fae7f179e428c539", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699249, "uuid": "d7ab7a81-aae4-43f2-9f5b-1c9a1f68897f", "comment": "Malware payload (AgentTesla)", "value": "b0fb5eb8dad64e67ded64e20c20075ad3198295ded5646c9cff81cdcb527f6b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699249, "uuid": "32998845-38d9-4366-92b7-98f06536f4c4", "comment": "Malware payload (AgentTesla)", "value": "db5700126f76ac40f4fadb7c1dd3ad69a5bc02f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699249, "uuid": "f873c51e-813a-4a98-ac06-03cff3b505f8", "comment": "Malware payload (AgentTesla)", "value": "62c8d48a6c5dee90c47c32b0f2c1198a43ac494e58fe8cac6b70aa8d974a0ca0961f37e0559a67445eef1eba900bbc66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699249, "uuid": "ccc43edf-28a8-4e9c-905d-523eb4340101", "value": "F0D43364DD6E26DDABB72A7285913DED0FAC5BF722857A70892004CE70F0B17E9740B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699249, "uuid": "a14fadc0-d986-4af6-830e-bb6cda0e28a2", "value": "12288:3K4SKF5pI9VFcG8cxcoxXKj3bCWEx//4kL0h9mFTcxGuveUcK:3pFTI9VJfiOWi/HLAmTcxhGUcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699249, "uuid": "b5551bb7-cfc6-400f-9589-cc7ca043f7ed", "value": 620741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699249, "uuid": "3dfda411-cf39-48dd-9df0-a7d01e3fb0bb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699249, "uuid": "6e40ce0b-bd1f-4bbb-9a64-c7c5c2720621", "value": "Bank Details.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb6ca5a-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622699438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699438, "uuid": "73232294-3690-454b-bb98-45ad292df8fc", "comment": "Malware payload (SnakeKeylogger)", "value": "94ce48634fe064dfc8f1abe5ea671c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699438, "uuid": "42071312-33c9-4615-abcc-6c2d81c9eeeb", "comment": "Malware payload (SnakeKeylogger)", "value": "b1c2eb2fe7296e6138b720e8afd126b79ee03f5202065473ca1bb1779a4050bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699438, "uuid": "56614ea2-b8a6-4400-b598-dab7de14f35b", "comment": "Malware payload (SnakeKeylogger)", "value": "3b85e1a7fb90b5d750de0b9d123b8223ed8a8194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699438, "uuid": "627cf39a-f9c3-4283-8d60-79a16288921f", "comment": "Malware payload (SnakeKeylogger)", "value": "f6221235f37e37622c4b5c1076ed9e704255d58e911b677c292cfef1703b1e63083b21fb8524abd0cac49136cf87f7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699438, "uuid": "7f7df5f1-5600-40d3-8c46-e3d66dd1eef3", "value": "1965B492F6958D38E249CE73CDEF981C63BD85B51A132F394FBE46872E11372C948486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699438, "uuid": "9e86b396-25cb-4a32-8ad5-7bcb8d2fcad5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699438, "uuid": "48eb3d3e-6e51-49b5-be82-3977ce625c62", "value": "12288:USK4CsKIBn3U7TNMssWpuOi3lcLk95mGfT+X2tRFAxgAhT/rfUZkmvT7:T5N3U7SWp5i3Ek95mw3chTuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699438, "uuid": "20a35c83-1f23-4e10-bf5b-9c6d503769ed", "value": 1542656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699438, "uuid": "8ee3cefa-6fc1-4164-b76f-ae9dd04b8a85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699438, "uuid": "527dce40-2864-4d5a-877c-ec4d3350e1a9", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6510a3-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622717847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717847, "uuid": "c7825bb8-9d33-4f34-8c21-25d1fd4be65a", "comment": "Malware payload (AgentTesla)", "value": "7ef8c8b59bb20eced74215a454deaaf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717847, "uuid": "819f2692-ed64-435b-9e8d-f63c76176e92", "comment": "Malware payload (AgentTesla)", "value": "b28e292f639bad240b06ab801e01cfeb3abc86170f493806d4f9477e5383486e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717847, "uuid": "59cba1f8-826d-4c78-b537-6988d23b257b", "comment": "Malware payload (AgentTesla)", "value": "79bf57be5656f4c503dbee92828293b93037a792", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717847, "uuid": "3b04273a-a1a9-4c78-98c1-128957a8e35d", "comment": "Malware payload (AgentTesla)", "value": "924d330f74e9da98e317889f8526a125d50b2501f75d68a7115f8a629b115a7a59d406fbb7293bcf98c0797d375ff86e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717847, "uuid": "0e68f37e-c8a4-40ea-bcc8-1765be9ce588", "value": "AC5508A8F984D86CFA55F334EA1819F9836F93A5110E3F3DA21DC1582E7B7058B98C53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717847, "uuid": "14cf977a-3f86-45be-94ec-0c604380348d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717847, "uuid": "faa58e1e-9a94-4d03-b679-0efb296b9831", "value": "24576:s+fUiAQ5qJs6aiUVczinmTJ9XRdbsmeehMJHAZLSq:s+8iAQYUyzym1VvQmeehMJHOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717847, "uuid": "b48d1895-231f-450c-a2f0-39f60f0c0f81", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717847, "uuid": "3bf0aacb-7f0c-42a6-9d09-24bc36fbdfa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717847, "uuid": "eeaf20cb-cf27-4cae-8409-bf4f82096f90", "value": "SecuriteInfo.com.Trojan.PackedNET.796.21363.17958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781a03c4-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622724283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724283, "uuid": "2e2bcefa-7690-4ffa-8af5-bacfb8ec575e", "comment": "Malware payload (Stop)", "value": "570fbe91fdd6d1eb8cfd2f03c032cdde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724283, "uuid": "17d9c805-5776-4436-84c1-d607d5cec2ec", "comment": "Malware payload (Stop)", "value": "b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724283, "uuid": "965e9e2d-dcd7-463e-81c9-115da589a1cb", "comment": "Malware payload (Stop)", "value": "59d07617c682fed330d82b1d97f1bf32c30c6ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724283, "uuid": "198294a2-1c37-4439-aa13-4540d7a4a9c4", "comment": "Malware payload (Stop)", "value": "74b00d0f8cec79dae43d989b6701f0b3ab44cf6309eb7c7090886d8bd543d1c67feddea5ae74a6935c0de59347a27343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724283, "uuid": "d6741d97-2126-4ed2-ab29-c63ef57a8ad0", "value": "E215F100B6B0D034F1F215F4997681BBA12ABD60BB2491CB62D427EE7635EE1AD30F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724283, "uuid": "c644ad16-d74e-437d-bbe9-6f4be96c687c", "value": "ad8bd715488c60ebd0287d0239f0c2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724283, "uuid": "b3780fd9-7267-4f5c-912c-ee29e1b662cb", "value": "24576:INlpvz4LHTBeBykHNnCGMl/CdHMQ4lpMS:Iv+HTBegXFhCNG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724283, "uuid": "dafe9a0d-b41a-4391-b987-1d220cf05b8c", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724283, "uuid": "3ddb8cdc-77ac-4153-88fe-b4e6d5979e66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724283, "uuid": "b418bd38-573a-44af-b1bd-407e1296c6cc", "value": "570fbe91fdd6d1eb8cfd2f03c032cdde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c767a010-c458-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622717114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717114, "uuid": "b12f8c22-845b-4505-8865-7b988884f884", "comment": "Malware payload (AgentTesla)", "value": "e1fedc10f7a332fd18387b62fd0c8174", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717114, "uuid": "4fb08492-b872-4745-81e1-6dd0f7268d6c", "comment": "Malware payload (AgentTesla)", "value": "b4dc60b514403aaa01b862023671629d5db9836642e56bd618a3b77052fd7fc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717114, "uuid": "cc769bd2-c7aa-4dd7-8446-02e3fc126287", "comment": "Malware payload (AgentTesla)", "value": "65b18014578bcea332ef1a9c9233a37fb6d9bb85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717114, "uuid": "77323bb6-6fb2-4e16-811d-faf4cefff098", "comment": "Malware payload (AgentTesla)", "value": "47d1e6287f512209d48a477dae0d222665905443819ea298b4b7442f7fb092c4d5e71f13ac3d8f472744b537d5f64cf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717114, "uuid": "7f7d0a72-56a6-43ec-996e-833fd422cb22", "value": "5E455CF8B6948CBBE15DC631C2405CB9A7E01CEA1A87A50C9AE4778D1F63F87CB6D444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717114, "uuid": "f5686249-2976-417d-88e0-a5824aba9ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717114, "uuid": "8184ac65-2333-4423-a959-e4393c837c18", "value": "24576:AQt1BaWXKSgykMpQ+APjNlavflw6dd/lLDjVWAL:wSFkMpPA6ffnLFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717114, "uuid": "422bba97-81f3-44d5-96d7-40ea538f3661", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717114, "uuid": "c40ebad2-0491-4ea4-a5d8-08523c6d535f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717114, "uuid": "aae5c6fc-bfee-41dc-8fcd-e6ad4d8147c1", "value": "Order # 10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a232ce8-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622703241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703241, "uuid": "71b46860-833a-4272-a6a1-b02983045cb4", "comment": "Malware payload (Quakbot)", "value": "4202199ba0236c1df17b30f5f52bf84d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703241, "uuid": "c561dc83-dcd8-4516-9f83-e432af4126f1", "comment": "Malware payload (Quakbot)", "value": "b53f44b328ba80f0b95e458ab310b5ba165610d2564d0b9a4c5123474e14eefb", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703241, "uuid": "da1d7c03-ab43-456b-85c5-c7fed9b3510a", "comment": "Malware payload (Quakbot)", "value": "c7fff9f33e66509978b529f605e3340a5b6e1120", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703241, "uuid": "3208c544-3a3e-4cbc-834c-7fd5cdae0e38", "comment": "Malware payload (Quakbot)", "value": "bc09a6625e6d607ebe531964df55513c5aa26b39b499bb3909b0b63b2c9c4a2d3a0f53c575e44210343f0824d79f392c", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703241, "uuid": "27760df1-1031-4bed-90ae-4ee6926712b1", "value": "1174227EE28169F4C3398C3ED244A1D0C295F1D050A7B31D07DD3528A7532AFAA5E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703241, "uuid": "0dc17fea-bb07-4dab-8ff5-8c0916562f6b", "value": "6144:IMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZN9:fRMmEv2Bc/nvm8IKABfsYOmauFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703241, "uuid": "89811875-ce20-4fca-84b4-a9bec6f3cf40", "value": 346073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703241, "uuid": "612c83d6-c7f0-4cc2-a05e-7f1f729b5442", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703241, "uuid": "6f7fc7cc-4038-4eed-939c-8e9c7b219753", "value": "Document_06022021_1157730537_Copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e9dbc1-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622700073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "0d1eb70e-695c-4892-b57a-82ea99f7bc74", "comment": "Malware payload (Mirai)", "value": "86bdfc400be83de2ec30cb16fd7ac5c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "0c6d3cee-24c1-4d44-9ce8-4e6c3e3ef6ab", "comment": "Malware payload (Mirai)", "value": "b67b0a164de7917796a343ed1582b72d90dbc346313afd41bdec1a6123f2069e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "a55057aa-c1dd-4f32-912e-56fd7966a2de", "comment": "Malware payload (Mirai)", "value": "fbaf1557be118953afc5ce3c906ec51a096f086e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700073, "uuid": "1cdae312-beb7-4717-be95-0193b761858c", "comment": "Malware payload (Mirai)", "value": "3859cd7dbaae1a1acbe95f38436df8d690bed7b4426bfc741317bc1ee2189b0ebf07a6fce9dc848082b4544fc7833346", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700073, "uuid": "59867c79-d2de-4045-ba4c-bddc3c66303d", "value": "F2934B80B604AC32D18C6D37B7FA974B3F2751E49A92D501D445D7CEBB8FA80DA184EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700073, "uuid": "66b344aa-a7a0-4a11-96d7-b356d0cefba2", "value": "1536:3zxVxT8KT+VKHvYvrEFSKmRAyeGhgrDUFEqmElseziPep49VyU+U8WP:3RT+Vmvo4SKAAyeGSrDcEq5H4ep4by4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700073, "uuid": "e6f4e4ea-2f2f-4ee4-88a6-a9b67eea0d23", "value": 95312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700073, "uuid": "0562faa8-2191-4d4e-b2a1-0a0a98e86666", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700073, "uuid": "67cac369-0c59-49cd-ac69-cbc99cdeadb1", "value": "mirai.arm4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2b143d-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734594, "uuid": "e4267398-3d31-443d-aea5-8f5e5987af8b", "comment": "Malware payload (Gozi)", "value": "ecc4e73f710d096fa7fd8573a999883f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734594, "uuid": "11125318-a480-492a-b519-152b816d43b6", "comment": "Malware payload (Gozi)", "value": "b6d47431005c53645b469aaae5c0531bca27e9d11d014755193aa74c3f228ae8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734594, "uuid": "8168db17-63ec-498d-86ba-d6421ccca1c5", "comment": "Malware payload (Gozi)", "value": "6b17f6e11503689592ee647f27a4e3b889156c11", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734594, "uuid": "8a2ee426-a0d0-40cc-a8b8-254c7fd85936", "comment": "Malware payload (Gozi)", "value": "3abd77cecbde008bbce8784c08717ec211d1a36a193c1945dba33acb8b33d617f8924159ea55039a0e9bf57b84f262b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734594, "uuid": "26f50294-e984-4c83-8ba3-75405eb990b4", "value": "04D49D507582F036E47214368FA9D9F90B28BC015B290ED773F81F6F5E6D9E26A31722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734594, "uuid": "fc11ba40-5754-4293-8e2a-cda8ee5d18bb", "value": "d6ffae5d966e71277978ccdc1a61df7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734594, "uuid": "aea9360e-6069-4628-99ab-f92e92a54b9b", "value": "12288:VvrXkk/47lD+LKF+KCCfJXAokh+q4KlqXP2IlqKnMgV:VjXn/47lD+e3CoXZk8m4pfMgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734594, "uuid": "ad56e58d-b174-4950-b7d1-727d8f32bf8c", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734594, "uuid": "1fd7e4e1-f0cb-454e-8b78-bf52ad0bf692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734594, "uuid": "d805f57a-b3f3-4047-ada8-a63d7935fd56", "value": "shook.vob", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a479b1-c48c-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1622739383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739383, "uuid": "15104f18-0a76-49ae-8555-052db7153e76", "comment": "Malware payload (AveMariaRAT)", "value": "a24fc1476d5da0d06ebcb6924a02bb18", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739383, "uuid": "8ba99525-c5fe-4201-a832-7a3bef572105", "comment": "Malware payload (AveMariaRAT)", "value": "b7ef9f5137720932895dbc0e1231e71451eace1e82f2baac3e208c969ec1e966", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739383, "uuid": "4df103fe-a8e0-47f4-82ac-3acb994c1caa", "comment": "Malware payload (AveMariaRAT)", "value": "ad06b3b5025b8dc5bfbfbe01de15ea2d7898c64c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622739383, "uuid": "442b4c9b-d8e8-49da-bae0-b295662fa1a4", "comment": "Malware payload (AveMariaRAT)", "value": "c11e5d4af5a7c80a1881af87cf4eb91766963e3f82ea6197839332291ff63b8287df8aa62ec005e6b90365fa56fa9ff6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739383, "uuid": "0152dd7e-1892-4874-8492-66fabe2591cd", "value": "C635E02AB7917A9AC1090F3AC867098493F190477373F76FB8F537D40E2562A672F606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739383, "uuid": "6b072337-e3ab-47cf-9ce2-5becf554400c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739383, "uuid": "119d1b08-8bc9-4576-b12d-043c03c83ff2", "value": "24576:7tujR144jWgSCFEBNk8AMgPEmRol6NCErJYj:8jMSZl8AB1+CCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622739383, "uuid": "bfbd03b5-76ae-486d-8a5f-70dba47836e4", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622739383, "uuid": "3f06227e-c3e5-4fc8-8554-5f9564498b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622739383, "uuid": "8097b7d2-8030-4bf6-b26e-b539e27a14ba", "value": "a24fc1476d5da0d06ebcb6924a02bb18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e80467-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622703292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703292, "uuid": "13a32de3-2979-485e-978f-cabfae0e92c7", "comment": "Malware payload (AgentTesla)", "value": "cae89562b7ef7dd9f4789462757f530e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703292, "uuid": "e512c3e8-f256-47c2-94a5-8689682c81e2", "comment": "Malware payload (AgentTesla)", "value": "b8f310dd22b42fd66ce8f3242be9c3a36da8ec08951b2913b593d8208252a1db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703292, "uuid": "514fb42f-f085-4ff5-99bc-4f4d7f244ea5", "comment": "Malware payload (AgentTesla)", "value": "55fbf22e1aa32a591e0ee9a2d3a7f790c4b36dd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703292, "uuid": "ea8a149e-d443-4f9f-9574-49cd0023d87c", "comment": "Malware payload (AgentTesla)", "value": "b9ca721afdf24bcfb6e52dc3e7bb0b2576385d4cde654147316d9bff2ef7417d2f271a731b3438010b985ab53ecfe1ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703292, "uuid": "1baea7e0-0eb1-488a-b67e-ef655b8835c3", "value": "EA75D552B5D2DE28E20B86738DDF5E4C77BC82F50A012F38FFB355982E62B52958C446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703292, "uuid": "d140eb1b-73b7-4b74-a3f4-f075f5ab12e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703292, "uuid": "566dfac3-1dfe-4e48-8135-f3bb7b8fb56a", "value": "24576:JQY+FOT2UJsQS6Pl6nuSpHJ7WrUfoSMKd:JQYEUQ6NRSpCUf0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703292, "uuid": "7777c091-cae1-463c-81cb-0bda0f0ff5d5", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703292, "uuid": "2f07bc1a-2f6b-4cc1-b9c5-df460183870a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703292, "uuid": "bf737f0e-e2b2-4c77-ba97-3f5916effe7a", "value": "Scan doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23aa72c-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622738124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738124, "uuid": "ea2c3441-c09d-4e0b-9f41-29f443661533", "comment": "Malware payload (NanoCore)", "value": "c33cc281834ca429da214b799105adf0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738124, "uuid": "268fcc46-5ac3-4d9f-8ec7-432372a43d21", "comment": "Malware payload (NanoCore)", "value": "b8f50fae9d9948276a249c9ccc91a79310df4fb782b795cfafb3852fb47e4c8b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738124, "uuid": "9f36a4cf-7e41-4158-8cd1-4af4d2c928bd", "comment": "Malware payload (NanoCore)", "value": "b93d23798edc7b2c57eca2e53c2468f2ca77cfc2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738124, "uuid": "63416112-6fda-4944-b33c-626357a4f39a", "comment": "Malware payload (NanoCore)", "value": "65fd22da3cc4a55610f716cb02fc31751c0e77570b4feca6d7dcbf9ccf74cda84fc66eb1bc5b4072ad69d1f80ee2b189", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738124, "uuid": "a62b0cfe-eccc-4951-8898-2f18196d5464", "value": "8D84230A3F20353B9336BC2465088259B2BC4BD957709C6C8679628DFEA74C33F6BB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738124, "uuid": "dcf77a7b-8e85-4995-95d9-797d2a7267ba", "value": "6144:T/3OpxhbL6eX6rzoryKpSUJXMcSTlBScHpGXHzLAJMD6G2abX6hzmobpBe9mdjU0:b+pqTzorxXGlBScqAJMgabWaobW9mdjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738124, "uuid": "44dc9dbb-cf35-4b46-979e-9169bf0cf2c9", "value": 384882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738124, "uuid": "c76bb90f-9bd5-4337-972f-9033082ebb52", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738124, "uuid": "58a44d2c-d0b8-4e2e-9b68-f26b6cc2514e", "value": "PDF 209467_9377363745_3783411527.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae9324b-c441-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622707215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622707215, "uuid": "638437d7-b8f1-417c-bbd9-f94563aa0499", "comment": "Malware payload (Mirai)", "value": "598845e597ce148c251f0be1a20cbd84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622707215, "uuid": "fb068deb-13f6-4953-8d46-68db7f09e992", "comment": "Malware payload (Mirai)", "value": "b97432e2fb8b3cbc59bc4e496d506787b7f25f5a0da7345200d434060d39796a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622707215, "uuid": "06b44dd4-bb97-4820-b9db-4554b1095712", "comment": "Malware payload (Mirai)", "value": "a63971a8ebb7cd8d2270f055bcaeeed62c1f45b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622707215, "uuid": "3d6a8481-2e3a-4b02-9ca1-65769830abe6", "comment": "Malware payload (Mirai)", "value": "854e519113a8a6a83dad412f7f071af9491cc96f444742e8640cebbcbd573d1bbaca21a97ed93003be758cbaff38bd72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622707215, "uuid": "37f32e3a-5f77-454a-a757-4c99c8a585ab", "value": "CAC36B22BE56482BC1E9723E52F78330F4E7274960B88F1E7EA30D8DAB357542527365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622707215, "uuid": "b8f41123-8209-4610-bf95-4a5263b26324", "value": "3072:G8l8Wf13o808ALlW3l9ny6kwuQNg88QLUywTmEc:GzW8lW3l9nyjHQpDUdPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622707215, "uuid": "bf2f8268-6d0d-4fee-b794-11b1a8205575", "value": 127504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622707215, "uuid": "79be2e5b-1df2-4f4a-b83c-f6c300aa4cac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622707215, "uuid": "cdc1b476-f540-44b0-9e2b-211d44ce8eb2", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0956c0d-c449-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622710687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710687, "uuid": "e1dc87b3-c7ac-4a89-a50b-b9280b4cdb20", "comment": "Malware payload (AgentTesla)", "value": "62076932340efcbb9318f7310e4685b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710687, "uuid": "e0d00cf6-25fd-4a68-9699-3377b7222b82", "comment": "Malware payload (AgentTesla)", "value": "be8e26740538a54b9fd6f9a1be079d91f59224885e78c832840dee42250dab77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710687, "uuid": "4193d1d1-e181-4b94-b638-4b026a683a51", "comment": "Malware payload (AgentTesla)", "value": "cd9c1249133284bf7311dee81f61f77f565f24c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710687, "uuid": "e40cdc09-acb6-4f7a-a604-fd5e5af61931", "comment": "Malware payload (AgentTesla)", "value": "d28dcc50528e38cc2a3586f1f4aa7797ca4a67ab9bf3f8e5d1888ea279e58ea78b3b16fb321b557e31ff226b9799f9d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710687, "uuid": "2ece1822-f56d-4065-bbd4-b9c53e114af0", "value": "24452348BFC1AB93C41F5F75510A2ABA899EAD9233D5E0577394B3B121B6932024FF0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710687, "uuid": "fa5ae1b8-5a67-4953-bb9c-bda59a07e380", "value": "24576:ScbM5/Kl3w8s1u084hOEY8kBjwOXA8CiKR3k98NB7FshAgqMVEowKI:ScbMwXs1u08lEY28YR3Jb7FoeB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710687, "uuid": "8eb738a7-f1bc-4166-8ee9-9b018c8ffa07", "value": 1271880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710687, "uuid": "89bd8ecc-bcdb-4097-a3d6-5ab2b2cf5928", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710687, "uuid": "ce6e9b91-c893-4580-8637-84daf9b1cbaa", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d190166-c458-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622716802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716802, "uuid": "a5a0899b-8139-413d-b820-c65b1f0ec2f7", "comment": "Malware payload (Formbook)", "value": "bec2e8c1264d79aefe707625576f4466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716802, "uuid": "c4c116d9-24f1-49ac-8301-532f194497aa", "comment": "Malware payload (Formbook)", "value": "bfc5459f5283fd7fd1026ac6b8da4dc47a73abb4744f2704451e8796925c1024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716802, "uuid": "84dc73f8-d03f-4338-bd67-bd82f59577a4", "comment": "Malware payload (Formbook)", "value": "a50c3c756aba6d07cc1bbf0868c377616acab000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716802, "uuid": "fe86951f-ae01-4237-a820-3561ab0b2924", "comment": "Malware payload (Formbook)", "value": "663ea4a969a18b2cfbe05d8bf6b0d7ad61d7c10f6f0a0c834e500773a56c0c53a9e43633aea4ea931a5f3b458cf499bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716802, "uuid": "d760e7ec-8264-45c3-8ca4-1e8d71c25986", "value": "26754B6C73A0D893C01DCB70A55CDBBE17A12CBE5752C52D36B4B28E3E13BA58E25436", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716802, "uuid": "21c7cae0-d3f5-48ef-a4ac-264088eb1190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716802, "uuid": "a110b311-da3d-49c1-9dba-b7a3950ea8f7", "value": "24576:Z40MY7bFOBJrQIEF5jRbMYE6cn+RwwriwaA8hnhGVg4oB:Z4yMdn+Rt/18h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716802, "uuid": "f251d9e5-fa42-42ae-9890-6ca463b410e5", "value": 1646080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716802, "uuid": "1dc7e26b-82b6-42f0-9396-822754c7cce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716802, "uuid": "59260664-0a79-4e4a-9617-db6b7748dc29", "value": "Revised_Order PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae44d7ab-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622724373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724373, "uuid": "e9c00249-3c37-46c4-bf21-c26ad6d49d9c", "comment": "Malware payload (Loki)", "value": "d8a0e96605bf9ae5340d6c7e98b2bead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724373, "uuid": "5749d6e6-3c50-4d15-9081-f55cb90eed2c", "comment": "Malware payload (Loki)", "value": "c05fd4fdd43626d0d5191e234b7c20cf778b583fb8be7bb65e80d1a50cff5623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724373, "uuid": "b1926ef5-6c66-41b1-9f42-0a6da3e7833d", "comment": "Malware payload (Loki)", "value": "dfd08b01cd3949ef1670eaf59b7b8dda0469f1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724373, "uuid": "fa1035e8-2d19-41b5-b300-a696b62adafa", "comment": "Malware payload (Loki)", "value": "b8b271575e43bc773295147b870126506523a15cdd4cc6e20b4fa9cb8a0d5db28eb5b22548f1bd59ef798f01bf0c96f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724373, "uuid": "ed1fdf51-54c0-41e9-bf44-70e35cd3b961", "value": "5E156AF4F19898B1C54EC772C690DCBEEB211EFE5203092D05B9FA8D2A3379A9F58445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724373, "uuid": "dd9bcbe2-623c-402a-ae54-fcd7721a05fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724373, "uuid": "eaf167b3-b4ac-4c51-916c-4125d2b99d3f", "value": "12288:5807jvTJWqFZX7GAkvoNqr1qqhSd2+HKL1C/AX7c:pFqvgC1pS0VE/AX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724373, "uuid": "4814a66f-f2a8-45a6-857b-aed63ae50868", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724373, "uuid": "5fecc0e0-9a9e-4a9e-82a8-7d68286b79cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724373, "uuid": "9f44b900-11b6-468a-9327-5af0a5c94fb2", "value": "d8a0e96605bf9ae5340d6c7e98b2bead.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f9a1d0-c48a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622738394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738394, "uuid": "94144378-6358-44bb-a799-4912c608d205", "comment": "Malware payload (NanoCore)", "value": "72c9dbd2555b9a77c49ef0cb89ed117e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738394, "uuid": "de122f6f-d078-4876-8f4b-d44b905d288f", "comment": "Malware payload (NanoCore)", "value": "c1d8805a1d4e64b46121ec6b9b21225c26012a296632c58495d4dc8d845aba8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738394, "uuid": "9f6df643-d13a-4584-b4ca-f1c7aa8bd9dd", "comment": "Malware payload (NanoCore)", "value": "fcd64159cec199c9cca5ee2dd3c23c8876c7c82c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738394, "uuid": "f0c6c0c6-9dfb-435e-8677-c34cd6c39d35", "comment": "Malware payload (NanoCore)", "value": "a8e5eed722ff36d0dc7c9d6a614e65efc5c49bdebabdf5aeee56fcf1bf6e6dad7f932de3403b7a713157dbec48924909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738394, "uuid": "2444e3f6-4b4f-4304-b6a0-b8d0f49cdf3c", "value": "84C4DF03EEB6EE37C7F179BF0004B1141E2C5E954DE2748A74ACB189FEB3946DA42586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738394, "uuid": "339eb12d-0817-40c6-b6e3-022a2c58c8f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738394, "uuid": "9e9d1164-427b-4ade-8c1d-00b52b7a83bb", "value": "6144:sXSONcmCW6rzoryKYSUJXMcSTllScHpGvHzLAJMDeG2aba6hzmobpnfDXw:ilNEtzorAXGllScsAJM0a+Waob57w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738394, "uuid": "2c0d2905-f753-4aa8-a4ef-6a8b1261d751", "value": 549520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738394, "uuid": "c7c77c0e-afd3-419d-80db-76862bf51e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738394, "uuid": "70c50f4c-bc28-4bf5-acd7-a6ff74855e4b", "value": "PDF 209467_9377363745_378341152.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9385740-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622700313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700313, "uuid": "6243e67a-3a0e-468c-83d5-7b57b67747ba", "comment": "Malware payload (SnakeKeylogger)", "value": "7b1af7564887531abe7565e16c909dbb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700313, "uuid": "032e0343-d6ee-412c-a5e2-1208465dbe49", "comment": "Malware payload (SnakeKeylogger)", "value": "c281a7861483a39ff4da8236c5b2a202f88562caa737f4d7060049fd1b5fb980", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700313, "uuid": "25fbdada-ef01-4b75-b97d-458661fd637b", "comment": "Malware payload (SnakeKeylogger)", "value": "27b365f3952cbeb38febb5cb6d54476d7dcf04da", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700313, "uuid": "6c9d4b5b-763d-468e-8acd-32b33cec5b60", "comment": "Malware payload (SnakeKeylogger)", "value": "21147655d543367f7d1e9db72b3cb01bed3a24dd29c5f75f5648aecfbc7b8527225d9d52fb030344397c411ad9d5a4a7", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700313, "uuid": "d8816dba-db1f-427b-8b38-e791073bdb90", "value": "939423219C0A16190CBFE03DAD1E9D526F34A0B76A7369279B82B3018FFFD653522734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700313, "uuid": "4bf1c041-4dfb-416e-b7de-0a69eeef0515", "value": "12288:Qd27oyaMdmHlxBRSVFED1eIZg2RYc6cvpq9rhrJzO:QUDaMdtFW1eIZgSGcaFlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700313, "uuid": "4b19497d-9794-452e-88ad-9b62db37e30a", "value": 443150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700313, "uuid": "92d1dfc3-ad63-4c7e-9749-00a66f105572", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700313, "uuid": "68037d12-3e12-4006-81ac-bf2f2ff46896", "value": "Balance___5132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd7172e-c467-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622723302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723302, "uuid": "e448cc0b-e1cd-49cd-832a-e60ebab731b3", "comment": "Malware payload (Formbook)", "value": "e72c4d350d8eca854c521d455f3a224e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723302, "uuid": "609ad622-59c7-4573-83c4-35b0daf88275", "comment": "Malware payload (Formbook)", "value": "c3ce9a925d6648a3fa48d02e7640a0d541435651585f11aa72bf8c66a63522ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723302, "uuid": "092c5760-aac9-49cf-9263-028e5d436b39", "comment": "Malware payload (Formbook)", "value": "920087a9c54987a8bf6ca21403c8e3ee2a3f902c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723302, "uuid": "804f4292-4515-4a8d-810b-20139ccb6bb1", "comment": "Malware payload (Formbook)", "value": "3fc338dcaf517eb861d9e19058b7b1bf7413af8524d6071676566bf1751fa906f1f9a45c3235812b2a8f1a2924c997f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723302, "uuid": "977cf90f-82e8-4bd6-961c-bd021b9a0f71", "value": "92C437722E43C055C9AE0FB1FD26E2C25F9A1DD905A4F2612EFCB2691DB0E8B464137D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723302, "uuid": "9b2b10ed-e3cd-47d5-b504-e533886697c8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723302, "uuid": "96c5ebe2-b962-409b-8415-163239e334f1", "value": "3072:tLk395hYXJa3a+MbK3i9GFcwJMeRXK0Hw1bl1HOR0q1ZWz1IuWLXCNF6Rjfnp:tQq482wGF3ZXHQN3uWq1wzOLSN0Rj/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622723302, "uuid": "6391a631-71f6-4428-9fed-fb19c0ad55cd", "value": 588346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622723302, "uuid": "bfa543e0-e4e0-43c2-a456-c510a365e3de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723302, "uuid": "26561de6-2709-4467-8a8b-33c2170ef83c", "value": "SKMBT41085NC9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f235e7-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622724363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724363, "uuid": "38c53849-badb-4cb3-ac2d-a8c9cea898d4", "comment": "Malware payload (GuLoader)", "value": "2d43c9fc5eee0658f1ebdef9d2e4c184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724363, "uuid": "3fa74ab3-cacd-4d51-a37f-c8b08fe86205", "comment": "Malware payload (GuLoader)", "value": "c5615a2ab19a2bcd8d33b5a721f04d09218103cfaa4005ee044fe3c583f09d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724363, "uuid": "4553cfeb-50f7-4a7b-80ef-c9d5517fee09", "comment": "Malware payload (GuLoader)", "value": "a3b96cd35708c5555363e365a1ab14f0de5f355c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724363, "uuid": "c9a2c638-948f-4ee9-9c6e-272bd9afdb25", "comment": "Malware payload (GuLoader)", "value": "4f2aa5cf447884657ce7f2711a8ab45c109c6678f65b4d044043842b02d1081443d0899ab9b406adef3b19ca90d7b03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724363, "uuid": "6fa09981-65cf-4026-bcac-abb1ec0071e1", "value": "88649363B721B165E00AF470F164E1BEB2147C72541A4D1BB6C47F6B2074AA7FAB4F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724363, "uuid": "27f84625-e921-46e5-b5dd-5346d870eebe", "value": "1b3a9d51a40f5ca9cef0b8379f0622fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724363, "uuid": "30f48d7d-28f3-4657-b9da-cc145a06d13b", "value": "6144:HY/r9qK/of83h9XT5FPosKZGN36DIKRdkCVsS13o3EQxH41I+iIy2ttd0fjtKpsi:4jstkzT5FPosKZGN36DIKRdkCVsS13om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724363, "uuid": "59341503-568f-4706-8267-22f68eb5d8c9", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724363, "uuid": "ecedd07b-0735-4165-a086-692458c926f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724363, "uuid": "41cc4d18-fc2d-46e5-bc26-0e481a56897f", "value": "2d43c9fc5eee0658f1ebdef9d2e4c184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549e5416-c467-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622723364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723364, "uuid": "a26ac568-4d55-4a4d-8943-a891e72aa573", "comment": "Malware payload (Quakbot)", "value": "46ffa2763198f08bc929c9b5384b0c75", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723364, "uuid": "b09328c8-1a5d-4ce4-84d1-54d9530fd82d", "comment": "Malware payload (Quakbot)", "value": "c652e67ab63853cd68f7aa4b78a12e6f6a7dc2cdcb1b3b410c6c2ed17ba9c72c", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723364, "uuid": "7a9ef5a6-b4c7-493e-8103-6edecec0060c", "comment": "Malware payload (Quakbot)", "value": "adebf51463bf96778b63bec879b8ee82fea191b9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723364, "uuid": "7fce9af3-ba7e-4fe7-8267-13eea033707e", "comment": "Malware payload (Quakbot)", "value": "8bf773fcfc88dc86a358486bfdac00ac3d85558a0b91cb99c47d48a8929ebb0449b504d1f07f2aaefd1cb733afcd6cba", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723364, "uuid": "3721d8dd-bd2d-45d5-9a45-3b5d3f5a5b48", "value": "8174127EE28169F4C3359D3ED244A0D4C295F1E050A7B31D07DD3528A71329FAA9E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723364, "uuid": "5267b6d1-d7aa-49a4-8e53-07aa17763fd0", "value": "6144:BJMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNl:kRMmEv2Bc/nvm8IKABfsYOmauFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622723364, "uuid": "1b66db49-1671-4619-9663-6c2fe84bb1a7", "value": 346062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622723364, "uuid": "c2dc1015-9275-4574-aeae-18f338a887ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723364, "uuid": "85be2007-a524-4804-a519-5c269dcfe898", "value": "Document_06022021_1135117076_Copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42c0143-c42e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699124, "uuid": "98f57e0a-394e-4bda-9ec3-28cbc4805e10", "comment": "Malware payload (AgentTesla)", "value": "d0119b64f832964759a81ccafd96db78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699124, "uuid": "dd44b693-167d-4591-8f36-6b29131f4ed0", "comment": "Malware payload (AgentTesla)", "value": "c8154fc702b6d57a98a25576319480aed8b53e991dd1460c04556b8dddc89ae2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699124, "uuid": "49d8961a-2f21-4e8a-8efd-d8a45c3f2368", "comment": "Malware payload (AgentTesla)", "value": "345e0de24b36292bab13f30f35c61accfcc3da65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699124, "uuid": "ca18dcea-6601-44d0-aebb-9e98e1640c90", "comment": "Malware payload (AgentTesla)", "value": "d2fed776b9f6b1a42d40049fa17417e86bb7cc6143308fe5f6f7fa4a6f56837924e08c763ce1650a8c3d98d3a25560e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699124, "uuid": "10f99a73-33bd-45fb-a568-aae5ca586729", "value": "C575E692B5A68E68E209CB738DDF9C5C42BCB2F517052F38CF735A482E9235BC51D846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699124, "uuid": "8e3fc001-ed68-4e40-8ab5-64d6af460c5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699124, "uuid": "bce14819-d476-4748-8f9c-c2a7ff6c7a8c", "value": "24576:CcNVrKLHmsXCK54n/52LdN9lJQ8c8EAkz:Cc8H7/5u/wJNfJLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699124, "uuid": "9fb6aee0-a797-48c4-bde1-92c7f0545378", "value": 1616384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699124, "uuid": "251c1f75-6371-434a-9759-17303fb27cf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699124, "uuid": "0b99491e-5f34-41ad-8cdf-f4a77c2815a9", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a2b043-c471-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622727604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727604, "uuid": "acc6f631-82bd-49eb-828d-06daf2804412", "comment": "Malware payload", "value": "340fc80338a3c3c557374768a228a1e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727604, "uuid": "a87bab66-a1ae-4509-898c-d59a7866921a", "comment": "Malware payload", "value": "ca487251774b268ea4fb14526568eb65726de88240a61ccd4a64ec937a881c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727604, "uuid": "2fa27315-c8e3-4373-b810-2ff32ea81b29", "comment": "Malware payload", "value": "e43732322034e32fdc11e9d5be1a86cf17fea205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727604, "uuid": "f675f4b8-2493-4de5-b46b-75884803add5", "comment": "Malware payload", "value": "c9131ff7ab67d37e7bdfddc5e835debf5b01c9b2275dfb415bf38cf5900fcded86e5f6e1604789f49f865f88c75588f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727604, "uuid": "bd65a229-63a6-487e-99d8-e842fd0dd2dd", "value": "399623DB5D4546B3C7ADF47220A33B3C022F987E6BDB4E6D851F3E0153721AE64A211A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727604, "uuid": "1fe7a2c0-1ed7-48ad-9fc5-b6775f73b966", "value": "196608:RlhWQ9T1tuGMROS6tfuyeYQj3Gkb+W6VnYlaynZqBHRO9dFyoQ4e:LFVq/ROS6c6EGkbmREABxIUoQ4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727604, "uuid": "ae4e277c-65a4-4d66-ab2a-ff1d7cd840c8", "value": 8772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727604, "uuid": "1b67f1ec-5c3a-4470-86df-e95a3136af9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727604, "uuid": "ecf30f78-c899-412a-8374-58e254319abe", "value": "SecuriteInfo.com.Variant.Bulz.498529.8023.16570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e1d19a-c46a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724631, "uuid": "a6f74afe-0ff9-47a3-a46d-1d467bc34702", "comment": "Malware payload (AgentTesla)", "value": "0c821969572fcdfcc89d5888c3fa9ca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724631, "uuid": "a8d83014-01c8-4fe2-b442-0e2db4addda2", "comment": "Malware payload (AgentTesla)", "value": "cae74acee7ad600bbcebd34c778533f1bfe03d930adbf3c21ea56b1730c4f8ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724631, "uuid": "84db72bc-74be-4730-984d-90e49579d143", "comment": "Malware payload (AgentTesla)", "value": "e633c4b611d6cd6907ee0cc85b67a48d4ff25a55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724631, "uuid": "545c8bc6-af7a-4666-ad20-3f51858b50e0", "comment": "Malware payload (AgentTesla)", "value": "23aeae57894461d43ac7a9e55a4c7b7e5421224db69c6345d59f86978c471414f1940228fd2fbfd4c83981599063d135", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724631, "uuid": "5f5ef3fc-1ca9-49eb-8076-7a0f9d2bde60", "value": "13156BF4F19898B1C54EC732C691DCBEEB210DFE5603492D06B9FA8D2A3378A9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724631, "uuid": "2db8b471-15c5-433c-a7b9-aa548d502a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724631, "uuid": "452eb056-736e-4608-b6fc-559b421c9d71", "value": "12288:0jif/bAvTq+ENSqWtNT0FOnDpq14JmduBFHTlIiNuuH2x4ljBYVD4+R4:Zj+ESB0wDpZDFRBH2yby4+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724631, "uuid": "01467073-f989-4ef1-bde5-be2b06066566", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724631, "uuid": "e3b2d3d7-92b1-40fd-a5a3-c9cc9d1e6e93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724631, "uuid": "eb44d94a-9729-4d57-8ba8-ed912a669e86", "value": "Additional documents required.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57d51d9-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734747, "uuid": "c95623aa-5cac-4a59-8dec-c116661afd44", "comment": "Malware payload (Gozi)", "value": "9aefd3ea1f73601ab7765412d70920b2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734747, "uuid": "af242a61-2bf1-4ae2-b61e-3acbdcb2a2e9", "comment": "Malware payload (Gozi)", "value": "cbbc3dfcd7d4efcd01a21cfca2776eb495a9b0f515e6f8096d6f470e8e2c8fb2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734747, "uuid": "d3e6a048-7387-4726-a4ce-80044682afa9", "comment": "Malware payload (Gozi)", "value": "8048307abababa4d8489b03194ddf06cb7f877ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734747, "uuid": "2ee4ce47-f508-43ad-aedc-89c5417ed445", "comment": "Malware payload (Gozi)", "value": "372613c0cd0bee82b29c392272bcdfe1b387624a60cde28517dedb0b5d076a17520e46694b6345d41733f743d7f5cd53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734747, "uuid": "9feae3e5-ea2d-42d1-a03c-2bf400f49685", "value": "1BB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734747, "uuid": "484886c7-e020-4360-9daf-d91ac9ac85c6", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734747, "uuid": "19c71d8a-a410-438b-a094-50256c0e936e", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvkqW6mZuzuJPjX7R75:vz75tzST8AMq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734747, "uuid": "0bce10eb-4b4f-4d65-8119-587a88402865", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734747, "uuid": "34dcdde9-6be0-483f-99bc-e32730b6df03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734747, "uuid": "d475ef8d-7ab9-406b-b5ca-d863e6398aed", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f86420-c43a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622704091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622704091, "uuid": "2c1a763c-fbaf-4b46-9cef-d50a7720735d", "comment": "Malware payload (Loki)", "value": "f2dc31b2374a0a04ee780bd5e65d7398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622704091, "uuid": "e406e837-b0f6-461d-b23f-120514c0c83e", "comment": "Malware payload (Loki)", "value": "cc348d59b645b999a5f3b83240e6459338c605d8c0b5ec6b47f82baae02a316b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622704091, "uuid": "6d8b9157-361d-4e04-a817-ee274760fc18", "comment": "Malware payload (Loki)", "value": "7b9c234e53729045efa621169201680ea757598e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622704091, "uuid": "ca86a921-b081-4b85-8241-9495b39ba10b", "comment": "Malware payload (Loki)", "value": "c46e818966656033fab9f896b722c77c4fc11d6d0d80500f0f58f22d47dd9c3018537f9398065303027d9ac90a2d4e4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622704091, "uuid": "7a3bb74e-e0bf-46aa-9c9e-8ba9547cff08", "value": "CC45F7D07E54C3BCEE49DB72AA145C78833492A53011BFBC9F9D85A82E37B45AACC453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622704091, "uuid": "11a84c31-97a6-4797-85e2-10bdfdaa1179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622704091, "uuid": "2e555312-985b-4a33-9a17-5eaf3cce6466", "value": "24576:xiOOyZ57gZyqTDitiU0G20XxRR8PyPu+mKUQe:Uq3CikUV20hsPyPu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622704091, "uuid": "1d695c93-16be-4afa-b309-6314113b7c0b", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622704091, "uuid": "ca97eb5d-de85-4a8a-ae8c-f7ff04fa8bd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622704091, "uuid": "240fe267-2ff1-446f-a1ca-db053adaf9a8", "value": "SOA MAY'21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acadec6-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622737843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737843, "uuid": "86818a31-0306-4ecb-ab85-00c3e9b94d2e", "comment": "Malware payload (Quakbot)", "value": "80f8b9a1bbfd7284dc156651ddfb7d84", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737843, "uuid": "6f5e3400-68ba-4085-874c-3b4ab91646d0", "comment": "Malware payload (Quakbot)", "value": "cc8b05dc16d4bcf3865d860cf44a0b95cbf0a5db0559aadca892e99231e6d2a4", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737843, "uuid": "98b428e5-32b9-468b-811e-47c41752a0f0", "comment": "Malware payload (Quakbot)", "value": "947ce444f98e38ab00bac9a2775a922d768df274", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737843, "uuid": "2fe8adfc-939f-4ed0-a500-35b0e653adc0", "comment": "Malware payload (Quakbot)", "value": "18256e3b47e8c6d92b6e085f9102737ecc1f8e6b7966ce368e15b3cc8af991c83f48a49162ec8fd3dea01a8cbda96b0a", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737843, "uuid": "7f38e977-e791-4b1a-bb7e-2751bebeae27", "value": "777422BEE28169F4C3399C3ED244A1D0C255F1D090A7B31D07DD3528A75329FAA5E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737843, "uuid": "ca927f75-7417-464d-a130-dbf26889c110", "value": "6144:XtcMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZN4:NRMmEv2Bc/nvm8IKABfsYOmauF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737843, "uuid": "9870d7a5-0df8-4fad-9275-7623b0423dc7", "value": 346068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737843, "uuid": "5ee47f16-a098-4941-a01c-211a25de31f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737843, "uuid": "bc0c8e5f-8a13-4aba-9e33-fa3859fbf1aa", "value": "754123384178_06022021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc8f02-c43f-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622706254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706254, "uuid": "2eb2f360-f297-4397-b156-59ac936279af", "comment": "Malware payload (GuLoader)", "value": "1e4fb00217aa4c3df1f5f7d195ced560", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706254, "uuid": "0cfe0e1c-c767-4064-857f-151fe7e7c369", "comment": "Malware payload (GuLoader)", "value": "ce055e506f7c2fdca3d760929428100572d89362fa453779563d095c4d71724e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706254, "uuid": "2ea19605-6c46-49e6-a321-81ad0504d326", "comment": "Malware payload (GuLoader)", "value": "e6bc2915f91847ef46dbbb88ca4469cbb5f4d36c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706254, "uuid": "174cb3c9-cfb1-47fc-9989-60d13812cca6", "comment": "Malware payload (GuLoader)", "value": "2c7dc961996c7b13af5e8008add16345fa3e0e9c64c6c5be2afdc37afb26b0587ff94503c33ff1306780ce52f69379e8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706254, "uuid": "c67f2ac3-0b0e-4368-aa84-77f06dd49241", "value": "C8453327FCEE6F49E6BA1C7D1326D4111116BD223204D062BB2C379151BA3766ECF16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706254, "uuid": "cadd10dc-3148-4258-ba1f-99e2779cc5fe", "value": "24576:Hsjjb/1JbHL74hd1huJCBB2QUdTKRz4EQX0HqXWq8gUzmEcDm:ObdJbHL7gwJgB2QUdI4EQEKXWIba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622706254, "uuid": "4596ec5f-a31e-44b0-afec-8cf45a636791", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622706254, "uuid": "ffa3554a-2a01-43c7-ab0e-6d979b7a2367", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706254, "uuid": "a8d0a769-c02e-4ef1-b5f5-72ff89c78745", "value": "DRAFT BL_CMA_CGM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ae5a00-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734719, "uuid": "44df4dc6-6750-4d5e-977b-a0a54d32a215", "comment": "Malware payload (Gozi)", "value": "0cf06e90edfdfc8aa5231d1d71bbb87f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734719, "uuid": "8d4a4233-3e92-498b-90ec-2f0869de6e0a", "comment": "Malware payload (Gozi)", "value": "ce5c7f9383546e5bac2cb7d425f0b43af9bffe7bc57d4d08be206bb1ea945f98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734719, "uuid": "60f013ea-5b2c-4575-b6a3-b839ec35f2c6", "comment": "Malware payload (Gozi)", "value": "6c116c8e4a19a516484f987232347e531d09933f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734719, "uuid": "1c00aacb-2b8e-4f42-8797-65007073fca2", "comment": "Malware payload (Gozi)", "value": "3b23ca751265f488f9d66f6b58df9399aeaf77684b60ad601fc0bcebc7a8de33d957d5d516179412b3a38a6bbd58be3d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734719, "uuid": "36feab6c-67cb-4d5d-a0d4-21c00cde7c0e", "value": "F3B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734719, "uuid": "ad7dedaa-5073-4da2-8d42-2919b62f8406", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734719, "uuid": "a12a4c70-9bd7-43ce-ae3d-f69d1c486a24", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvmqW6mZuzuJPjX7R75:vz75tzST8A+q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734719, "uuid": "ad8c39b8-1ae6-4d37-b46b-c8a5b1e26ebc", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734719, "uuid": "526efaea-1bbd-4551-863e-218635cf2292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734719, "uuid": "d0afac58-1040-48b9-8994-6c4d01dd9317", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a255f15e-c456-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622716193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716193, "uuid": "3bbaef81-2e08-440f-b253-fb46f9a617b6", "comment": "Malware payload (AgentTesla)", "value": "ff850f7513d42dd3d84c8cab11ae0641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716193, "uuid": "08689440-8812-4be9-bcee-29a95f51e274", "comment": "Malware payload (AgentTesla)", "value": "cf661fe3541f9bd899f86256f14bca8141e07518b87193862bb1698105894482", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716193, "uuid": "2a95efae-b962-4079-a187-d2d6f680a9ce", "comment": "Malware payload (AgentTesla)", "value": "cabcd2d0e3ddbe8704b77127c7d8e4c05061f14f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716193, "uuid": "0daa6584-b6da-4e67-9f6c-ea57183e3d24", "comment": "Malware payload (AgentTesla)", "value": "825c05a16b1b1c8c4248669c2c9a3826979af825c28c15913e8a43d39e44582571a5dc998d2bf6970dccb04e722b71e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716193, "uuid": "28315aca-1990-4a4e-b332-2400798d97a7", "value": "6244126D10D15CF3E72B4671AAEB77757BFA435A0A30016327A15B683E242A3CE1F4C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716193, "uuid": "f88b3b76-e3da-485d-b122-8e8ad7d373af", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716193, "uuid": "002e12a0-1d9f-4bd3-be1e-704068101751", "value": "6144:8Qq+1Yf09P5r2cntOQF72PCOmxrPIIVhpGQRxt6FdBk3jrYnTfkp:T1Q0vrZntOO72exrwbQiUT04p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716193, "uuid": "f6acfe72-b1a6-45f4-b7b4-416557fb4531", "value": 272326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716193, "uuid": "3df41a76-2034-4c44-85a1-45b99d5412a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716193, "uuid": "472c6a32-b206-4979-bd0e-6f6937c118e0", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920b1127-c438-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622703281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703281, "uuid": "d35aec03-0234-4924-971c-941cff2b79c3", "comment": "Malware payload (AgentTesla)", "value": "92b91febc86b346ef6d036a4a3942325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703281, "uuid": "c9de7598-f131-47ca-8a69-8dcd7f19d5ea", "comment": "Malware payload (AgentTesla)", "value": "cfbb725d3f8061a0ac536fe16b0bdbd9e1ac895c7fa56523681eda11108e5539", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703281, "uuid": "efd830e4-19f9-4cb2-a330-7013bff3b8b5", "comment": "Malware payload (AgentTesla)", "value": "4f48c670aac12572511b32a90b35f7869da12e50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703281, "uuid": "9b1a5aac-f52a-4739-b855-4ae79f2b2b24", "comment": "Malware payload (AgentTesla)", "value": "0e7ebd89db773fb94e69c0524acf8ab06f0d3f9745b5fd00f94300dde8571d1c190d2c65527eecf891618b2e5819baf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703281, "uuid": "281e55c7-ebec-480e-b1c9-c5a9f71e5be3", "value": "72D4121D73DCCB22C0BF17FA39B5254003B8F9692536E72F5DC926E84E22B80525976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703281, "uuid": "d6e690bd-9189-44df-a0cd-89c94ecc2022", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703281, "uuid": "dce71d56-b66b-4ddb-96b3-0a0b6f110b8f", "value": "12288:Si/Y2iNKAEBgW/YhZp1IYA57EQS6E9htxQruTy4IGf8XGdQU:Si/Y14fB5Yhf1hAqQNE9htmyTthf8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703281, "uuid": "83d6fb96-da09-4369-9d9a-adae453fe481", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703281, "uuid": "57cf330c-02f8-4473-8f02-f2d68d80e2e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703281, "uuid": "eec67b7f-9c62-4937-a193-0aacc85ef3ed", "value": "release letter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b77559-c44f-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622713088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713088, "uuid": "38f03981-bd83-4f93-9b1f-e94d22fe37e3", "comment": "Malware payload (GuLoader)", "value": "4bae8e3a6827859940ae24bf86b0fe63", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713088, "uuid": "b3987ab5-f2c4-40b0-9878-e06617186b7e", "comment": "Malware payload (GuLoader)", "value": "d16a164b711450cbcd4fca8631729e6aa2e5166a84c80e61f3ac0321510893cb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713088, "uuid": "cfba46af-5bf2-46e5-99e0-8884dd7ac8cc", "comment": "Malware payload (GuLoader)", "value": "af4f6a8c8210060ae4c69a4ba1ad8cf0303737d7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713088, "uuid": "ab89a766-f8d0-4d39-82e8-f8fcda5bd3de", "comment": "Malware payload (GuLoader)", "value": "6a9803ca0cd39dfb1ff0d13408660f4d7f3d18f101a9bc8d3d85d4e4d5bd7a7273c61bd924e3dc5d0ed613e05fbd623f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713088, "uuid": "fbf2baf0-bd05-4a31-8983-5f5cc318f047", "value": "815533D6FCC3C70BD9AE643B442345A856FD8C24AF418A88737F35747AB67724B8121A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713088, "uuid": "54d1d32d-ea1f-4530-8ae6-bd430872062d", "value": "24576:lVXOTxVQnXxJc9dFF0rWj6oqIrPC3fdo2XL+ViBmf98AM5xoQS:+tcgZQWmoPye2XLIiBmfwxo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713088, "uuid": "4ddc0d74-ac7c-465e-b582-6e8ee3229fd2", "value": 1402880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713088, "uuid": "c887ed65-e2ba-44a8-8da6-a5a59f2afc13", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713088, "uuid": "215bce4b-287b-4f35-b44e-81576eae749f", "value": "Order Request Form 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586d76f3-c46c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622725518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622725518, "uuid": "9c92a386-8c16-4757-87b3-ee044b2dfed2", "comment": "Malware payload (Mirai)", "value": "3f49abafa4e973491acaaa16f6d85cc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622725518, "uuid": "0a04acb0-2171-49f3-9a96-a7c74707d8c4", "comment": "Malware payload (Mirai)", "value": "d184a7638cd53837e676bfb9e944e2e9fc617d6bcec508db20ca0cc1b2353ce6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622725518, "uuid": "6d092892-502e-4878-8c97-fabe80c4cce8", "comment": "Malware payload (Mirai)", "value": "ef47b9dd6dea26de61c3ba12cca1e991ce739764", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622725518, "uuid": "d4271d40-4e13-46a8-9f06-a610a545c516", "comment": "Malware payload (Mirai)", "value": "01f5fb3262632370686acf54a8f93cfa6451611a2b715aa446e563be8cfd6a0d33dae7973150345e7f8e632297e68fa6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622725518, "uuid": "14038135-c1f2-4344-99ad-b3997a7a8cfc", "value": "D164E18AED01AF75F9C506B9FA5F074973B38BA8D3D7B110E620C7143ADE64A8B35184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622725518, "uuid": "d0802fbf-2105-449e-b2af-f13127b540f2", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnc3a77oNsKqqfPqOJ:78QpZsKCai3a/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622725518, "uuid": "cb5a9b03-687e-4afb-9bc6-c175a3147857", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622725518, "uuid": "bd7d2966-4fc3-44cc-82e9-ad781aef442b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622725518, "uuid": "b28c06fc-6c23-4c67-8de4-e2c8cf3b5926", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9de2c2-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734331, "uuid": "ca8361c5-a5a9-46a5-b94b-21fc58f5a2ac", "comment": "Malware payload (Gozi)", "value": "db5e9f05033009814ef005cbc7be2c5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734331, "uuid": "8502549d-7d29-479f-9119-a6848adb62c5", "comment": "Malware payload (Gozi)", "value": "d422be9c13a05834c38e162f3387cc787a8cc31c56998260d80f0544fdfbab5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734331, "uuid": "6fe3cc7b-42db-411f-8ec8-3365f819da90", "comment": "Malware payload (Gozi)", "value": "fe10deee43fb80b3b177cb699a72f08ccacd45cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734331, "uuid": "d147311e-3400-4424-9c21-b161b14ad7e1", "comment": "Malware payload (Gozi)", "value": "56753e886d22b235b37151c1d3bdb6e5bbe9a4c837d30ef10e406c6c2842944c31a2c09dfa05286a3dee8d83faf6f6b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734331, "uuid": "fa8eac70-2ded-4b84-9c65-7351a789846a", "value": "9DB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734331, "uuid": "f2be4e12-ffac-4cb2-93f0-7dc9af01d3b4", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734331, "uuid": "93deaf45-9a31-407f-8424-4df2aaedcc25", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvEqW6mZuzuJPjX7R75:vz75tzST8AMq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734331, "uuid": "b37f0672-2ee7-409f-8a9b-c680294f8521", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734331, "uuid": "95936d63-9b0e-4234-9d2d-fc37630fa2c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734331, "uuid": "f3be99f9-a50c-41d0-adfb-a96a5487af5b", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a0695e-c430-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699923, "uuid": "94db3db2-a3dc-46c4-9f6c-2d5171688a88", "comment": "Malware payload (AgentTesla)", "value": "8f310f476d94685424314ab47316f4fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699923, "uuid": "c19aa4a7-37db-4e3c-8e0f-b763ec5afb9a", "comment": "Malware payload (AgentTesla)", "value": "d4800340fbd1803a42df8ac5b06b47b8d2cafa64738f02282fe4b32e97fa872b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699923, "uuid": "02e4fbe7-8a4c-4d23-a5cc-cf5aa6a553d6", "comment": "Malware payload (AgentTesla)", "value": "c6de6c8b72681631a3c1292b6733bd393e94086c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699923, "uuid": "330807c2-7972-4a77-b2bf-e7eb9b2ba815", "comment": "Malware payload (AgentTesla)", "value": "0e3324d1514a23b238300614e4ada9c9ec0b9808d0e6a26489f1e84296ba910f0465b5fad3b34ba89b7f0c604e7dc00b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699923, "uuid": "093d5ed4-15a0-48f7-84aa-ba0fe6757e75", "value": "BFF533854B2F0D12CFE22235F212099C896FE8310D3EBED4B56F0662436B956B7E7647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699923, "uuid": "48f7b891-cbd7-4e1c-829f-65100a5455d8", "value": "98304:bExPk8ihEMOvOqvUTO70Q50UJFfQEUgCyJgc7WdNjSRnaO7huWB:OEEMwUy7Z50UBUgCySc7mjgnakB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699923, "uuid": "5cf4bc2d-d86d-4568-a2be-5f83a5a0540a", "value": 3560299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699923, "uuid": "4e6123c9-0cae-45c6-8ce2-bb65337edd05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699923, "uuid": "75db62ba-c56e-4a50-b929-2c8885584fb3", "value": "Product list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b7107a-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622724205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724205, "uuid": "5072224d-814c-4de0-accf-aac6b6e69adc", "comment": "Malware payload (AgentTesla)", "value": "d241c3889a34b246cfece690cf4adc50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724205, "uuid": "845d5087-cc10-4995-8782-a8d3e21a8d91", "comment": "Malware payload (AgentTesla)", "value": "d493e2fed7fc2cc85b1049f5705d21080c44a877bca7d0ff24a7ea9d8487fda5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724205, "uuid": "12f94df3-5174-4698-8e0f-c90aa0457ba7", "comment": "Malware payload (AgentTesla)", "value": "8945b74aee96cda69a65a6b85db963c99a73951a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724205, "uuid": "511f4d03-a0c4-4784-873f-ae68327e0fc1", "comment": "Malware payload (AgentTesla)", "value": "740d89dad1bb5db60dfa3f8901fe86c2492c7837c8c326fc941e8764f996439df865149b205a9e4e31e0f4e02c42d1bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724205, "uuid": "44fb85ff-ab1f-4a2a-a2ac-6c1f0b586426", "value": "A975D5A2B79A8D68E2498B737DDF6C5C82BD91F517012F388FF345C92F22392D54844A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724205, "uuid": "39699061-e75e-4c74-88af-be9b9011515a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724205, "uuid": "cb7ea71b-70de-4559-92b6-e861c81facb9", "value": "12288:DqIW8/Fdx3edQznZaBQc/l1EQj9zof1noAWDJLsos94CdTN48KNb+0OPMXwiB1Y5:W89b3eezZaBr0fWVg94gTNCSMbBiETy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724205, "uuid": "cd9459d6-4347-4fac-9c81-797e8119f07b", "value": 1608192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724205, "uuid": "f220ef0c-2092-47f9-8c40-19933cd6abc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724205, "uuid": "b2a8a6dc-4fbf-4703-9f53-ca92d8e75350", "value": "Purchase Order PO750KG.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9746edca-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734213, "uuid": "5c98a508-2c31-45f6-a514-1f80b27b7282", "comment": "Malware payload (Gozi)", "value": "11dbf3457def6dece6fcb7564d957951", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734213, "uuid": "2e3bd5e3-65da-4b83-8cf6-d9ad90e8321c", "comment": "Malware payload (Gozi)", "value": "d4d0bb44895c035a39afd7fab48f879e058f1cdc00db0666ebb08463cece2e51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734213, "uuid": "fbb90696-e1b1-465e-a243-1552673897cc", "comment": "Malware payload (Gozi)", "value": "d3f497dae6407e80f23340b990416abb5e15b748", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734213, "uuid": "9815f418-794b-4255-8b07-8816ba1cbd81", "comment": "Malware payload (Gozi)", "value": "49a0b309d0d2925b163759191c46e8382335c31c8cb25fa69d179ed2964f1586316628ae56e858077fea9f49dcd132f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734213, "uuid": "17b099c4-e29b-4d01-8d5f-d96c9593fef7", "value": "27D49D507582F036E47214368FA9D9F90B28BC015B290ED773F81F6F5E6D9E26A31722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734213, "uuid": "00d27f37-0dc4-46f4-b8ec-82681fc81059", "value": "d6ffae5d966e71277978ccdc1a61df7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734213, "uuid": "2625f869-e000-4e66-bdbe-2ead936e74bb", "value": "12288:VvrXkk/17lD+LKF+KCCfJXAokh+q4KlqXP2IlqKnMgV:VjXn/17lD+e3CoXZk8m4pfMgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734213, "uuid": "1faec6f3-633f-4442-ab6e-097f7acfbd0e", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734213, "uuid": "c038dcd0-b0ca-4b0a-8c76-34a37d700ab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734213, "uuid": "db73ba89-ef1d-43af-b455-5f3ab91f29c2", "value": "shook.vob", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415c5786-c49c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622746095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746095, "uuid": "1d225f45-fb24-46ab-83ea-16b525478718", "comment": "Malware payload (AgentTesla)", "value": "4fb6a335482872d0b8020331fe077329", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746095, "uuid": "311c31d6-d0cb-4c36-9935-05dab10ec68e", "comment": "Malware payload (AgentTesla)", "value": "d53786108011591535dde0f695a94147981e1f2c3a9b8a4c5196205e40ccb443", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746095, "uuid": "f6945c3c-8f74-4241-9e28-129de494dd0d", "comment": "Malware payload (AgentTesla)", "value": "68dc2c7ff90b8a91648db83d7f09fcdaa5b1e407", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622746095, "uuid": "ac020598-c5d7-4b8d-944a-856dfd7ca4da", "comment": "Malware payload (AgentTesla)", "value": "acb05d4806ec3266c65b6f1beb5af535635b3f8c6ab2bbb02e92d0ceae867b4f6e322fdb6c466c508173d95c9e906eca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746095, "uuid": "719edcca-e2c4-44ef-b52e-32f2821c0ea9", "value": "0D157CF8F19898B2C14DC7B2C6909DBDEBA102FE1247891D09B9DACC1B4379E9F5D448", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746095, "uuid": "a8a996ac-19f8-480b-bacb-f2532d22866b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746095, "uuid": "57bb5779-2ee3-4beb-a63b-103bc79b43ce", "value": "12288:ZbixmvTFoiM+NixnPhaEn6kzj4c0L/H5Mw3kL3eTjr7GjVWrwFpos26/uCx:tTixHtMNMyTDGjIEqE/uCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622746095, "uuid": "f3dba250-799f-4322-8172-39ec7d02f435", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622746095, "uuid": "1b6f8a5c-83ce-4010-9cd2-dfe00badb7b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622746095, "uuid": "c21fe651-3281-4f69-993a-91ee16811ae4", "value": "OM PHOENIX TRADERS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95107077-c42d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622698561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698561, "uuid": "d477b5f5-fb72-4cdf-863f-fd8e2c90a69a", "comment": "Malware payload", "value": "10a6370bb359ff9f3a595c3ad389222c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698561, "uuid": "0c80a392-b782-4117-9538-206f24646e95", "comment": "Malware payload", "value": "d605724b31d8627ffbf203ec7d917cb70019e6c95d0c501a7136f7e2b72b79bb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698561, "uuid": "3a3cb5d2-2bdd-446b-8460-0e1db9f23410", "comment": "Malware payload", "value": "9f5d5664530652a46e06f0cfdcbbe2d2b0770dca", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622698561, "uuid": "b119a67d-cc95-46b9-934b-ff1ce0f2c521", "comment": "Malware payload", "value": "f033ecf7d59da1c192bbd7c294ea8d3b4636e30ddccc8e73bd86d1e26b557b2bdd0daf074c082f15437a981fd78bc5fc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698561, "uuid": "a8347225-8ed6-477a-b889-24c3b911542b", "value": "80D4E0B0F6C59526DD4B12339C91ABD2673CEE859F51032BB2B9334E5E367888233B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698561, "uuid": "b419de8c-f4b8-4093-85dc-3a114f5d6f5f", "value": "12288:HspCOElpb+2pUpkNXu5d3QB2RNv+ot0N8Mx6jKe3bhjWWiMLRwD:H5pjNQxE2RNvBt0N8fjKe4WikU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622698561, "uuid": "3f19d19b-46fb-4640-b5c2-6df45c1707d1", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622698561, "uuid": "d3f34010-cc0b-4027-ad42-a9ee83e5cfa7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622698561, "uuid": "7f396d79-f38a-40b0-97f0-d1f78a35f7fd", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4710.30287.30308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe477414-c456-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622716347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716347, "uuid": "d9163ea0-1a3d-4717-89b9-26b90d2c4b38", "comment": "Malware payload (AgentTesla)", "value": "676cee7794d6bc265b653bc6e1ceedc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716347, "uuid": "5ef29904-b442-4dd6-865f-47a8fba80752", "comment": "Malware payload (AgentTesla)", "value": "d649da4d6e45efc5830efb532f63e17004ce49602de831fa98f4137c756c8c1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716347, "uuid": "f8258843-243e-440c-aa99-2f021e9b6cf6", "comment": "Malware payload (AgentTesla)", "value": "42770f9b9fead71fd2f1f575c1ce3ce61e17c5ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716347, "uuid": "78a0ec74-66b5-4d2c-98a7-a59f2b6bc75b", "comment": "Malware payload (AgentTesla)", "value": "32aa4c9070a10f069e674547cdafa12e43b931393a5867da82caea979d7312dc15749505f2937da49811e2256b83384a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716347, "uuid": "10187571-ae65-48f3-9671-9e5a9bc7cc2c", "value": "EC156BF4F59898B1C54ECB32C695DCBEEB211DFE5243092C01B9FA8D2A3378A9F58445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716347, "uuid": "c8652903-b76d-475d-b7b1-287333ecc64c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716347, "uuid": "f86dbb00-4b95-4289-87e7-f8fe94662c38", "value": "12288:+8OfgFvT4kVO9mF+2BA/Q96+J0EqCJdRHI03QmhyVqGAY:Ufg+kVemg2BGQnJ9JvoEQQ2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716347, "uuid": "4ed02414-1997-401e-a7bc-75aba66a5297", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716347, "uuid": "80784f61-3a91-4a1b-959c-3ac3e1f7b86d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716347, "uuid": "14d26913-8e11-4400-8a99-1f7a8fb3977e", "value": "Scan 03.06.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec5ef48-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622738226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738226, "uuid": "213948a0-287a-4d9c-8226-dcbc8b1fc22b", "comment": "Malware payload (RedLineStealer)", "value": "f8c61215907a4b3a6e2c5409641ac8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738226, "uuid": "7a815525-42e9-4562-95e7-372d8f731238", "comment": "Malware payload (RedLineStealer)", "value": "da4c20f19fd8c1e1decf936cf6e2b592c39db829546f029f7be0d46e3baba5d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738226, "uuid": "3e8bd2f1-c72e-489e-a632-96238a4724bd", "comment": "Malware payload (RedLineStealer)", "value": "179ef28e6812f4a1135979a091fc99659a3d0bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738226, "uuid": "97668907-820b-42f4-a822-43c6023c4fb6", "comment": "Malware payload (RedLineStealer)", "value": "d70923d23c9859dcbfad0228605bfaf275f912be106b2f437e91fb4970afcd23c32c0592fcd88093163b3e0f1be37752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738226, "uuid": "86fb2d63-3a01-4d4c-ae82-2636860fff0e", "value": "0484AE10B7D0C035F1F716B49ABA92F9A53D7DE16B2450CF62D52AEA1A346E1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738226, "uuid": "785996ed-8bd3-4fe2-813e-48dd4e917d44", "value": "ad8bd715488c60ebd0287d0239f0c2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738226, "uuid": "6d6eb2cd-1f75-471d-a4e2-d676d5b94ce4", "value": "6144:aapF9CcZINOU7k+vumyfqrhRXOJc7V9n1DQw7hxt0Qu3O:aapF9CuMOU7MmySbXOJc7hDQwTFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738226, "uuid": "4edd063b-8216-42b9-b4d5-65495a3ac665", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738226, "uuid": "59958959-4fe1-4866-8113-379fafe4ec4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738226, "uuid": "06579292-ab26-405f-b057-9bcac405f4f6", "value": "f8c61215907a4b3a6e2c5409641ac8a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7715bd9-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622724443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724443, "uuid": "6f374b79-94a4-43a9-8a71-ef9d4fa5b7f6", "comment": "Malware payload (AsyncRAT)", "value": "4270337062dd7bc8bf4ccbe505a15256", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724443, "uuid": "8ba3d0f5-1143-4131-96a1-1a34fa293dbb", "comment": "Malware payload (AsyncRAT)", "value": "db1e6b77da2691daf1be1eed70dc625e5e4749cfdd1833f194fedc63340b41d9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724443, "uuid": "eab6a7d2-4c91-49ec-a172-27fce1eaa133", "comment": "Malware payload (AsyncRAT)", "value": "8b48ddb8b17e21b3b9085ea3eda17055fc7cd222", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724443, "uuid": "9739182f-6004-4e91-b4d7-7244f14d534a", "comment": "Malware payload (AsyncRAT)", "value": "73b3806a681d37c1fefe196c51a24ac9845b9a653981cd0efea964d4d6034e44c5bf7e619a3f4354f2c814f380d6c32d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724443, "uuid": "d994470c-aa7d-4a01-a587-0395de960fd5", "value": "E64458E8AD71C1E9CC153470A975C3A88E6EFD005E07E786D6A1BA0E16FC603F4D46B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724443, "uuid": "dc6c8897-3a04-4d24-b5b3-47dbdf131599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724443, "uuid": "257a3a6a-8327-482a-b816-a45a7897a97e", "value": "3072:czX8ds12CbLUQdseKpRKMoUFdczBg7RAhaHxNtrXXsQFY81kncoh:UX8akeUS+KMoUDclgV2aHnt4Qi82nco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724443, "uuid": "0ecb742f-0efb-413a-b2a8-99bda35449c9", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724443, "uuid": "45293063-f5bf-451d-b7f3-1f991ada3301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724443, "uuid": "8c99af9d-84ca-4e94-bf6e-634526757500", "value": "4270337062dd7bc8bf4ccbe505a15256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336fb42e-c469-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622724167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724167, "uuid": "f020b8cd-90e4-4994-b9c7-7f929f303d6d", "comment": "Malware payload (DanaBot)", "value": "e496a2012a67bead17a4b47cae40729a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724167, "uuid": "d48e266a-99f4-404a-8156-281cfe88cc92", "comment": "Malware payload (DanaBot)", "value": "db8220cbd62d1046db60abc9af4d4218c1a5b4193e970f19fcec7e67d58a1292", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724167, "uuid": "8547c5a1-3659-4b34-b9ef-803530cc205a", "comment": "Malware payload (DanaBot)", "value": "45e5362e9e0b00ed469259c633b0505d4486c587", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622724167, "uuid": "fb761645-64b0-4b3c-8087-6b669956e142", "comment": "Malware payload (DanaBot)", "value": "cd5003fdacfee6a2a16c9438e2e2da1ea55163b7b4a49925784d4887ce92fd8d6df4baec953e66baf0185e7906c0d987", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724167, "uuid": "6ff6b851-f1c6-41ba-a0d7-f223ce955ce7", "value": "59563341F3B0C439F1F312F48ABA83652527BDE06B2458EB92A947DE95293D1BC72707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724167, "uuid": "62659eb0-40d3-4174-bd16-cec5fef4125c", "value": "1736d54edbb0bc75969c6531257cd3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724167, "uuid": "31bc6c65-f6fe-4169-8e54-38e452e8fd43", "value": "196608:YSIAVISt2P15C76kM1raF3VnfGTuXhgy3RVZL:YvSAPQ7dX3RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622724167, "uuid": "cde043d3-8ec4-4b13-92a3-ed2a0d8c5ce6", "value": 6320640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622724167, "uuid": "5b84f5a3-09cb-4f93-b078-f9ac2b6ea453", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622724167, "uuid": "9b36559d-3590-437f-bed0-eb3bd7a2964d", "value": "e496a2012a67bead17a4b47cae40729a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b3a6e5-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757754, "uuid": "8f261de9-77de-441d-814e-8ce578bfd04c", "comment": "Malware payload", "value": "82e73e516c967f6c138eddb3b48a4ec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757754, "uuid": "1ba4cc70-8356-4293-80c5-b4f2c470c2a7", "comment": "Malware payload", "value": "dbb03a69c6051258fa2c2751aa834b26fa953b00742d36615f4368245bad0479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757754, "uuid": "633c8aba-be22-4531-8a44-c048956cf04d", "comment": "Malware payload", "value": "6134f7b40727d85db479752c0c5dff83ce8c1563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757754, "uuid": "535814c2-7dcd-480b-b991-fe5e57c645ce", "comment": "Malware payload", "value": "0adb5e314ce714c667ed3e7d5fbb26dad4ebd11b7eb299bae37c40bd838041cf1550c783a4f31c382b32eb82d613c9af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757754, "uuid": "3b454ba6-585c-43dc-a74c-bb141902d2b7", "value": "C2E35A3C93AE8E76DAEF1BFC9092221007B3C5536613FBBA0EC4E6D85D6376A4511253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757754, "uuid": "57bdcb9a-4078-4c78-81e9-f0cdcbb62d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757754, "uuid": "169c5b23-2d7d-4d20-8e71-4171c9bcc276", "value": "3072:8mSXGLsQKiUkTUT5DCfJTqtmEbs9hR2RQh2:8mScsQKEs4ybI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757754, "uuid": "4ab6400c-7edc-45d2-9292-63af72307874", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757754, "uuid": "4d1d7b70-6e9c-44e0-aa85-01e51041b97a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757754, "uuid": "b05a1b40-b742-4a26-9b3b-aee5e03aaced", "value": "SecuriteInfo.com.Variant.MSILKrypt.4.5719.11893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4e71da-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622714359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714359, "uuid": "3e94bee6-7dc0-44fe-b8cc-c3cf64530ae1", "comment": "Malware payload (RemcosRAT)", "value": "fdd2c2d69663f38e4af1668c3b736224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714359, "uuid": "a3109512-b26d-43cf-84dc-462d919dae50", "comment": "Malware payload (RemcosRAT)", "value": "dbc2d79881e917ef4698fa6121191938e1e9614d6d1159de6df72908df3bb126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714359, "uuid": "fe5fafcf-71b0-4e30-a611-1246e6c7be1f", "comment": "Malware payload (RemcosRAT)", "value": "d9ca7bd236da8d90ffa8f3676bfbeef09d28a646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714359, "uuid": "34dde70f-26d9-4292-8e9f-2949dd52d7f7", "comment": "Malware payload (RemcosRAT)", "value": "76259cee0ad42fff39bdfb05868245d70be7839da27bba07d921cdcc1ceb57a77ef563911b17716fd8bf54a85bfeaf7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714359, "uuid": "70067b14-648f-4203-a566-063924b842f4", "value": "C4B4128A33FC8F51D83E1BB3247560640771A52AA897E70F0DD8A2F91DB3F80456676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714359, "uuid": "bce3c152-f115-46ae-8954-e5ccb44b2821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714359, "uuid": "2295e1c4-0822-4a0b-a0db-6f42ae2ffe10", "value": "12288:l3RY2iNgwi0siaBrCUrlYnYcBAHEIi/Mmjcl:l3RY1u90Fxer/mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714359, "uuid": "c7fb4174-f679-4420-b4ea-cc925aa1a746", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714359, "uuid": "549becd5-2bfe-4311-9be5-d84f644f660e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714359, "uuid": "c754fced-d5b8-4095-972f-0db2319eac0b", "value": "fdd2c2d69663f38e4af1668c3b736224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c1f2a3-c45e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622719423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719423, "uuid": "26bd639d-59a8-4397-bba2-86bac28e2957", "comment": "Malware payload", "value": "e583546003db5b61b95fff6382d10446", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719423, "uuid": "9110019d-4274-488d-b4ea-94adb4d973d8", "comment": "Malware payload", "value": "dbe9adb27d314e866d5f15a4179583753c7153bc95a0c1735e52cf55720ee9c0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719423, "uuid": "96aeac3e-7f41-4147-b726-312a04d001b5", "comment": "Malware payload", "value": "c1da9815ab54fa11e26ae838e4191e9be9d6a03f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622719423, "uuid": "f3ae8276-bdf8-4f08-b9fe-ee019b73a12c", "comment": "Malware payload", "value": "ec29fa88e93ab167c4193e4ea645505abce81f68c91941968c664a20f52cac7974414040c3353268cfb139d7d94cb63b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719423, "uuid": "5e90a1a5-f246-45e1-ac1c-cb0712b33628", "value": "3C16E192F2C1CE6FCA4A41305416CAF477B93C346A59535A34CEBF5B3C7B2908E9B648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719423, "uuid": "b512eed6-1ec3-40ce-977c-031a8c01978f", "value": "98304:SGwfnGwfnnfnfnnYUwfnGwfnfnfnfnnY3cfnfnGwGwfRrtnfnfnfnfnfnfnfnffO:SGwfnGwfnnfnfnnYUwfnGwfnfnfnfnnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622719423, "uuid": "68122c95-69e7-48da-9b7a-9632eb63347f", "value": 4346880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622719423, "uuid": "b5058a6f-1fae-4532-8b51-96fd5d31d900", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622719423, "uuid": "1331b666-c6a8-42c1-8bc7-5b2cbe892489", "value": "4673684.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74016c52-c43f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622706237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706237, "uuid": "5f36e49a-053a-47e7-80e0-d2dcf4f37f53", "comment": "Malware payload (Formbook)", "value": "983fec9b1834a4de7d746193841b578f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706237, "uuid": "011b4553-ebf6-4da0-bafe-5ec114417148", "comment": "Malware payload (Formbook)", "value": "dcad3fc09abd15cd0ce960d29b7cfa524c10216c873a6cbf71e4c4c30619e926", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706237, "uuid": "6cccc9ba-faac-4fa7-ba7a-12e93ba53dc3", "comment": "Malware payload (Formbook)", "value": "088463499629a57c7e1911708a41888b0eb89068", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622706237, "uuid": "ca36536a-506a-43ae-909f-ca66d67fd589", "comment": "Malware payload (Formbook)", "value": "bd49604b67a42d0277221cdb4e50169a7b9ce6fc18d3f6c8b84f1a4c8f31136ccbbb2dc4184c46ccf9c79706796bfe26", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706237, "uuid": "4891268a-4b72-44e1-b8af-55ef581d973f", "value": "E0553386EDCE9B4EE08F8A35001FC860A938AD603991D6377BB47F4671B1531D54EB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706237, "uuid": "16f7d99e-988e-413e-8b78-d9a7bb5dd8b7", "value": "24576:MLuvPTo/rH/goxDW7Hf0W7/jgDxVRGsRAyHUMdp8C3zejvcAgkcKqwZvZN:MLuvPUrIopoHf97qVRznHUMdpJyvcKqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622706237, "uuid": "887275cf-60cc-4720-a174-78141fd92475", "value": 1302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622706237, "uuid": "7fd8509f-1934-48b4-9e28-0a1d0a4993d1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622706237, "uuid": "dab218cf-5489-4c2d-9716-06e0ccc33cde", "value": "no.IV640381 refer PO 4500260781.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcb53e1-c4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622757736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757736, "uuid": "33fcc680-8ff5-4529-a54c-098706b1d034", "comment": "Malware payload", "value": "f94af1a2500d42846a99873b32eb9418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757736, "uuid": "dd5589a7-4a45-457f-a683-341af0921bba", "comment": "Malware payload", "value": "df9e35e27862f86d132a0e1f760d9b97dada51ebd465dfcc259a70c5799586f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757736, "uuid": "31a9edb3-f2d9-4483-a38d-c0a9f9fe6c91", "comment": "Malware payload", "value": "7956f6245dbd9298dc09991e48f2c735285870e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622757736, "uuid": "d9121113-e58a-42a1-a013-c15520122acc", "comment": "Malware payload", "value": "d79716520d79f2f965874b0de39e179cec853584e933e74ad0331227b7464a1c95ec09cf85baa7fae39392033cec78eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757736, "uuid": "10b58ec2-7c21-4906-a2cf-cd21ef72b94b", "value": "0313AE6D4B5A4A76CAE58DF504A3D6200B70EA3E9401D77FADC1159A8F03BF8B7813B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757736, "uuid": "76855f51-88d4-4d5b-b832-7addc7c9b479", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757736, "uuid": "b3aefac1-1e51-485e-802d-bff146f8c26d", "value": "768:0dW3pE32IjWUd9UOtUM09HPM4JcgmYuRz+ZgY6k2uDmP7wDOI8:eKEl3dIHPzJlfuRz0j6lu6jwDOI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622757736, "uuid": "0b426ada-7c7e-4efc-a3f6-063c5caf8c13", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622757736, "uuid": "2f7a7e94-d42a-44d1-83c2-aa4420e796fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622757736, "uuid": "1d00595e-b901-4af9-9e3a-2478300f1391", "value": "SecuriteInfo.com.Trojan.GenericKD.46314031.27398.1769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf523ede-c439-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622703786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703786, "uuid": "f061c84a-e7c6-4219-81eb-06497c7cf013", "comment": "Malware payload", "value": "9a0a13a2ca8f3a4ba4f65f9b3695613b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703786, "uuid": "755c9aa4-8e2e-4de9-9e32-9f78f260a6b7", "comment": "Malware payload", "value": "e0e411283e5b92edd289b37ad04da05bd2500f71a4c6bd0835e8af71bd543e0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703786, "uuid": "4853000c-396d-476a-bd9e-79fc0e7750a3", "comment": "Malware payload", "value": "604770cb4be1ce328207714e4a3b7c8b16dd2350", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622703786, "uuid": "9a70c573-6b3e-4fd7-8d5c-e7452d9c8374", "comment": "Malware payload", "value": "73fa6e12f9b8e11172c8b749d7cb9185186bb972e4781f410f3a479ae071d655164285ece43464b0d96eee27deb0265d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703786, "uuid": "03b90a00-93ac-49c1-9949-65ddb059eb64", "value": "C713F13F565A0A97DD6A49B282D203E00FB2CBE4B163985895C4D1B38D1F4793A2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703786, "uuid": "16e973fb-7910-4671-8063-0dbacde879ab", "value": "768:t6R7y2n0bES2L23q9/ejJXz8LpDZLR0hPo39LH6AwHsYSPa5vsgJgGlzDpuW3wg1:8E20wbL592JXol30ONHPwigbVEW3qenx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622703786, "uuid": "7d91ffc8-dbbe-40ee-9b33-69f0d1de4754", "value": 43116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622703786, "uuid": "986ead05-df42-4baf-927b-710bf09793b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622703786, "uuid": "8095e678-7f3a-4ff8-9a1b-5a07e16fcde3", "value": "megumiv4.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807a1ce5-c431-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622700245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700245, "uuid": "ac74c8c5-f9fd-4ab0-a67c-e344bd89f5d2", "comment": "Malware payload (AgentTesla)", "value": "da39c9009335d432bb9fb3a17e48114c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700245, "uuid": "2bc1bdf6-d6be-4ef3-96b3-6f783ff7290e", "comment": "Malware payload (AgentTesla)", "value": "e18af05272a47b781350c7582f3a6a02744801b267deafc256556966cc926192", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700245, "uuid": "69e84322-2b40-4877-85c4-8819776bc29e", "comment": "Malware payload (AgentTesla)", "value": "4ef83cad92633a3bb81494000fce740091d639be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700245, "uuid": "4d2ad323-c1ba-4745-918c-d8ede560e29e", "comment": "Malware payload (AgentTesla)", "value": "8eb8ea9ddab05cb8c43dbb379ae7a8a62011e50b07fcf489ea8c4982d230a82b0678a45dc4684c0ab0686380dd5ca180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700245, "uuid": "005fb460-e3cb-473a-ad09-e310636aa16b", "value": "1DD4E122F2A48BCAF1585F735B6495000B743C537875C63C689931EB48F2BA31A6FA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700245, "uuid": "6a14c92b-2c26-4015-b328-e21c6b362eb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700245, "uuid": "de99e8b6-b44a-4309-a95b-5affee89f3dc", "value": "12288:6Umxty6hZiouQZ8Ua8T+ObC8AlXz8J4tKbhNlYFk5inFge:cTTUw1p5XkXwJ4twhzYi5inFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700245, "uuid": "a0e96453-8d8c-4c2d-8423-91ebf1314d51", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700245, "uuid": "2a3fb977-d308-42c7-ad5a-a0d017862305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700245, "uuid": "a47c4fe7-291c-4f99-abc9-3ca722ebd759", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85053539-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622714426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714426, "uuid": "31d858f3-0fef-4376-bd10-bdc82768de59", "comment": "Malware payload (RedLineStealer)", "value": "4202415ab9a4a5895be70426bca072de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714426, "uuid": "389ac1d6-b2ce-4385-bebf-d43ed6c3a493", "comment": "Malware payload (RedLineStealer)", "value": "e350e3c70db30c91aadc46298cd2563c05dc20e2113416a3e7b9b60ef22ae6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714426, "uuid": "2c8d083f-232c-41b8-9d6e-bd76071f0062", "comment": "Malware payload (RedLineStealer)", "value": "a88ae82fa8eff70cc5b53c20b97c35ebe28a2761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714426, "uuid": "7f17443e-6857-47c0-924d-f06cf0e619fd", "comment": "Malware payload (RedLineStealer)", "value": "db8d440c4a8185d43cd825ea7c2b6f87ed37ae0de3e169db6cf473620f51ab35aec0e5487ca7c3aa65463ade1dd70e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714426, "uuid": "dd546e34-4748-419c-ba61-d1b0c2723ab2", "value": "A284AE10B7A0C034F5F312F49AB682F9A63DBDA16B2450CB62D52BEA17746E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714426, "uuid": "7633a25e-21d0-446b-86ea-449cb8e2c5f8", "value": "788842c19811b0f2f6994735b8f363a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714426, "uuid": "3a4b4021-7b97-4bd4-83c5-e24988ae872b", "value": "6144:uyzOImoWq1j+BKDwDPSEGZIzZH+26VCic3NoXXoaw/j+cO:uyzfmt2j+BBDPqZIzZHeVzc9BfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714426, "uuid": "78be5e13-4f47-4e9b-8017-4e08ca669bfc", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714426, "uuid": "9d36e4ff-40e0-4a31-9373-6838e06573df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714426, "uuid": "63254afa-45b3-48f6-916f-8d484c4bb12d", "value": "4202415ab9a4a5895be70426bca072de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc91a9a3-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622738195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738195, "uuid": "7aaf9eef-d2a2-4078-987e-b26634cdc177", "comment": "Malware payload (RaccoonStealer)", "value": "0f3d4d5318f5158eff689efe404dc5f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738195, "uuid": "60a4c538-7b9f-472c-b24b-e7e56638af29", "comment": "Malware payload (RaccoonStealer)", "value": "e479976218616ff4a1303a5e783d6034d06ee0e2c6e0fb9c7f4e42c0b794541f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738195, "uuid": "092d14c4-0c48-48eb-b0d4-908ec58fa32c", "comment": "Malware payload (RaccoonStealer)", "value": "f178a6c4baacee21314e3aeafe1a8fab031bff0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738195, "uuid": "eb79f805-2681-4b47-b57e-f6f76516198e", "comment": "Malware payload (RaccoonStealer)", "value": "f03e1a27ea11ba4f8477b26805a709ae4a2339d4e88179fc4a94b57008ab2adff1148a7f8f6c921d3a4b14aaa9eabd8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738195, "uuid": "3b621663-68e9-4654-9011-0a6ee16065e3", "value": "50C4D010B690C034F5F736F58ABA92BDA52979E1672860CF62C527DE1B346F0AC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738195, "uuid": "522d51c1-92d8-43ee-972b-9b9a1a00a2b0", "value": "1736d54edbb0bc75969c6531257cd3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738195, "uuid": "0232fa9e-c74c-4b47-8a8c-2a1e855e3b2c", "value": "12288:JBAWCCdRQv5EuUbC8jBij4on8cN27ofawaBCZQ:JBAsuv5+C8On8uawTZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738195, "uuid": "d7765c93-9600-4be5-a14a-1ad338655cf8", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738195, "uuid": "fcfe446d-6546-42b0-bc07-c7a903c8b2a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738195, "uuid": "8cf2d4fa-7b68-4df4-88a5-75ccb0b1a4cb", "value": "0f3d4d5318f5158eff689efe404dc5f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462f01e0-c452-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622714320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714320, "uuid": "d4387eac-f057-481a-a760-18fb976e943b", "comment": "Malware payload (RemcosRAT)", "value": "c95edf6adbb8c23515cc62df28ad8251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714320, "uuid": "b46c5c4f-be3e-4488-bfdf-819d9153a47a", "comment": "Malware payload (RemcosRAT)", "value": "e49652ae364f8e79333c289887bd0c3e5dde9efcad680039863ad32ea8ac9724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714320, "uuid": "53b428df-0635-453a-851c-8199e4a2c9aa", "comment": "Malware payload (RemcosRAT)", "value": "65ee23e7176fe0365f8632ce2b8c73524d63c270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714320, "uuid": "cf89a001-09c5-4d54-bf3c-d358d1e70637", "comment": "Malware payload (RemcosRAT)", "value": "6e59daec8ff69102dc747385bc222050fc40e7182df7f12b964b8e5dbfd32b7d43639fe376fd7d0431d34175ddcd3654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714320, "uuid": "7259d874-fa4b-4670-99f4-2738307d6da4", "value": "B0B4DF16F3A4CA8AF0182F734765D9010F743C53B475C63D685676E748B2BA31AABA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714320, "uuid": "fbcf5005-53e2-40c8-977c-9af5b572e54c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714320, "uuid": "a36d0c24-b8d8-4c52-89d5-42d362b1bcdc", "value": "12288:fPJmgyVLqZRN1C5vvoYyMH3JC+v0NFge:oDg1C5vQWH5OFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714320, "uuid": "8be3dbeb-a68c-46ca-8f94-a69f7825a23e", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714320, "uuid": "549614e1-cd2a-428b-82cf-04900f9ac52c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714320, "uuid": "b260ef19-0258-431a-bb46-5b74f6714cb8", "value": "c95edf6adbb8c23515cc62df28ad8251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b8b5ec-c467-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622723552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723552, "uuid": "825c165a-f7e9-4d10-81fa-d2db194ba159", "comment": "Malware payload (SnakeKeylogger)", "value": "5619f70a6959e949ad82cd4c4ff4223f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723552, "uuid": "9b51bd35-e68a-41cd-afb0-462ae220ff82", "comment": "Malware payload (SnakeKeylogger)", "value": "e4a4784ec60a517bbd0533e84611bdc1f3e73833aa35889860aff5bf41f7bfeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723552, "uuid": "7ca1c55a-30e5-4b39-ae0e-082c17fe24f7", "comment": "Malware payload (SnakeKeylogger)", "value": "ec7c2051a0ffc62635d5dc04f1914ede3e28608e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622723552, "uuid": "de1496d3-23be-45d3-b274-4f5ed937179d", "comment": "Malware payload (SnakeKeylogger)", "value": "bd187772bc69c7dd47820ebc1e0e4b0f1bab6bb16ee2268630f87447104293575274b32a114907bfc8fb52308b150485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723552, "uuid": "a8d597ec-554f-40a9-9934-2f7133d56e7e", "value": "28E4492439FA501AB173EFAA8BE479DADA6FB7733B07645D1091038A0723E41DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723552, "uuid": "e5c76299-1be9-4472-ada1-c5602b0f6f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723552, "uuid": "c5076c5a-c9ac-4369-bf0d-febb9969d94d", "value": "12288:NI50ZJLgeJfcwb8YFhYbLDdrJB8xX8CqGWK91AFGoJ0TBZZzLG26xPujZNVqGi9o:1WbLisK91T5Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622723552, "uuid": "867c3266-2c84-4f94-a99f-b266dc4ee04e", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622723552, "uuid": "ebb2fafd-5bee-4d33-8467-a2c5ef2f2abb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622723552, "uuid": "b663c227-7ff0-4d13-8baa-0c284a2399c6", "value": "SecuriteInfo.com.Trojan.PackedNET.788.25034.12742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d481ef7e-c432-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622700815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700815, "uuid": "da5e238d-b253-490b-8cf8-c909bca134a7", "comment": "Malware payload (AgentTesla)", "value": "5d196b27ef9cbcb777a735f4c67fc14d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700815, "uuid": "6806a154-1270-4cd9-acd4-8b6403623d2a", "comment": "Malware payload (AgentTesla)", "value": "e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700815, "uuid": "6b6542fe-fdb9-497d-aa51-6d45b2533d3a", "comment": "Malware payload (AgentTesla)", "value": "f1c903b2b4d18b081f129e043e181298ba24cb6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622700815, "uuid": "a1859ae7-b8f6-415d-94d7-d4e1ef51b78a", "comment": "Malware payload (AgentTesla)", "value": "4dc5827ed7afad50601a5e7d2f28a18791374c11cc47923fe266913183a38e312fe107ee5cc2ef40b07ae2bfac3e3ec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700815, "uuid": "dee2d7d2-b250-40bb-b34a-428731430f0e", "value": "DA75E8B2B591BFA4E32986738DDF586D87BD42FA17013F394F734988EE223538518846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700815, "uuid": "49200f89-d6dd-4cdb-87fb-04d321ddeae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700815, "uuid": "aa9bc37d-9f5b-4e69-85ec-e8a6547ad612", "value": "24576:jtGs2MTWjAHHzU7NdOnPPlYrntk5OVny2mY1gF3HJaHYe+D/:ZGsujAzGOnPPKrntyFbzpte+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622700815, "uuid": "b698cdc9-082c-4500-ac06-727839d72631", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622700815, "uuid": "4491cc34-dc45-4ee8-a2b6-82a3003ffc01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622700815, "uuid": "0cc7cc1f-2e0f-4d54-b1ef-bb5b3f2e8938", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b089aa52-c457-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622716646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716646, "uuid": "3323ab83-7671-41d9-9e5c-e112e6d5fb90", "comment": "Malware payload (Loki)", "value": "361c4561d7dd4c37a6ca78a1188c990f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716646, "uuid": "0a083a2c-3b6d-4f82-a538-9554b4683984", "comment": "Malware payload (Loki)", "value": "e6757fe21e4d69481178374e29b79d9634941c538d214f6645d56e4eaf187751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716646, "uuid": "b2bb964a-809b-45ae-aa48-7ee1cb33f2b4", "comment": "Malware payload (Loki)", "value": "48eb59d628774181a1ce39ed89899443445c1ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716646, "uuid": "39f10072-9224-4994-9f49-ab2a73a753f0", "comment": "Malware payload (Loki)", "value": "24912c901b84fff85447f5997146b5e7e70c9b12d5644bb3bc4a6ddfbefb41b57252cbf5306b00fd54bfa1f4233d9ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716646, "uuid": "5a694e15-f500-45e0-b0bc-9f2b9876d49f", "value": "C1649D81B590C4D7DFB80373746BD83A16F2DEE9A560510F639A7A637BB3192061BF08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716646, "uuid": "202938b9-f909-45e0-9c4c-0a2355c6d4e0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716646, "uuid": "844a3d89-4356-4988-ad9f-cee35d9c7362", "value": "6144:jQqi014v3RMbDTTjdArQqthiBFcY5BfWhPH/eT5Cd+1CGerPp:FC3H8HfYv/M4uCGeLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716646, "uuid": "ad70db68-ef5b-4ee3-b585-1b854222f3e4", "value": 321966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716646, "uuid": "d70ac607-9493-4cc4-8c1a-a71c75f3c112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716646, "uuid": "a6ad6927-a78b-443c-9e2c-481dd965125b", "value": "RFQ #7047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53953cc4-c447-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622709618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709618, "uuid": "1b5d4aa4-2c7b-493d-a193-1f2f1d59bf0c", "comment": "Malware payload (AgentTesla)", "value": "376df7215f6d49f5ee52e24a85f3204b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709618, "uuid": "b3446ddc-566b-4468-9d24-244f36daa229", "comment": "Malware payload (AgentTesla)", "value": "e703a313517dd9deb1ffd327ebd2206dc342b1a66ddcb21c47cd90fd6c76aab4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709618, "uuid": "53a9967a-f056-4084-a687-948adf29320c", "comment": "Malware payload (AgentTesla)", "value": "db1e18f57c0f931fd77066cd2b6de2a28f3500d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622709618, "uuid": "1a82a490-0ebb-4ea9-8ec3-6617d81f31f2", "comment": "Malware payload (AgentTesla)", "value": "8497afd7a13f15547456c4afb4be409ee23a8270cf8f5bb5454d416c6973163881dcaf036929e74151fc7bbc8e38a842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709618, "uuid": "4684036b-81bd-4af3-b7ac-770c5021b377", "value": "B9157CF8F198A8B1C54DC771C680DCBEEB220DFD6603096D05B9FA8D6A3378A9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709618, "uuid": "12148b5e-130f-43ca-91f8-27b8f3b7e813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709618, "uuid": "f1734e54-eb4e-47e8-862e-2e2015e0e417", "value": "12288:RugdJvTWCfKqfVrOGU04qJ4WeYdIV+Qd0ME/FPEn/bo9vAtnfyfmva+552E:3liPPO4Wvg+Qd0ME/FPEn/U9vAfiw53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622709618, "uuid": "4ba5482a-0b41-488b-b96b-fd7e370e73be", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622709618, "uuid": "5f89d1f6-3b3e-4458-8f5f-141e66b7ce85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622709618, "uuid": "79e1a662-e382-4146-b540-ff8d7f125ab9", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aae3b92-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622717844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717844, "uuid": "7ae5b21f-15a2-48b5-9ea7-433f1f688e72", "comment": "Malware payload (AgentTesla)", "value": "46eadea2077db56d94566a6c8b7d45c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717844, "uuid": "c8674d6b-d105-4258-844d-f36bc121a0c7", "comment": "Malware payload (AgentTesla)", "value": "e710dbf7987446d44063609b22f326f0568189a4035dfebf8cac9b97f4bed106", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717844, "uuid": "52118cfe-9fda-4ddf-9bda-65ca3b69a50c", "comment": "Malware payload (AgentTesla)", "value": "37bb553d3a81620d8504c7925ee4a95804bb0de5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717844, "uuid": "2f014d50-bae6-41e8-b473-f6da4a4ce24e", "comment": "Malware payload (AgentTesla)", "value": "4dbae12eecb9cfe383d6828631815103930a94c0cbd24d349b03a8ef533f35f2214fc3a04af845a233ee3ce98cc6de66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717844, "uuid": "9cc4b4e4-5785-4499-b74b-e2b7c53e0d51", "value": "0915390BFB59BEA4D25C1A7680131848C3DDC4637332F7AF46E5D0E27D0274A5A8E2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717844, "uuid": "4d8b90aa-5272-4454-80c4-dba1b3c4561e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717844, "uuid": "53f1e6d1-b0e4-404d-bf2f-bfabcc63d3fb", "value": "12288:L84GQRHGHWrOPcl4+q1Xr+jzen/BGHhyUx0oMVwk+ZmX7c48GvgsnI4KvG+A5HFR:44GYajcsXraen6hVMvvYsnn3ha2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717844, "uuid": "34ed683e-138b-451c-9264-e039c8f68072", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717844, "uuid": "98192955-4a0d-4916-b8bd-bb72889a5d49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717844, "uuid": "2f2fd577-8675-4820-9f36-d0c364e3969d", "value": "SecuriteInfo.com.Trojan.GenericKD.46369990.8945.8944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305c149e-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1622713854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713854, "uuid": "0df59f2f-331f-45e5-99d0-5f3ddfa132ec", "comment": "Malware payload (SystemBC)", "value": "5350c1492b2359b71a31ba103cc19b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713854, "uuid": "610b6a61-4142-44f7-8e4f-d53d65052bd6", "comment": "Malware payload (SystemBC)", "value": "e90fa8b16a3e943baf7882ce978b4903c3012be94370e99eb0560bb8e970d682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713854, "uuid": "51c228ee-4995-41e4-9975-62742444abcb", "comment": "Malware payload (SystemBC)", "value": "67b81cec1269523057aac6db028b33955bffc735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713854, "uuid": "522e7609-f5f2-4413-af55-a4d46a595356", "comment": "Malware payload (SystemBC)", "value": "8710dc27830189799bafab7061641c597ecae9854a1066f1f1da0b6af2f8224cc57a06543ec4f24c1e0b70670022fa38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713854, "uuid": "d6905301-03c3-4f54-9d3a-12e54e7cd26c", "value": "A0157D26F3924837C5332639AD5B67989C39BE006D38AC472FE81D4C5F397813D6A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713854, "uuid": "fb558f7e-0047-4c18-8688-d05e857145ed", "value": "9a2a7aae9114d22ac47b1fe0953c1e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713854, "uuid": "cfd62896-9853-454f-87fe-e41fa54c52ac", "value": "12288:u5jstvk8D3uz0yNIU58aA+amdQXwKW4dkaTSJxtBBmcDgAfXPyNPd:ag2YuAWP/fvdQgD4dkaTSJrjUAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713854, "uuid": "10c13343-c2f0-4419-b4ae-f1ab8c505587", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713854, "uuid": "4f437fa7-34a3-40ca-a481-f30b14926a2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713854, "uuid": "6ec77167-43d3-4f90-9b1e-c88ad639c816", "value": "5350c1492b2359b71a31ba103cc19b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13b5728-c430-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699951, "uuid": "84d2490c-7114-4620-b252-c683c9be8ff9", "comment": "Malware payload (AgentTesla)", "value": "998aa8498fe9c96865842d82fc1b680f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699951, "uuid": "2de34c5c-8f50-4579-a13f-91f36846563f", "comment": "Malware payload (AgentTesla)", "value": "e9b4cb23f9e8a68d296ba0f51cbfd513f7e621e0461e560f1cb910b38d172244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699951, "uuid": "dae848c5-af4c-423a-9279-11d8f7b8f5cb", "comment": "Malware payload (AgentTesla)", "value": "c37aeddcf5d70ec25836b1221d1d0b4393ec9992", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699951, "uuid": "9fa0bab2-45ae-46a0-b782-82b70d20cc6a", "comment": "Malware payload (AgentTesla)", "value": "bf8fd84e7a3fac3431a1f7418e85cc260dc0006edd329d612dff25613fbc03e7be4a7d90588bfa1f74a9ac923b09b27d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699951, "uuid": "3b1e9a9d-f72c-4ead-aaab-3a530d5cc169", "value": "F4F423131A4C5035DF8CCDF86EBA4DD1AF036E148649E59C83D91AE445206F6EFEE2E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699951, "uuid": "2318dca3-58a4-4188-95f3-4696109e256f", "value": "12288:IqM2mrCjF+Sp+AP721SsP0N/Ee8+mslyDXyCZJ4TGcDQzOj2fdkXSCO:VM2mrCxfQAoSOYq+msMD4TGcDj2FkXSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699951, "uuid": "c8014cc0-3ffb-4c3a-baf7-4bcdf2b452c8", "value": 765907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699951, "uuid": "bca6b7d3-8450-480f-97e3-740bb8d826bf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699951, "uuid": "b11131ca-bf80-4bb1-b364-b560b3615cd7", "value": "Bank Details.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ce6a92-c457-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622716526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716526, "uuid": "7956ff6f-e4e6-4cc8-a96b-11dbbe7cd8af", "comment": "Malware payload", "value": "361bc9f9687ec0c2994a3b6e84e74a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716526, "uuid": "25ccdcd0-9ae4-47fa-99c8-dd5d79a982de", "comment": "Malware payload", "value": "ea167f5460c5f920699e276fb0c51f32c862256415c57edb4bda5760a70b9e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716526, "uuid": "101e10f0-7e20-4bab-b8be-33c24c428feb", "comment": "Malware payload", "value": "d57e8f8a1fe62b190d0400ef8073582266a9df64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622716526, "uuid": "ef3e248a-0217-436a-85ea-7f5ab90960c1", "comment": "Malware payload", "value": "6fc8295ef7bc2d64019227cc4f8f80de7caa7a0a0d9b6bfe5be118ea4f716bfbe6f305c126bf7ae395ceb6b2729fdaf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716526, "uuid": "c530d097-a6b3-4887-abd3-17f49e2cc09e", "value": "49E4BE00B660C039F5FA11F89AA9D378A82D7EF1672850CBA3D51BE997B45E0EC35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716526, "uuid": "ff0e8762-6eaf-489b-aa7b-31ce171dcf6e", "value": "f63d142084447c3121e2666f17fcff1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716526, "uuid": "e6c378a8-0c60-4857-b306-7001ff0ff3cf", "value": "12288:qoKlLhP4vzpXYyH/Iofxgdq5d6hyzPr+znr2VphlYuGUoPavYWIJdvrQoDpBkYgN:mrPCz/H/IUAE6aLVFYuGDQ2vQonkRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622716526, "uuid": "c6a5268c-bc5c-42af-8a95-62d596d17cb6", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622716526, "uuid": "0e21df9c-3590-48f1-8aa9-867cabd6c44b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622716526, "uuid": "90a4b64c-623a-4796-a329-801b998ab3ff", "value": "ea167f5460c5f920699e276fb0c51f32c862256415c57edb4bda5760a70b9e4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e929bff-c436-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622702201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622702201, "uuid": "b1aa0b9e-5829-4aba-a9ef-5e429d8b45e1", "comment": "Malware payload (AgentTesla)", "value": "6c4927f00442585480d9b5f79fed73d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622702201, "uuid": "1ce3a1c6-d381-4461-9a47-098e1cfbb436", "comment": "Malware payload (AgentTesla)", "value": "ea67fc1a3e2c4217cb32d348a38a2ed6f17c2930fd3844a4b6a5109b8bb522ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622702201, "uuid": "cfff9888-4381-4d37-82f0-4c4c3b331773", "comment": "Malware payload (AgentTesla)", "value": "e6aa205db8ae87a3c82626d4fc9366fd78faf673", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622702201, "uuid": "7f46cac8-e0e3-453c-afa2-9c4f1b471f48", "comment": "Malware payload (AgentTesla)", "value": "4011c3f612eab72385b740f4ec8d406f9a5b003daa4dbe2f01c1849a9a8b3716ee6a16084b86e64e173ba62f9afadeb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622702201, "uuid": "9eb5ad7c-b9ae-4f05-8a28-6a59add93e81", "value": "241579736420617FFDC03EF120CDD3BB196D5C946E59B149CBE8BE8A26721C3B56122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622702201, "uuid": "3700df2e-c7d5-48d6-89ec-d965fe131d17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622702201, "uuid": "86f77b71-11ff-4950-8024-976b743e8618", "value": "24576:/7TYGkQ77j7LZFor1UbAje9TVL2sjP6GHpq:DTYS7fP/obATVKklq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622702201, "uuid": "fd7da4ec-6367-4f25-a205-f911159cb6d2", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622702201, "uuid": "0e1bc2e7-f7b5-43f0-a5fd-7418aeee0e89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622702201, "uuid": "d5c1ae88-e95e-40a5-9692-0834cb76df9c", "value": "NEW Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21683e7d-c47a-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1622731439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622731439, "uuid": "06362ead-bfcc-4814-ba53-356bd20f0e3b", "comment": "Malware payload (AZORult)", "value": "a1a37dc2bab00e0e4c125b068de78371", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622731439, "uuid": "80127568-7a59-43d4-b918-ad74b8275253", "comment": "Malware payload (AZORult)", "value": "eba13d2d3a2217296afb54dce9203015253967359181ddee11f7c456a4521c43", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622731439, "uuid": "775e0f9a-a23a-4f2d-9bef-f6bd1d9dbc2d", "comment": "Malware payload (AZORult)", "value": "a36dcbdcc914cfcc7fce2e0587d597b9b1710227", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622731439, "uuid": "4e08fa01-8dee-40a3-99db-a72d5d74b4aa", "comment": "Malware payload (AZORult)", "value": "f9290b32ec6b8f3eb08055b1f3e51557a9c39ec4805567845cda5d2e93ca6fd5fcd0d8488a739cddf6f9f3a1351671a8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622731439, "uuid": "8e479422-3490-4876-9656-92ee7e6616a9", "value": "C0C49EC8A788A891E8148DB804B1BE18537F5D5DEA5E4887119CF39F8BF1E8152CDDBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622731439, "uuid": "8d05f663-98a6-4e14-8c8e-6144414ccb6a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622731439, "uuid": "d9525ecd-a712-407c-9c04-c2e3ce9a8b70", "value": "6144:GQqmyrZ4n/vFUyXD/QAD20ZC5kBYnx6YDZLSNzqzM2sCp:7yrZ4n/dUG/QAVZjYnQSuL2sCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622731439, "uuid": "3ee8afd0-2435-4eec-bb4c-5236354ab8fe", "value": 563473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622731439, "uuid": "5651d9e9-1ee6-4bc4-b3c1-5a0c73ca2445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622731439, "uuid": "4c780cab-0142-4eb5-ae0b-48b6b6d44e8e", "value": "Scan01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b955b-c499-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622745082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622745082, "uuid": "b1acd184-7794-4fc1-add3-467d050e0e3e", "comment": "Malware payload", "value": "fa31d26884b6c2b5d32b5459f7bbec60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622745082, "uuid": "efaf29e2-e15d-4dcb-a0be-9e1f80d233ae", "comment": "Malware payload", "value": "ebe3a8a66db805806dd55d6b4dca64e24d9f7dd6d7dae730c514c5c4e58caa39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622745082, "uuid": "7fb73c34-4bec-4981-b657-3e97f1407135", "comment": "Malware payload", "value": "69165f62bcceb4607848186e37ff6603c8ebbe87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622745082, "uuid": "936c6f96-6897-47da-b404-d227e1473dc0", "comment": "Malware payload", "value": "13ce8392550c3b3b2bb277cfc669bb92b92104c6dc560f8b4bee7f89a8ede3b08ecabe415f0441f22cd236d18f857e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622745082, "uuid": "dea92878-d0a4-4c52-888e-a3699885ffd3", "value": "C5059F22A6F1DC33C1B2257F4F4AB2D85C2D7E412DE4B44676D4794CFF3A641B91A08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622745082, "uuid": "7be9ac60-c624-4348-9057-e8e41b8b720a", "value": "c13589351b888eacb104575a16a88b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622745082, "uuid": "67c5236e-2fef-4e72-b01f-0bbdb06988f3", "value": "12288:9wZeGjiyhybwk6VAn0+A2NUj4pfIMNFkKOOikhoAOpbAF++n/tu:9sjhyZn4VuIMzOAAbAl/tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622745082, "uuid": "c7ab42dd-4d57-49bb-910f-4916776c6f44", "value": 874136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622745082, "uuid": "a4a46d7c-0a94-4394-955c-1f6858021319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622745082, "uuid": "44f78297-00f9-4578-a1f2-d4b9451f8bd1", "value": "soa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257bfbca-c473-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622728439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728439, "uuid": "07b9752b-0285-4348-8c46-1d556872afa2", "comment": "Malware payload (AgentTesla)", "value": "a3560efd9aea7791d5a55b6f62ee19ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728439, "uuid": "a3bd1ada-8e2a-43a2-8417-7c4624b31529", "comment": "Malware payload (AgentTesla)", "value": "ebfa3b7367c9f13b4417f57c541a9c8c192a291cda5fd113de575d4ef53d8543", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728439, "uuid": "1ecbc293-4bef-47f9-830a-ff1fc7bca64c", "comment": "Malware payload (AgentTesla)", "value": "dcb205ef95ff046ad9e04248f6ff013727c6619a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622728439, "uuid": "bbba2b7a-f837-4a8a-b291-b4c7d34e9292", "comment": "Malware payload (AgentTesla)", "value": "40af46f15c89c1f2a2a2afd573c1c52abd8c1fc0c548a150fb20bf28587b1edae098ac13c56ac333281e61a1ff3b18e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728439, "uuid": "9ee49133-f3d8-431f-9fa6-cb8574bba0d2", "value": "91C3071D2BF89C00E6FF8A3715B25121C775B8810A6BCE4C4BD1F469197DAA09D1AFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728439, "uuid": "a5d5501a-c144-44f2-8d13-56d8ed9e0351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728439, "uuid": "0ab8f2af-5821-455c-8523-623009251cf4", "value": "3072:qaUf0fdcjor2y1iDJF9GYCLz4r3F59bMWcJwB6Sc:CMv1i9F9Hqz2D9bM9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622728439, "uuid": "d069c63b-3d9a-47f1-ac0a-3552a27d30d3", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622728439, "uuid": "a01fe995-e2da-4050-83a3-feaa0afa7231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622728439, "uuid": "ef602bda-71e9-49ae-b6c7-79635677dbe0", "value": "StubV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681247e3-c471-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1622727692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727692, "uuid": "1247f541-75da-4ffc-9021-8d5204e636e8", "comment": "Malware payload (TrickBot)", "value": "320b4e4cd22f51525cd1b8948c9b1983", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727692, "uuid": "5da0ab4a-b822-4818-9a40-4aea69c4c7a7", "comment": "Malware payload (TrickBot)", "value": "ec6a49295a862df8608ba226deb6798a8611e05f83158f2d4f810dc4c265144d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727692, "uuid": "0deaf43f-aa16-43c0-9423-d27bce73bebb", "comment": "Malware payload (TrickBot)", "value": "456be7a46d7b5142a8831a0356bc47c4bdb08e5d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727692, "uuid": "a8c60036-5008-44f6-928f-1706ca7d9b4c", "comment": "Malware payload (TrickBot)", "value": "3550ea6dc3f7ed98c391e90e68e16c8a3cc67160b834d7160b865f88de867586f4f8da1ee71ee6aceb0fd30984c9171e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727692, "uuid": "cad7e95e-db55-4564-ab12-c3c7e2797857", "value": "9715D6F32CB24372F93892F82719EAD1FD286B628723CD571780EA6F95FC1417A41199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727692, "uuid": "aeb10675-5fdb-40d9-b448-5948fbe2cfdb", "value": "6f2d14cd4c4fd4019c3f20263050953d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727692, "uuid": "83b8b0d2-6735-4d98-92c2-52a7f2576d13", "value": "12288:uKN0lVablIJmw6UcxbClJTk2W4e4TJPz7fmiMBvKoKVIyL2YCb0L:uAhQmw6UsKBkZSTJ9MBMI7PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727692, "uuid": "5c25e42e-7156-451e-8b2b-962ac17c822d", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727692, "uuid": "8dd90d5b-474d-438a-bbe3-6efcf9be689d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727692, "uuid": "6b37cd28-4eb5-4b82-b7ea-61afa7c9f1ed", "value": "ec6a49295a862df8608ba226deb6798a8611e05f83158f2d4f810dc4c265144d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5021f915-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622713908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713908, "uuid": "136b1e5f-a10b-4e43-a6a6-b5fbbd37c124", "comment": "Malware payload (RemcosRAT)", "value": "72c1ad67b8600b38f85d357b6a94ceaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713908, "uuid": "ddc00f58-2680-45c4-97cb-e0dbc629b5d0", "comment": "Malware payload (RemcosRAT)", "value": "edacb9ce365031b86ad1c3eedc43d903ecaa38e7904539de21d45eda78a4286e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713908, "uuid": "d880fc2b-5c7d-4e39-be0f-e3c150d4916b", "comment": "Malware payload (RemcosRAT)", "value": "97d3249e253e15a674a78d5700ce878c5def2f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713908, "uuid": "084a3333-5ac3-44ea-9390-d88cf7c83bed", "comment": "Malware payload (RemcosRAT)", "value": "08b4ad09c39e9d1ab50aa21fd9c121d8f87ebfb9146b836aeab826bde893dc8dc24d6f36a45a28301758061f3338287b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713908, "uuid": "afc591fe-b9d4-4ef9-893e-860208ac864b", "value": "7B258DF4F59898B1C54EC732C690DCBEEB211DFE5243092D06B9FA8D2A3378A9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713908, "uuid": "898b9f37-fd8e-4296-a96f-ac6f24938061", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713908, "uuid": "bc0310a9-5883-414e-815c-cb34ef911ef4", "value": "12288:iBeHvTN73CtDCbg69P8LdGoIg6tTFZWLkUKgS8O9ihJkyY7t9OcWky:37yxC19SdGox6tTFZYkeOchJk1JczX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713908, "uuid": "0c3cfb04-78b5-4e24-a454-57d9ca32e4ff", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713908, "uuid": "f21ac926-b87e-406e-9f71-c9d16c0c49d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713908, "uuid": "ea146bd2-0dca-4263-9415-1f35a13f266b", "value": "72c1ad67b8600b38f85d357b6a94ceaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec16db5b-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622714169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714169, "uuid": "ee45148f-6b9e-4d8c-8340-cb26bdbbe497", "comment": "Malware payload (ArkeiStealer)", "value": "4efa8273a314d4ae643afbb599b23a85", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714169, "uuid": "1d9678c6-0c59-4e7c-b3a2-977fb4575f66", "comment": "Malware payload (ArkeiStealer)", "value": "ee5b56341fc871f88e2a32899bb9ad27db349918616db5fe20dd6540ab309a52", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714169, "uuid": "cd4bb390-2c79-4fa8-903f-01afde93c78f", "comment": "Malware payload (ArkeiStealer)", "value": "5aed1c050c33e30fcddfa81a4278b7b372e6303d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622714169, "uuid": "f58b805f-9894-472c-8bb1-60744bf5022f", "comment": "Malware payload (ArkeiStealer)", "value": "6a5be6c0086b02957f98b32c6ee549e4732319825c1f1b42096edb0b90f2b249d036548ab4ee76e67e07d02e5217ba6e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714169, "uuid": "6908478d-6552-4d9d-8b39-02d488e2e279", "value": "5815F100B7B0C030F5B716B49A7691AF953ABDA17B2451CB22D526EE3635EE0AD31F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714169, "uuid": "5ace2e1f-779f-4364-8092-4a6dbdc045f5", "value": "788842c19811b0f2f6994735b8f363a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714169, "uuid": "62413f0a-d542-43b8-a572-b6d4d3915f2e", "value": "12288:GPh7zAanyI+8jZJkMT5RFILHdpHusE9WbI46VmQVJ52PtbNF0tRysTgJ8kLVPTKw:G9lnyD258OMOVlJkVbsjkJ8kvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622714169, "uuid": "de855368-ee0e-484e-a294-12df26af3c7e", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622714169, "uuid": "7f479d60-6537-4983-b937-aa85dbe8fb29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622714169, "uuid": "f394e4b2-3729-4e96-a19b-d14f12e0eac2", "value": "4efa8273a314d4ae643afbb599b23a85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4ef317-c471-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622727617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727617, "uuid": "734af910-6b49-4d0b-86e9-0674cc1733f6", "comment": "Malware payload", "value": "d534c439cb108c89522bb611a7aacbe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727617, "uuid": "ae18635a-eacc-403a-a370-05ce164456b8", "comment": "Malware payload", "value": "f16d16bdcef4fc4bf64c7d44ddb884deb14dca5299c96660011f68f14f7d540d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727617, "uuid": "d7283c3f-9dbc-48aa-b611-302b1d83a979", "comment": "Malware payload", "value": "d74dbae15fba94f54f887756c7f9d950c5d43a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727617, "uuid": "ca661982-6b06-4ccf-aa5d-61e3ca002820", "comment": "Malware payload", "value": "2ad6cb78c661c009914246c9f6d4674bb2f6089e32193f47b458d4b33de7a55bbdbe8a8309ed6a5f4ee140aeb9474ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727617, "uuid": "12e16f7a-3a90-4b30-b744-5c9604aba435", "value": "B3043E9C7FAB515BEC918174C7F6EE44400B3CA064728C67E1E3392FA7246178A65FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727617, "uuid": "21c093ce-2933-40f2-8321-fd060db3a53a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727617, "uuid": "9d27d315-e512-4976-af51-76b9ef747ac4", "value": "3072:xsse+EQNBysHivCCCZCCCZCCCCZCCCZCC+P5J8Y:y+EsByoyCCCZCCCZCCCCZCCCZCC+Pz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727617, "uuid": "fdaab7a5-8a55-4c8f-9054-cec916840a4c", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727617, "uuid": "b34d113d-8d75-400b-802e-1efc4ff24ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727617, "uuid": "2397b611-c358-4814-bf80-d97b5e563503", "value": "SecuriteInfo.com.Trojan.GenericKD.46409230.13045.5920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c761e48-c451-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622713821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713821, "uuid": "8a9bc12c-f3c1-4a4f-b6ff-8d3ac022acaa", "comment": "Malware payload (AgentTesla)", "value": "846d357601d74fe9facba3c0ed069d40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713821, "uuid": "911e8267-761e-4ab4-a0bc-1a8a47f0ed09", "comment": "Malware payload (AgentTesla)", "value": "f2c61768be1321792830e8fd0ffbc0a049f37d44b7d54cb2e943d5d98cbf7fcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713821, "uuid": "b99ea963-f716-47a2-b145-3c4489862e67", "comment": "Malware payload (AgentTesla)", "value": "764ed013c6e787bad4e975b92d5857eff4040e4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713821, "uuid": "ce4648f2-d7ae-4833-99e4-858ea1f48cfe", "comment": "Malware payload (AgentTesla)", "value": "d33d3d50950d22bafe9568a93ae017c1df26d996569b24ef20dba718cdaa7dc30bf385ff5d83b4a325991da5c174fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713821, "uuid": "b5e3e446-77ac-4c8b-8381-3f8eb7c0fa5c", "value": "9675D552B5928D28E24986B3ADDFEC5942BCC1F527416F394FF35D482EE2352C9388C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713821, "uuid": "2d3b3c3e-416d-4002-83e0-b1c10bfd6481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713821, "uuid": "5f3f7c59-ad96-49e4-a898-09bb228bd965", "value": "24576:LNtHFtguXAHHUSiwC/V32ikI2nnlcFd7Q5:5tlWiwC/V3JkI2n+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713821, "uuid": "f31c9ec4-7ec9-4678-bf95-9a4e3e77a264", "value": 1611776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713821, "uuid": "eeffaf8d-ada3-448d-ab06-62f2f209c19a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713821, "uuid": "1dbb4533-ebf6-4fbb-ae20-ffef58d1c921", "value": "846d357601d74fe9facba3c0ed069d40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66800140-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622737997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737997, "uuid": "42b9f32b-bf38-49be-aafe-f755ea58533f", "comment": "Malware payload (ArkeiStealer)", "value": "5e6e5fad6ad241b653840b7fc299f7b8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737997, "uuid": "51b49e98-3797-4644-817c-6833f681d224", "comment": "Malware payload (ArkeiStealer)", "value": "f3111a72a43115727e0224015777dbde5f4dbf285fff1b7b28f5444fa19c5310", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737997, "uuid": "1f0fc36a-052b-4f86-a23e-2d12acf0550b", "comment": "Malware payload (ArkeiStealer)", "value": "8417b9f76c4e5c9fa6fdecb4c1f08f6a45333f4e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622737997, "uuid": "03c8353e-d624-4d55-bf9d-f8fe93fd2f79", "comment": "Malware payload (ArkeiStealer)", "value": "aebb384e5194fefae5d57207501c5052ec64d32d6474ba6fec83a020f7452e1a87d04d03aeb835a62fb3e65e2547a1ee", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737997, "uuid": "c0c961af-a59c-4705-8aaf-61933780c126", "value": "9A55AE6DE122EAC1D127BC3AC2BA400412FC7E7B797182C2F95825385C9D6BA9D117FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737997, "uuid": "2bcff440-8b5a-41f6-a1f0-f9158a472de4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737997, "uuid": "617eaa46-d4cf-42ef-af6c-3949cfed1da3", "value": "24576:rGSTR7HjO32H4ePUq5crSpB2uM1LC3MMTRSq/VB7H:yKR7DO32YJAcW+R1LC8MdSq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622737997, "uuid": "b910d785-60c5-4818-a62c-0932f6036e90", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622737997, "uuid": "1512a358-b47b-416f-95ff-5ab1c49f995b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622737997, "uuid": "ae0f1227-86aa-46e0-b8ca-1e931be718f2", "value": "5e6e5fad6ad241b653840b7fc299f7b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61286647-c448-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622710071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710071, "uuid": "f2e167fd-37d2-42b9-bbc1-5531a0c44703", "comment": "Malware payload (AgentTesla)", "value": "a3fe9e9f94c184e5e3378835810a81b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710071, "uuid": "19b6fa9d-453a-479d-b427-53e6601eef6e", "comment": "Malware payload (AgentTesla)", "value": "f37df491fc4f9865cd58b4ac28d115f4508d209cf30e937fb23179d18f16162b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710071, "uuid": "aa7a6379-2c18-4212-846d-03cb4f69ff90", "comment": "Malware payload (AgentTesla)", "value": "ea4fa085c95d2a5b5cce7d624c4db2d9c38dd865", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622710071, "uuid": "df22692f-cfa5-4dd0-a594-dd7639b71da2", "comment": "Malware payload (AgentTesla)", "value": "be4dd4bf63d5a573cba5019558f39fbfc4d748a7269deb5716c1c418a6aacb04b873d34ad1379777abe1e1030cbdc11a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710071, "uuid": "70b1e161-3787-4539-a089-88a50e6fef96", "value": "5B15292439EA5019F173BFBA8BE475D6DA6FBE633B06545E20A0334A0633A42DDC153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710071, "uuid": "6d6f52c8-9afb-48db-9c03-368bad5d1c64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710071, "uuid": "d9b693db-08bb-480e-a532-43df3dfbb8cf", "value": "12288:1AWkKuXrYRNONLrJ3ecDvYTx36ORC62eTg8WHEu3lkXGEMRU8cdGUtDpearFBuy6:Q19eKH5P8dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622710071, "uuid": "614281b5-54a1-4836-84c1-b20cfa969417", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622710071, "uuid": "c9f3236c-6303-4b58-8504-e0ed85dfa681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622710071, "uuid": "42fa97a5-9a41-486a-9a04-0d5e95cb4bd1", "value": "SOA.rar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9b64e7-c47c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732561, "uuid": "4db3e89b-394d-45cc-b144-497873944573", "comment": "Malware payload (AgentTesla)", "value": "a38d78640c239d623cee682fad627b63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732561, "uuid": "996bb4a4-87be-477a-a6ea-263d2743d1e0", "comment": "Malware payload (AgentTesla)", "value": "f3aa33624436186d1a98332a8631b6e59b33e3d9bbebee334753d29966574ee7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732561, "uuid": "70c71941-dfde-4b1e-a996-736ad494c43e", "comment": "Malware payload (AgentTesla)", "value": "0b200cbd7a0e2e7e63fce957e73387f11f3c68f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732561, "uuid": "993d5213-92cc-4e00-a019-7068dbfa8b8c", "comment": "Malware payload (AgentTesla)", "value": "b0dbb3e60ad34379d46c8ca5bddb09aec5230b654067d0973362e845fdb7a7c79b4aafb378db7a814c75c0db02a91d23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732561, "uuid": "9b629268-37bf-45a5-8651-b70761cb02db", "value": "87D4233C84315217F1246DF98E4E13738BDDA2AAEE33C5297FD4E15CE54582838BAB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732561, "uuid": "ae806f7e-904c-45f7-8de9-f1e224f92457", "value": "12288:cbCwb4rmy5azi0/WMe/VUu1yJ6VkLxiVKSTNZ34xnulKARfwt5Y0QZbvqe:cDCu3/Leq7J6gkwCZH0ARot5d6bvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732561, "uuid": "4e188040-846c-448b-8eca-2b68d4ebada5", "value": 620298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732561, "uuid": "2d60c324-f4fe-41ae-a4af-e8f65ebca263", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732561, "uuid": "c8d58b70-47c5-4d1d-9c18-8b3921860f92", "value": "quotation 20077162.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b8702a-c47d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622732706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732706, "uuid": "6a503f86-4127-430a-8b40-7613a85db42e", "comment": "Malware payload (AgentTesla)", "value": "dc3c188ee07ab654041c4a31ac0d97dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732706, "uuid": "b35b4ddb-253e-4440-9047-46b448d2079a", "comment": "Malware payload (AgentTesla)", "value": "f3c213146e15e0f4b33e10b6468c7e686aa76328adc46f6f17f500ee7a05e6d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732706, "uuid": "99c8e5e0-3cbb-4e35-814a-1279e3a1cccc", "comment": "Malware payload (AgentTesla)", "value": "5236454889673f9e92e058dab2256e48d162925a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622732706, "uuid": "ca62535a-adc4-4a19-b334-069eb8a6e7c2", "comment": "Malware payload (AgentTesla)", "value": "f9c9a8209cf3553e7c1f25553227abadf54b2665fe73ceb358d4a82404b27feb40770e1c9be3066262e9291d31234ab2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732706, "uuid": "cc30d2c6-0994-49cb-9d9b-b23dee22e365", "value": "357423BCA05A722E8D937B60137A25DA9C6D604F8F96F8DC9CB3F3CA4130895954494F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732706, "uuid": "13ad3204-443e-4885-b22f-03963fa25ce4", "value": "6144:OGi3ATDspOwe5Nt9tU9YCcZAOCJiZM4hyjRnVVrVs4O7f/3JaJwvy/aHikK3tWe7:+wTDsXsVCoMF4hyjprBg/zFQWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622732706, "uuid": "da0ef816-9fcb-4cce-a4bd-51ba6cdd50e6", "value": 342085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622732706, "uuid": "c0b0c1ee-cf32-469a-b750-015d6dd7a1d7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622732706, "uuid": "70a0ee2d-5eef-474c-954d-39aa156fa37c", "value": "Swift Copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887b7e0e-c481-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734618, "uuid": "51fe14b3-3f19-4f5c-8b0e-08f713324972", "comment": "Malware payload (Gozi)", "value": "b3526bc3c4a61f9f09ac31ee9a5fc8a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734618, "uuid": "f4670836-0a7b-47d4-ab9e-49513532925a", "comment": "Malware payload (Gozi)", "value": "f4a464c2e5f14cd4c391a9b5ba60deca36ccaa6c1503a097eeb0c5070945d1fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734618, "uuid": "1a0c7282-04d7-468e-aa01-96a96d42b0eb", "comment": "Malware payload (Gozi)", "value": "d92ac3fa9cca4ed8273111f767e24d8f53896787", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734618, "uuid": "882411a6-4956-4bf5-8273-87c7365ffcc8", "comment": "Malware payload (Gozi)", "value": "44f0309103ada2d120d0efa06e960ef4c389448b93a5382dbf016026d027a6607381877d46efebf172d51acbbc586241", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734618, "uuid": "3a9a73b0-b2fb-4344-9cc2-9abad1933631", "value": "9E84BD5076C6E031E17241354A69EAE0073DBC629FA10B8F77E41E8F9D7C6C26E35B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734618, "uuid": "f7dc7831-e076-4785-bf77-38c829d02fab", "value": "f97da13a5df33dbcb72f17527b1d6819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734618, "uuid": "579b94cd-48ab-4539-a0a4-a7cd795a5e77", "value": "6144:hC5FUWwNmY036ua+71w5uJEr+AitTdyh+a6R+/ZQWdB:0FBwNuKu4umqAinyh+7+h1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734618, "uuid": "13c55e71-a449-4c02-a117-d628e47e4705", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734618, "uuid": "76ac707e-f4d1-40c2-8718-fc68aa28281a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734618, "uuid": "5e5cd66a-fb1f-4cb8-90fb-dc1c8b095b4a", "value": "shorefront.eps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b526239b-c489-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622738129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738129, "uuid": "e3b96d52-886b-4f27-83de-c0c163d077f5", "comment": "Malware payload (Loki)", "value": "f8bf1d1a116dfac562587cd1dafa98c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738129, "uuid": "a4c8ec2c-bb48-46ed-97a1-d29e2a6932ec", "comment": "Malware payload (Loki)", "value": "f53bc46a9009d6a514774eda324f85efc23f9f3273a07f206446109c1be74c71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738129, "uuid": "c4d32432-bd0e-4b29-8829-96e5eda3f8a3", "comment": "Malware payload (Loki)", "value": "b2ac6d81833c84b97fd7b2942173238b104a5c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622738129, "uuid": "85f82abf-b205-4828-bcfc-7cbec05558b9", "comment": "Malware payload (Loki)", "value": "c0b7c9792a3abba095d843e3a47c605d54894310d4b4fe63ca21bea19b0ab5eaf622d95957e6584adfd4c7cdb11d1470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738129, "uuid": "cd5d1520-8002-4a23-9391-8675ea347d64", "value": "DD9401AB32A0D0B7D9A587B255AFD2726B64F39A7201259B7340DBEF74C4038930F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738129, "uuid": "60a5a832-ca85-44be-91f3-c005d1cd2988", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738129, "uuid": "9fbde83d-c1d2-4802-b786-ca24b68b5f6c", "value": "6144:dQqtWNUBe4CiJjcpiGX/py261hQMdKXeNm37d73ZlWXvXZRAZJrwpiZYZkAUnbMh:U4CiFA61hQ+KX/R3ZlGZiZF+ZkAlPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622738129, "uuid": "8b76f67c-23c2-4e75-bb3e-ab5828b82094", "value": 412349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622738129, "uuid": "ff6e9692-6143-4881-ad6d-6fd2d3776905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622738129, "uuid": "a411bcb9-2ba6-4008-9f40-5100627ec555", "value": "f8bf1d1a116dfac562587cd1dafa98c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aad4c0a-c45a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622717871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717871, "uuid": "63933599-5ec1-43ed-9df5-af2dcc6a6dac", "comment": "Malware payload (AgentTesla)", "value": "7c47f30bcdb61dada53d87ff5c73115e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717871, "uuid": "db10e133-5dba-4fee-8fb4-ca8f2f216d0b", "comment": "Malware payload (AgentTesla)", "value": "f60aef03895677e34311836bdb586b793d92603af6aedd460fa4db391d55ff26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717871, "uuid": "29fef9f4-17b0-45c9-8013-8ec49e81637a", "comment": "Malware payload (AgentTesla)", "value": "b89683e1df8c9665fb3752d98cb7bb58c8a8dd62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622717871, "uuid": "df72d4f0-cd51-4e5a-b58f-9679d5283b76", "comment": "Malware payload (AgentTesla)", "value": "d563787d7633fd1348d006788b49c55decbb20bb1151660ff8cd6ef9c4d5a4b77ca533d56a201c0a58bfff006b9ed598", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717871, "uuid": "55270a2b-57bb-40d0-8860-f75115ef446a", "value": "0225380AF786BEA5C16E0B754053145C87EEC5537372FBBE41E494F2BD02B4A4A8E1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717871, "uuid": "7076c2f7-804f-407a-b2e9-d95be4525ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717871, "uuid": "fa9a177b-2878-4922-85f8-6d46bd9f8d5a", "value": "12288:KSfOZ304nh1w3Ws1dbC9XmdwkwrAubHAd50H6QnatenC71c48GvgsnIZKvJvtuCH:KmOZ30+s3Ws1HtAatJvYsnNtuCcmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622717871, "uuid": "4511da1f-cb98-453b-8609-21fdc69fa852", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622717871, "uuid": "0eae2024-8e79-49ed-93a7-2bea755ccd92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622717871, "uuid": "4891e2bb-1a9a-47dd-9fe1-e5e30002ad37", "value": "SecuriteInfo.com.Variant.Bulz.480664.28948.23644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a557d2d-c471-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622727642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727642, "uuid": "3e54dcfc-9581-4105-8a88-56a8f67c9f73", "comment": "Malware payload", "value": "19295d360b9ca2678d757d87d9445a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727642, "uuid": "bfb45339-f331-4d36-be5c-8ac1c3b1f1c1", "comment": "Malware payload", "value": "f6baf2cbb7e86d3c1e140b0cc62dec7de55cc5359eeee7eda6f21ce0a00c13e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727642, "uuid": "659595fb-d727-4078-8303-59986d236bec", "comment": "Malware payload", "value": "ac9d2e9364f8914004af53406627e04fc8ce2b9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727642, "uuid": "138f09bd-985e-4a58-9441-ff761e214c0c", "comment": "Malware payload", "value": "428677827371a969d3d7bc2b35a5ed8089558b5341643fdabe895233dbf2fc64feff3d47c709e03b620ee562c8ef3b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727642, "uuid": "5b8e2c83-3e45-43df-ac2e-da57bd3d8ceb", "value": "91643771242BF7A2F4624C3F8CD5B0405E796B8AA2115F48A435AD4AC32C37D49FF69E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727642, "uuid": "f5db9d69-97de-4718-a53e-730d47b69553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727642, "uuid": "a390e18a-414c-4a17-a5f4-dd7cf8e53ee3", "value": "3072:EDxVMVmeyYYq5rHRhXKpxCtqKl/geOwxkQlsk4ex8AM4yJ:EDcVuYYq9XIC0Ktj/xNWOFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727642, "uuid": "b5d932a2-d643-42d0-8a59-70538c511198", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727642, "uuid": "0058d216-a319-44b8-ae4b-631a58f68239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727642, "uuid": "42d3635d-d7c8-4f36-91dd-ff0116ab5226", "value": "SecuriteInfo.com.Trojan.PackedNET.783.10804.27219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1795f4f9-c46e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622726268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622726268, "uuid": "7a88121a-c9bf-41fd-a622-daccda8996b3", "comment": "Malware payload (AgentTesla)", "value": "35e296ec6d05d9e0c90e5e2f5b1c1adf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622726268, "uuid": "a8204870-7055-4cd1-94bc-7b461d81d76a", "comment": "Malware payload (AgentTesla)", "value": "f6e9174f6712aaa52c7a669e88a15eb08b4e901e94099bf1432bf1f7b2952d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622726268, "uuid": "63eae476-f4a1-42db-b895-ad8c5a52373e", "comment": "Malware payload (AgentTesla)", "value": "b39c44f324253e3cab11eeaf070cca30275ba192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622726268, "uuid": "9d2178ad-b40a-4c0f-8c05-04164de68966", "comment": "Malware payload (AgentTesla)", "value": "72e3402d738f21938d7e05ad8e754364e4ae57fb393975ee4f87aa534537dcb3bdbf8736d91dfdfd002dbe37304e196c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622726268, "uuid": "5f13e13e-a854-421e-9b79-62d6e8f33eef", "value": "AC156BF4F598A8B1C54EC732C781DCBEEB211DFE5603092D05A8FA8D6A3378A9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622726268, "uuid": "78e53c47-9091-43b2-9f34-1a3f1e3c53de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622726268, "uuid": "89256634-d421-4bc9-a57c-8727e08cc55e", "value": "12288:PE0bSvT9rb+DlXewmtrllhjYlshxOS4tfD3g/ciWRJZ2qlCK:F1eZDhjYlUPaO8Z2ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622726268, "uuid": "a726b1e2-ddec-452f-9c40-5c161b40cb14", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622726268, "uuid": "bb6037ad-655f-48fa-b49d-200a3a122b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622726268, "uuid": "ddaec0f3-d720-4f8d-bec5-0c8afb1386fe", "value": "ESA90844633.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db094287-c450-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1622713711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713711, "uuid": "25d35850-cee2-41a5-bef5-fec6b086bff4", "comment": "Malware payload (SystemBC)", "value": "b8e091ab0a94f3be56bbc2b66ccd653a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713711, "uuid": "f30eeb0f-9e6f-4afc-b6ec-59e99c5aff6e", "comment": "Malware payload (SystemBC)", "value": "f7330d13166125485e745bcbe75e8c2af7423be00c70a0765610ca86d3b01eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713711, "uuid": "4a30a254-60b0-4387-8e61-316fcd2fde65", "comment": "Malware payload (SystemBC)", "value": "e62f75fcd271409e1c9eda1c60c0178247bbd3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622713711, "uuid": "118b10e7-cec8-46d5-bb64-b10ca422469f", "comment": "Malware payload (SystemBC)", "value": "8f3c29acba56ab1c120fd133b569a4d2fc77f62b5abdcc3803c8a4ffbc8e1cf6ffde6bac185e6467f66f51d3396d7283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713711, "uuid": "42663b49-b28b-4416-a7bc-aa999417cb05", "value": "D0157D26F3924837C533263DAD5B67989C39BE006D38AC472FE81D4C5F396813D6A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713711, "uuid": "d695732f-4032-4203-9660-8cbff1df6637", "value": "9a2a7aae9114d22ac47b1fe0953c1e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713711, "uuid": "d026d5c1-6b22-4d84-bd81-eb21bb740343", "value": "12288:u5jstvk8D3uz0yNIU58aA+amdQXwKW4dkaTSJxtBBmcDgAfXPyNnd:ag2YuAWP/fvdQgD4dkaTSJrjUAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622713711, "uuid": "d123d5f5-e445-475f-8773-29762695a126", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622713711, "uuid": "97d234ab-59b1-41b6-908f-b39e6d774681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622713711, "uuid": "1a7875ef-a767-4d34-b59b-00edca1baeb0", "value": "b8e091ab0a94f3be56bbc2b66ccd653a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1336fbf-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734284, "uuid": "e9b0bba8-5993-4ed5-8933-460e47fdacdf", "comment": "Malware payload (Gozi)", "value": "efb92925b144840e5a35d2807b42b09b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734284, "uuid": "1fe2dbeb-c74e-44b4-94f9-caeb84e8738a", "comment": "Malware payload (Gozi)", "value": "f7fe2c3969d0e34e88cee07fc7623b9e7aa0cd30231e7e2ddea6b9b967fe7702", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734284, "uuid": "22624eb5-dc6d-4b0b-b338-def4bb9221b7", "comment": "Malware payload (Gozi)", "value": "50c4b3a4f3eb4ddac6de2773ce91b39e74492ed2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734284, "uuid": "6679015f-670f-40b5-be43-9e42d5fd86ae", "comment": "Malware payload (Gozi)", "value": "fa9ed71428b613fdb649699c3bd3cb3b890ffcda6ade684c2355adcc8563dd1a0c4c6262a4f613fe524c5f91d1c583fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734284, "uuid": "2f43f148-5e69-4d3b-b639-41ce78656955", "value": "7DB4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734284, "uuid": "72c7eb77-afac-4a86-aa1d-57006bc8260d", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734284, "uuid": "77529fe4-c77f-4988-ac10-91426b5a184a", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvwqW6mZuzuJPjX7R75:vz75tzST8AYq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734284, "uuid": "dd782bf7-2e1e-4c45-8e01-2edd42d6a599", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734284, "uuid": "04e8fad6-2ecb-426b-978a-ea1a7e27329f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734284, "uuid": "b26cc017-b783-4cb4-9c3a-50ff9f654120", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebae76d3-c480-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622734355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734355, "uuid": "3a7f26da-c3fe-4e7d-9336-8d28dff08e19", "comment": "Malware payload (Gozi)", "value": "1e50905e13be743056a296745da33567", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734355, "uuid": "f49119c8-7683-49b5-a560-03f2a0533669", "comment": "Malware payload (Gozi)", "value": "f824b2391d7ef4d4214ff90664192f4e2cb9636e80688593a800bf1aefbb07a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734355, "uuid": "c8f4f9d8-d707-49dd-b98e-0e7d35b350d9", "comment": "Malware payload (Gozi)", "value": "7483be7ed1d73f97634c6de6aaa1829f96e712e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622734355, "uuid": "a64ec13c-dbc2-409d-b960-efa6d738b540", "comment": "Malware payload (Gozi)", "value": "0b15a2ba625a892b5a99a144d49ca622eaa789e174b73f9bf7c15c58a0a90aa899acd6944ad9f96ff5847decd7d25dfa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734355, "uuid": "521c8cd0-4744-4b56-b4ff-0e67894c9963", "value": "B1B4D000B682F976C02549399F96F5E4471CBC144F691A9B32C86FAF6F3E18305397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734355, "uuid": "fac1b3f0-9090-4db8-ba17-a250ee6dd34c", "value": "3bfdfe7fdedde57f8d113c7e630bd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734355, "uuid": "56c88491-64c7-49a6-b075-ad9ddb2fbcba", "value": "12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAvLqW6mZuzuJPjX7R75:vz75tzST8Ajq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622734355, "uuid": "67268ae6-4edf-4e39-a707-f26428c51300", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622734355, "uuid": "1990a71f-ba18-4e51-93c2-834e14164ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622734355, "uuid": "9f7d369b-a6f6-4f3a-814c-7029c423dec9", "value": "racial.drc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1137f3d-c434-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622701695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701695, "uuid": "e8a0ad04-9b4f-44c7-89f8-34d687e61d72", "comment": "Malware payload (SnakeKeylogger)", "value": "3f3717ed17813d8091b2243d8afeade6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701695, "uuid": "d4a8764c-09ff-4e7f-943b-d89412ca5078", "comment": "Malware payload (SnakeKeylogger)", "value": "f98ba09a6a83dc7686855c00411608fd3c1af1d60a915c799f4f20fbc8a238fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701695, "uuid": "8e7e9b26-7198-4992-b215-bf0f79fc98bf", "comment": "Malware payload (SnakeKeylogger)", "value": "9bf5154f06fe0ea558700c1108646e40cb857ebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622701695, "uuid": "b8962c81-645e-42c2-8eef-5414dd591eed", "comment": "Malware payload (SnakeKeylogger)", "value": "b26b6e4cb21c35ce0dbfd5e3ed763591ca53c3d5325d4de51711c22363884281dc0c16e1ac56617e7ed105919fcd3ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701695, "uuid": "8de6e714-e90a-46c5-a852-e5322c9360e9", "value": "5CF4392439EA501AF173EF7A8FE4B5D69A6EBE733B03645A2090334A4633981DDC153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701695, "uuid": "d72d471f-ff8f-42b2-9207-c42fe22e6275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701695, "uuid": "6811df09-6a26-48fc-b826-08ee5013c1be", "value": "12288:Bpl5hLvt8L2CJHdsrk2czYVV+xVXkQwwVuB94ql+au5yc8PESb2Hx8W3xv8JqbyR:bt7WK2uiyExRSJdhjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622701695, "uuid": "6f5d57f7-bfa0-433f-ab71-ecfe7a63e762", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622701695, "uuid": "609f6897-16a4-4194-8681-74f482639b11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622701695, "uuid": "b163aaee-364f-46d8-8f76-ef0cdb84acc6", "value": "PURCHASE ORDER 07959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de5187b-c44c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1622711810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711810, "uuid": "e8407ad4-a872-4f21-b3de-9002761d3489", "comment": "Malware payload (TrickBot)", "value": "7bad9bfadd445f637abb738bba8000c7", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711810, "uuid": "52733e11-78e5-4899-9110-3bbbab345ae9", "comment": "Malware payload (TrickBot)", "value": "fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711810, "uuid": "0e752068-8633-4ad9-8cf8-b36d8689884f", "comment": "Malware payload (TrickBot)", "value": "9f286f77edda0ea0cdfd3fbd897b3e007974d30a", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622711810, "uuid": "f5d82fa1-3a4f-4e99-90ef-aadd4a94b778", "comment": "Malware payload (TrickBot)", "value": "39487981fb4f0506ca10309d824b1b01bee445386fc2a25fe54c537f41c10d63be4004ba2db5074d693daaae2ed41c9b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false }, { "name": "rob96", "colour": "#932183", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711810, "uuid": "0e828ca0-d5ab-4e94-9247-4baadabd0105", "value": "B1435394A349DF1AD645383C9CCA9AB212269E43B83F00C7269D77DC9CB6C3CD7A0756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711810, "uuid": "8553330c-00a4-4642-88c8-090bf2111d21", "value": "768:huuAWOOmKnnwOj+KCBbpCdOl2WDU7S+9mZRWAm8Wib2mkN:fIFCdN12WFgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622711810, "uuid": "25ee2a85-ee73-4075-874b-8c200a748394", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622711810, "uuid": "44223cb6-5579-4b03-aa1d-0b2446e72cf1", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622711810, "uuid": "e4e34309-a9c5-4613-9226-40802c5153c3", "value": "template-jn02b3.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74209c4c-c42f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622699365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699365, "uuid": "b0963866-69ee-4cd9-860e-826dbab34093", "comment": "Malware payload (AgentTesla)", "value": "c2551fe8efe908d1ebcea82607408aef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699365, "uuid": "93b6f4f2-0222-4928-bda8-29dd159748da", "comment": "Malware payload (AgentTesla)", "value": "fd80bdd9cb1cb0f140ce78a39a8c73087f27c85322ca17ed66a39026ac09c151", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699365, "uuid": "c9b1ce97-1b31-4d95-a689-c3c7958e0e79", "comment": "Malware payload (AgentTesla)", "value": "3689322849452533eda6a8c053542c887589b1bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622699365, "uuid": "d55de22f-6c4b-484c-9f40-b3fabdef6b67", "comment": "Malware payload (AgentTesla)", "value": "d976ff437526604b9ade9fa73b3edc7b9cad039442f86e7286124660bce4e218ec2620d99c1df362788b03a32c029ff8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699365, "uuid": "ac113f8b-efb6-4677-96c2-860a0b361d80", "value": "5DB42376DE65139B004D2B68F2122D74028CFAEF20C4AE9F12E777A628D6CCB5951397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699365, "uuid": "915fd320-3813-4eb1-9781-2430ed884691", "value": "12288:CW3oY/FJ9AfZ34xRK9YKLXlOO9t9tnJyzWA0Bm:JoAAZN9vOctnJZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622699365, "uuid": "bf7b9fdb-2766-4e34-bd02-26969ca6ff8b", "value": 506801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622699365, "uuid": "71548cf6-7fb8-47b8-9931-d62fa50fc517", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622699365, "uuid": "256335a7-3cdc-4e89-87b6-cd07a48211f2", "value": "new order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b4482f-c471-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622727666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727666, "uuid": "e6ceb116-207c-4fc6-bd51-c3d5441e2814", "comment": "Malware payload", "value": "dab6dc5531d329a0d22bded61c6ea2b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727666, "uuid": "59e95b12-340a-4c82-87b3-d072062ec6f3", "comment": "Malware payload", "value": "ffe53e36304bc25aa703cae5c4930d809031e5aa84fd6b4e4179932f82ae38f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727666, "uuid": "d25f1ee7-b8ae-43ff-91c3-edb287314889", "comment": "Malware payload", "value": "1a8da75eab37601bf45d53adb2626d3ea4e8ba23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622727666, "uuid": "8e9a6a86-0588-4e26-a4e6-790ab9e9520a", "comment": "Malware payload", "value": "1bcd962e765955d2f8f4058bc023079c7d79e3b46fc1c0c1a97bb1f3351640d23e32878f0a66cfb1bdf879c4eb01b4e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727666, "uuid": "86c1681b-fd83-4c37-98a4-e44b6edea1b7", "value": "DF433A451538AF42C4CCD3F884BD5AD9F592B1C700A2A45C97E2D173696B78EC9F8B34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727666, "uuid": "466f97b3-e1a5-4d4d-9c8a-e7937e7f4e03", "value": "62ec3dce1eba1b68f6a4511bb09f8c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727666, "uuid": "d6d7f1cc-743e-4da4-8061-c3d7601a4fee", "value": "768:8yZjENCC0jNPWCan2jwd24FFwqn+5nUef8HQiA2R8HiDhBYkACor7utW2p/1H5WT:8qgCHphgdBFFwqnqUtJZFIuQ2L0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622727666, "uuid": "d7cc3720-b222-4438-92e3-3e76acaa4ce5", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622727666, "uuid": "6c5dbc72-5736-4571-ba74-73455a7711dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622727666, "uuid": "ca04c2f0-f7a5-49cd-8f21-092e1d7431a0", "value": "ffe53e36304bc25aa703cae5c4930d809031e5aa84fd6b4e4179932f82ae38f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }